Privileged Access Management (PAM)

The turning point of an attack is almost always privilege escalation: the moment the attacker obtains administrative rights. Managing admin accounts is therefore a disproportionately high-impact area, far more so than the attention it usually receives.

The problem with admin accounts

Standing privilege. In most organisations an admin account is admin around the clock. If compromised, the attacker works with full rights immediately.

Daily use. If someone reads email and administers with the same account, a single phishing message suffices to lose the domain.

Shared accounts. A common admin account used by three people is not traceable: in an incident nobody knows who did what.

Traces on machines. Wherever an admin account signs in, credentials remain in memory and can be extracted. We covered this in detail in our Active Directory article.

What PAM solves

Vaulted passwords. Nobody knows the admin password: the system stores it, releases it on use, then rotates it immediately.

Just-in-time access. Privilege is not standing but activated on request, time-bound and justified. It expires by itself after use.

Session recording. What happens in an admin session can be reviewed. Useful not only in incidents but for troubleshooting.

Approval workflow. For critical systems, access can require a second person's approval.

Logging to a person rather than an account. Even shared account use becomes attributable, because PAM knows who requested it.

Where to start with no budget

PAM products are expensive, but most of the benefit is available more cheaply.

1. Separate admin accounts for every administrator, split from their daily account. Zero cost.

2. Tiered model: the domain admin account signs in only to domain controllers, never to workstations. Enforceable via group policy.

3. Jump server: administrative access through a single tightly protected machine, where logging and monitoring live.

4. Unique local admin passwords (LAPS in Windows environments). Free, and it stops one machine's compromise meaning the whole estate.

5. Just-in-time membership: most modern identity providers support time-bound privileged group membership. It is often included in the existing licence.

These five steps deliver a significant share of PAM's value without a new product. A full PAM solution becomes relevant with many third parties, strict audit expectations, or numerous shared service accounts.

What not to forget

Service accounts. These are privileged accounts too, just not used by humans. Long random passwords, narrow privilege, restricted sign-in locations. We covered this in our password management article.

The break-glass account. You need an account that works when PAM or the identity provider fails. Its password lives in a physical safe, and its use raises an alert.

Cloud admins. The cloud console administrator is as privileged as a domain admin, yet frequently falls outside PAM's scope.

Departures. When an administrator leaves, alongside revoking their access you must rotate service account passwords they knew.

What to measure

• How many standing administrative privileges exist (target: as few as possible, ideally zero)
• How many admin accounts are also used for daily work
• How many machines share a local admin password
• How long it takes to revoke a departing admin's access

Our IT security services include reviewing the privilege architecture and establishing a tiered model.