Privileged access management (PAM)
We bring administrator rights under control, replacing standing elevated privileges with temporary access that requires approval and is logged.
When you need it
Where admin accounts are an easy target
The turning point of an attack is almost always the moment the attacker gains administrator rights. These situations make the attacker's job easier.
Standing privileges
In most organizations an admin account is an admin around the clock. If it is compromised, the attacker immediately has full rights.
Admin account for daily work
When someone reads email and administers systems from the same account, a single phishing email is enough to lose the domain.
Shared admin account
A shared account cannot be traced back to a person: after an incident, nobody can tell who did what.
Credentials left on machines
Wherever someone signs in with an admin account, the credentials stay in memory and can be extracted from there.
What we build
Elevated rights only on request, and traceable
Administrators do their daily work with ordinary rights and receive elevated rights only for the task that needs them.
Temporary privileges
Just-in-time access: the right is activated on request, with a time limit and a stated reason, and it expires on its own after use.
Approval by a second person
For critical systems, access can be made subject to approval by a second person.
Logs tied to a person
Even the use of a shared account can be attributed to a named person, because the system knows who requested access.
Passwords in a vault
Nobody knows the admin password: the system stores it, releases it when needed, and rotates it right afterward.
Session recording
Whatever happens in an admin session can be played back, which helps both in incident response and in troubleshooting.
Deliverables
What you get at the end
items handed over
- Inventory of privileged accounts
- Privilege elevation and approval rules
- Logging of privileged operations
- Handover documentation
Related services
What surrounds elevated rights
PAM focuses on the most sensitive accounts. These services provide the access management and logging built around them.
Identity and access management (IAM)
All of your organization's access: who can reach what and with which authentication, and what happens when people join, change roles, or leave.
Active Directory review and hardening
An audit of the domain's permissions, accounts, and settings, followed by closing off the attack paths.
Log collection and alerting (SIEM)
Brings system logs together in one place, and the events it collects include changes to privileged group membership.
Microsoft 365 security hardening
Review and correction of the authentication, Conditional Access, and logging settings of your Microsoft 365 and Entra ID tenant.
Frequently asked questions
The questions we hear most
Do I need a dedicated PAM product for this?
Not always. You can get much of the benefit without a new product: a separate admin account for every administrator, a tiered model in which a domain admin can sign in only to domain controllers, a single tightly protected jump server for administrative access, a unique local admin password on every machine, and time-limited membership in privileged groups, which is often already included in your existing license. If you can take only one step, make it the separate admin account. A full PAM solution makes sense when many external parties are involved, audit requirements are strict, or there are a large number of shared service accounts. We set out the steps in our article on privileged access management (PAM).
What happens if the PAM system goes down?
For that case you need a break-glass account that works even when the PAM system or the identity provider is unavailable. Its password is kept in a physical safe, and any use of it triggers an alert.
How can I tell that things have improved?
From four metrics: how many standing administrator privileges remain (ideally none), how many admin accounts are also used for daily work, how many machines share the same local admin password, and how long it takes for a departing administrator's access to be removed.
