{"id":31681,"date":"2022-03-08T11:00:00","date_gmt":"2022-03-08T16:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=31681"},"modified":"2024-01-29T14:06:24","modified_gmt":"2024-01-29T19:06:24","slug":"privileged-access-management","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/privileged-access-management","title":{"rendered":"Your Guide to Privileged Access Management (PAM)"},"content":{"rendered":"\n

At your company, if there were a data breach, would it be worse for the account to belong to your summer intern or your IT director? <\/p>\n\n\n\n

The question should be an easy one to answer. While a summer intern probably has limited access to your organization\u2019s applications and data, an IT director is much more likely to have a privileged<\/em> account, an account that, depending upon the resource in question, has access to more data, settings, or other \u201cprivileges\u201d that allow it to do more than a typical user account. In short, an account that would be catastrophic were it compromised. <\/p>\n\n\n\n

Cybercriminals tend to target these privileged accounts, since gaining access to them provides the keys to obtain sensitive data or systems. Gaining access to privileged accounts is often easier than breaking into the protected system directly (and less noticeable, since the account is supposed<\/em> to access the target data or system already). This becomes especially problematic when users (like the summer intern) have too many privileges built into their accounts.<\/p>\n\n\n\n

Since the implications of hacked privileged accounts are so severe, extra layers of security must be added to protect them. Privileged access management, or PAM, is an approach that incorporates processes, policies, and products to secure these critical accounts, and minimizes what cybercriminals can do with them if they\u2019re <\/em>compromised. <\/p>\n\n\n\n

In this article, we\u2019ll explain what PAM is, why you need it, and how to implement it in your security strategy. <\/p>\n\n\n\n

What Is Privileged Access Management? <\/h2>\n\n\n\n

PAM is a way to protect your user identities that have extended privileges beyond the typical employee. A privilege is anything a particular account can do<\/em>, like which IT resources it can access, the features available while using the IT resource, or the commands it can run against the underlying operating system of that resource.

If you\u2019re familiar with identity and access management (IAM)<\/a>, PAM is the counterpart that focuses exclusively on privileged accounts \u2014 those accounts with permissions and access beyond the average user. The concept of privileged access management revolves around how to protect accounts with uniquely powerful permissions, and it operates based on a principle called least privilege<\/em>. <\/p>\n\n\n\n

Least Privilege, Privileged Access, and PAM <\/h3>\n\n\n\n

To fully understand the concept of privileged access management, you first have to understand the principles PAM operates on: privileged access and least privilege<\/a>. <\/p>\n\n\n\n

Privileged access is defined as any user whose identity has access to accounts above and beyond the \u201cstandard\u201d user. These people, sometimes called superusers, may have some type of admin privileges, or access to sensitive information, like company financials for an accountant, or personnel files for an HR professional. <\/p>\n\n\n\n

Least privilege, on the other hand, is the concept of giving all users access to the fewest apps and accounts possible, without restricting what they need to do their job. <\/p>\n\n\n\n

Combining least privilege<\/em> and privileged access<\/em> together means that only certain accounts are privileged with the more sensitive information and admin rights, but all accounts have the most limited access possible at the same time. <\/p>\n\n\n\n

Following these two principles is what PAM is all about: managing who has privileged accounts while ensuring all<\/em> accounts have the least privileges necessary. <\/p>\n\n\n\n

Privileged Access Management Examples<\/h3>\n\n\n\n

The concept of PAM may seem a little nebulous and abstract at this point, so let\u2019s look at a few examples of PAM in action in a typical organization. <\/p>\n\n\n\n

An in-house IT administrator\u2019s account<\/strong> would be considered privileged<\/em>, since they typically have access to the underlying tools that manage user passwords, remote overrides, and the ability to push new software updates remotely.<\/p>\n\n\n\n

However, least privilege <\/em>would ensure this admin account can\u2019t access apps and servers not directly related to his or her job \u2014 meaning, this account can\u2019t see sensitive financial info or employee files. The system of deciding what this privileged account should and should not have access to, and how it\u2019ll be protected, is PAM. <\/p>\n\n\n\n

A CFO\u2019s account is privileged<\/em>,<\/strong> since he or she will be able to access all company financial documents, spreadsheets, and servers. But under least privilege<\/em>, even the CFO shouldn\u2019t be able to access IT admin resources, or cloud-based applications used by Marketing, for example.<\/p>\n\n\n\n

A contracted web designer<\/strong> \u2014 that is, someone who is hired externally on a project-by-project basis \u2014 may still have a privileged<\/em> account if they have access to the backend of the company website, for example. But the principle of least privilege<\/em> will ensure they can\u2019t access any employee-only resources or information. <\/p>\n\n\n\n

As you can see, privileged access isn\u2019t specifically limited to one pay grade or team. Any application or server that only a select group of employees can access has the potential to be considered \u201cprivileged,\u201d and must therefore be treated with caution. <\/p>\n\n\n\n

Why Is Privileged Access Management Important? <\/h2>\n\n\n\n

Now that the overall concept of PAM is fleshed out, it\u2019s important to also understand why it matters. <\/em>While there are myriad benefits for implementing a privileged access strategy, there\u2019s a few especially key upshots to be aware of. <\/p>\n\n\n\n

Greater User Visibility <\/h3>\n\n\n\n

Because the security of privileged accounts is so critical, IT admins need more visibility over them than an average user account. PAM can offer this oversight through solutions like user behavior analytics (UBE)<\/a> and session management. <\/p>\n\n\n\n

UBE tracks patterns in the user\u2019s computer habits, and constantly analyzes them for abnormalities that might suggest a threat, like an unauthorized person using the account. The software tracks specific \u201cpersonality quirks\u201d in the issued user\u2019s behavior, like typing speeds or patterns, for example, and compares them to an established baseline. If a break in the typical user\u2019s patterns is detected, the software notifies IT of the change.<\/p>\n\n\n\n

Session management, on the other hand, can set time restrictions on a user\u2019s ability to access certain apps and servers, similar to how computers at a public library have set internet surfing limits before you\u2019re kicked off. These time limits can increase security by forcing a user to log back in regularly, ensuring no unauthorized person is using the account.  <\/p>\n\n\n\n

Increased Identity and Access Management <\/h3>\n\n\n\n

While multi-factor authentication (MFA)<\/a> is increasing in popularity with the surge of more and more remote-first organizations, it still isn\u2019t the commonly accepted security standard it should be. But additional layers of security like MFA are more important than ever with privileged accounts.<\/p>\n\n\n\n

PAM deploys measures like MFA to create more barriers between cybercriminals and privileged accounts\u2019 sensitive information. While the time and inconvenience to the superuser is negligible, using MFA creates an account that is much, much more difficult to compromise. <\/p>\n\n\n\n

That\u2019s because it requires not only the typical username\/password login information, but that the user must enter an additional factor to be authenticated (think: a time-based one-time password [TOTP<\/a>] or a fingerprint scan<\/a> hackers are unlikely to be able to replicate). <\/p>\n\n\n\n

PAM also means tightening up your superusers\u2019 passwords, specifically ensuring they aren\u2019t repeating well-used passwords that may be associated with personal accounts from websites with unknown or questionable security practices. Enter: single sign-on (SSO)<\/a>. <\/p>\n\n\n\n

SSO allows users to log on to just one platform, and through that platform get automatic login access to all apps they need to use for a certain length of time. The \u201cpasswords\u201d used during the SAML handshake (or equivalent process) are typically highly complicated, computerized access keys, making them nearly impossible for cyberattackers to infiltrate. <\/p>\n\n\n\n

Risks of Not Implementing PAM <\/h3>\n\n\n\n

The most obvious risk of ignoring a PAM strategy is cyberattacks. Privileged account holders, more or less, hold the \u201ckeys to the kingdom.\u201d These accounts offer the utmost in user features and permissions, making them a natural target for criminals.<\/p>\n\n\n\n

And cybercriminals have long figured out that gaining access through legitimate accounts is an easier prospect than covertly exploiting a critical application or server remotely. That means not having a PAM strategy could mean unprecedented damage if these high-clearance identities were compromised.<\/p>\n\n\n\n

Beyond the risk from hackers, not creating a PAM strategy also makes compliance harder to satisfy. If you don\u2019t have one centralized platform to control your PAM strategy from, ensuring privileged account holders remain compliant with federal or industry regulations becomes more difficult, which can result in fines or worse. <\/p>\n\n\n\n

What\u2019s more, most PAM systems include password protection benefits like MFA and SSO that are hard to enforce without a foolproof strategy in place that all parties must comply with.  <\/p>\n\n\n\n

Developing a Privileged Access Management Strategy <\/h2>\n\n\n\n

At this point, if you\u2019re sold on the need for PAM, you\u2019re probably wondering where to start on designing your organization\u2019s strategy. While no strategy is one size fits all, here\u2019s a few tips to get you heading in the right direction.  <\/p>\n\n\n\n

Step 1: Amp Up Privileged Account Login Security <\/h3>\n\n\n\n

An easy first step for your PAM strategy is to increase the security requirements for access for privileged users. If your privileged accounts aren\u2019t currently under management, they need to be. That way, you have close oversight to ensure privileged users are following policies and security best practices, like:<\/p>\n\n\n\n