Privileged Access Management (PAM)
Privileged access management (PAM) is the combination of tools and technology used to secure, control and monitor access to an organization's critical information and resources. Subcategories of PAM include shared access password management, privileged session management, vendor privileged access management (VPAM) and application access management.
Privileged user accounts are significant targets for attack as they have elevated permissions, access to confidential information and the ability to change settings. If compromised, a large amount of damage could be done to organizational operations. Types of accounts that implement PAM can include emergency cybersecurity procedure, local administrative, Microsoft Active Directory, application or service, and domain administrative accounts.
Why is PAM important?
Implementing a PAM system helps organizations effectively monitor the entire network and provides insight into which users have access to what data.
A PAM system is one of the best ways for an organization to protect against external threats by preventing malicious parties from accessing sensitive corporate data through internal accounts.
PAM is critical because privileged accounts can pose major security risks to businesses. For example, a cybercriminal who compromises a standard user account will only have access to that specific user's information. But a hacker who compromises a privileged user account will have far greater access and possibly the power to destroy systems.
In addition to combating external attacks, PAM can help companies combat threats -- either malicious or inadvertent - originating from employees and other internal people with access to corporate data.
PAM is also key to achieve compliance with industry and government regulations. With PAM as part of a complete security and risk management program, enterprises can record and log every activity related to their critical information technology (IT) infrastructures and sensitive corporate data, helping to simplify audit and compliance requirements.
PAM software and tools work by gathering the credentials of privileged accounts, also known as system administrator accounts, into a secure repository to isolate their use and log their activity. The separation is intended to lower the risk of admin credentials being stolen or misused. Some PAM platforms do not allow privileged users to choose their own passwords. Instead, the password manager of the platform will tell admins what the password is for a given day or issue one-time passwords each time an admin logs in.
Features
- Password vaulting
- Password management: auto-generation, rotation, and workflow approval
- Multi-factor authentication
- Access for remote employees and third parties
- Mobile access points
- Session management
- Real-time visibility and alerting
- Disaster recovery
- Emergency access
- Auditing and reporting