Privileged Access Management (PAM) is a critical element of enterprise security, a strategy that ensures the right people, once authenticated, are able to utilize system accounts with elevated privileges via a proxy layer rather than sharing credentials. In a normal organization that sees daily onboarding of resources and changes to access, administration of PAM systems can become a high-volume activity.
In addition, PAM integrations often involve configuration with automated actions, each requiring periodic tuning and health checks.
Management of PAM can be made easier with the assistance of a managed services group like Novacoast to lighten the load.
PAM FAQ
What is Privileged Access Management?
Privileged Access Management, or PAM, is a method of securing privileged user accounts by adding a layer of abstraction between the accounts and actual human user logins.
The idea is to insulate privileged accounts, an example of which would be a “root” user on a Unix or Linux system, from employee users. A common security breach scenario involves a privileged account, i.e. a powerful account with permissions to make critical changes to a system, being compromised by credentials that are assigned to an actual human user.
Privileged accounts usually serve a purpose, rather than a real user. It might be a service account that exists to run certain processes, or ad administrator account with permissions that allow it control over a system configuration. With PAM, the idea is to abstract the purpose from the person.
It’s common for a privileged account to be shared by many users, using a middle layer that grants access from a human user to the privileged account. Management of access to privileged accounts is an administrative role that performs tasks such as new user onboarding, change of access level, and periodic review and validation of configuration and/or automation.
What is co-management of PAM?
Managing a PAM integration is a labor-intensive endeavor. Constant changes to access for human users, onboarding new ones, all the while monitoring the PAM integration itself to verify automated processes are healthy and functioning as designed – the effort can be substantial.
If an organization is understaffed to handle the load, productivity and/or security can suffer. And if the system requires maintenance or configuration changes, security engineers will be needed.
A common solution is to utilize a managed services group to augment the efforts of the internal team. The administration and request processing workload can be alleviated with manpower.
If configuration changes to the PAM vendor product are needed, or security patching and upgrades become necessary, the MSS provider can perform them. If unanticipated technical problems arise, engineers can troubleshoot and repair.
PAM has become such a critical element of enterprise security that organizations should have some type of support in place, even if it’s not utilized daily.
