Privileged access management (PAM) is software that controls the accounts that can change anything in a company's systems. It keeps their passwords in a vault, hands each account out for one recorded session at a time, and changes the password afterwards. These all-powerful accounts are called privileged accounts. Examples are the root account on a Linux server, the domain administrator in the directory services and the administrator account of a database.
Why do these accounts need their own product? An ordinary account can damage only what its owner works on. A privileged account can delete a database, create new users or switch off security software. Attackers who get into a company look for these accounts first. In the past, several administrators often shared one password for such an account. It was written in a spreadsheet, and it was never changed.
PAM replaces this with four steps. First, the vault holds the password, and no person knows it. Second, an administrator who needs the account asks for it, and gives a reason, such as the number of an approved change ticket. Third, after approval, PAM opens the session for the administrator without showing him the password, and records the session. Fourth, when the session ends, PAM changes the password, so that the old one no longer works anywhere.
Take, for example, a database administrator at a telecom operator in Gurugram. At 11 p.m., he must change the structure of a table in the billing database, under an approved change ticket. He signs in to PAM through single sign-on (SSO), and PAM asks for a second proof through multi-factor authentication (MFA). He requests the database's administrator account for two hours and types the ticket number. His manager approves the request on her phone. PAM connects him to the database, and he spends 42 minutes on the change. Every command he types is captured by privileged session recording. At 11:45 p.m., he closes the session, and PAM sets a new random password for the account.
Programs need privileged access too. A program that reads a database needs a password or a key. PAM products keep these in secrets management, so that the passwords are not written inside the program's code. PAM also sends a record of every session and every password change to the SIEM.
PAM puts least privilege into practice for the most powerful accounts. Many products now go one step further, with just-in-time access. The administrator has no standing rights at all. The rights are created for one session and removed when it ends.