Privileged session recording is the part of privileged access management (PAM) that records everything done with a privileged account, so that the session can be watched live, searched and replayed later. A privileged account is one that can change anything on a system, such as a server's administrator account. The recording captures the screen as video, every command typed and every file transferred.
The recording works because PAM sits between the person and the system. The administrator does not connect to the server directly. He connects to PAM, and PAM opens the connection to the server on his behalf. Everything that passes between them goes through PAM, so PAM can record it. The person cannot switch the recording off, because it does not run on his own computer.
Consider a sugar mill in Kolhapur that hires an outside IT firm to maintain its accounting server. One evening, an engineer from the IT firm logs in through PAM to install an update. He has booked one hour. By minute 41, he has typed 212 commands. Then he types a command that deletes the server's audit log, the file in which the server records who did what. The mill's rules list this command as forbidden. PAM recognises the command, pauses the session and sends an alert to the SIEM. The mill's IT head opens the live session, sees what has happened, and ends it at 41 minutes 20 seconds. The next morning, the mill's team replays the recording together with the IT firm. The engineer says that he was only clearing disk space. The recording shows exactly which commands he ran, so both sides can check his explanation against the facts.
Recordings are also evidence. After an attack, digital forensics investigators can search the recordings for the account that the attacker used, and see each step that the attacker took. Auditors use recordings to check that administrators did only what an approved change ticket in the IT service desk allowed.
Recording is most common for outside staff, such as suppliers and contractors, because the company cannot watch over their computers. Vendor privileged access management makes recording compulsory for every supplier login. A recording does not stop an action by itself. It makes every action visible and tied to a named person. That is why privileged access management (PAM) combines it with approval before the session and a password change after it.