1 Introduction
In the age of digital transformation, not only the requirements for IT, but also the way IT is done, are constantly evolving. To remain relevant, organizations must reinvent themselves by being agile and more innovative. Emerging technology initiatives such as digital workplace, DevOps, security automation and the Internet of Things continue to expand the attack surface of organizations as well as introduce new digital risks. To stay competitive and compliant, organizations must actively seek newer ways of assessing and managing the security risks without disrupting the business. Security leaders, therefore, have an urgent need to constantly improve upon the security posture of the organization by identifying and implementing appropriate controls to prevent such threats.
Privileged Access Management (PAM) represents the set of critical cybersecurity controls that address the security risks associated with the use of privileged access in an organization. There are primarily two types of privileged users:
- Privileged Business Users - those who have access to sensitive data and information assets such as HR records, payroll details, financial information, company’s intellectual property, etc. This type of access is typically assigned to the application users through business roles using the application accounts.
- Privileged IT Users – those who have access to IT infrastructure supporting the business. Such access is generally granted to IT administrators through administrative roles using system accounts, software accounts or operational accounts.
The privileged nature of these accounts provides their users with an unrestricted and often unmonitored access across the organization’s IT assets, which not only violates basic security principles such as least privilege but also severely limits the ability to establish individual accountability for privileged activities. Privileged accounts pose significant threat to the overall security posture of an organization because of their heightened level of access to sensitive data and critical operations. Security leaders therefore need stronger emphasis on identifying and managing these accounts to prevent the security risks emanating from their misuse.
At KuppingerCole, we define PAM solutions to constitute of following key tools and technologies:
- Shared Account Password Management (SAPM): Shared Account Password Management offers technology to securely manage privileged credentials including system accounts, service accounts or application accounts that are generally shared in nature.
- Privileged Session Management (PSM): Privileged Session Management offers the technology to establish a privileged session to target systems including basic auditing and monitoring of privileged activities.
- Application-to-Application Password Management (AAPM): AAPM is an extension of SAPM tools to manage accounts used by an applications or systems to communicate with other applications or systems (such as databases etc.).
- Session Recording and Monitoring: SRM is an extension of PSM tools to offer advanced auditing, monitoring and review of privileged activities during a privileged session, including but not limited to key-stroke logging, video session recording, screen scraping, OCR translation and others.
- Controlled Privilege Elevation and Delegation Management (CPEDM): Technology that deals with controlled elevation and policy-based delegation of a users’ privileges to super-user privileges for administrative purposes.
- Privileged User Behavior Analytics (PUBA): PUBA uses data analytic techniques to detect threats based on anomalous behavior against established behavioral profiles of administrative groups.
- Endpoint Privilege Management (EPM): EPM offers capabilities to manage threats associated with local administrative rights on windows, mac or other endpoints. EPM tools essentially offer controlled and monitored escalation of user’s privileges on endpoints.
- Privileged Access Governance (PAG): PAG deals with offering valuable insights related to the state of privileged access necessary to support decision making process. PAG includes privileged access certifications and provisions for customizable reporting and dashboarding.
While credential vaulting, password rotation, controlled elevation and delegation of privileges, session establishment and activity monitoring have been the focus of attention for PAM tools, more advanced capabilities such as privileged user analytics, risk-based session monitoring and advanced threat protection are becoming the new norm - all integrated into comprehensive PAM suites being offered. We see a growing number of vendors taking different approaches to solve the underlying problem of restricting, monitoring, and analyzing privileged access and the use of shared accounts.
Among the key challenges that drive the need for privilege management are:
- Abuse of shared credentials
- Abuse of elevated privileges by authorized users
- Hijacking of privileged credentials by cyber-criminals
- Abuse of privileges on third-party systems
- Accidental misuse of elevated privileges by users
Furthermore, there are several other operational, governance and regulatory requirements associated with privileged access:
- Discovery of shared accounts, software and service accounts across the IT infrastructure
- Identifying and tracking of ownership of privileged accounts throughout their life-cycle
- Establishing Single Sign-on session to target systems for better operational efficiency of administrators
- Auditing, recording and monitoring of privileged activities for regulatory compliance
- Managing, restricting, and monitoring administrative access of IT outsourcing vendors and MSPs to internal IT systems
- Managing, restricting, and monitoring administrative access of internal users to cloud services.
Consequently, multiple technologies and solutions have been developed to address these risks as well as provide better activity monitoring and threat detection. A specific area is the in-depth protection of server platforms such as Unix, Linux, and Windows. These focus on protecting the accounts such as “root” or “admin” on these systems as well as delivering in-depth protection against unwanted privilege elevation, altogether with capabilities of restricting the use, e.g., of specific shell commands. In addition, as more organizations adopt cloud applications or leverage cloud and virtual infrastructure, the PAM technologies must adapt to protect privileged access within these environments too.
For a detailed overview of the leading PAM vendors, please refer to the KuppingerCole Leadership Compass on Privilege Management .
