PAM: How to Reduce the Risk of Privileged Accounts
A compromised user is a leak within the boundaries of his rights. Compromised administrator - ability to disable logging and delete backups.
Why privileged access is a separate issue
A regular account gives access to data. Privileged gives access to system that manages this data: to the security tool, to the database, to the hypervisor, to backup copies. The difference is in the consequences: a compromised user is a leak within the boundaries of his rights; a compromised administrator is an opportunity to turn off logging, change rights, delete backups and go unnoticed.
Therefore, privileged access is allocated to a separate control loop. Not because administrators are not trusted, but because The usual “set and forget” logic does not work for this access class: five people know the password for the built-in account, two of them quit, and rotation is impossible because it is written in three scripts.
Inventory: what is generally considered privileged
The most common mistake is to consider only domain administrators privileged. The real list is wider, and half of it is not visible in the user directory.
| Type | Where does he live? | Why is it dangerous? |
|---|---|---|
| Domain and directory administrators | Active Directory, LDAP | Full control over the authentication of the entire infrastructure |
| Local administrators | Workstations and servers | The same password on hundreds of machines gives horizontal movement |
| Built-in DBMS accounts | sa, postgres, sys | Often without owner, password in application configuration |
| Service accounts | Services, schedulers, integrations | They haven’t changed for years, rights accumulate, rotation breaks productivity |
| SSH keys | Home directories, images, repositories | They have no expiration date and are copied along with the image. |
| API Tokens and CI Secrets | Build pipelines, secret managers, code | Give access to the product on behalf of automation |
| Security Administrators | SIEM, firewalls, antivirus | Can disable monitoring of their own actions |
| Virtualization and backup administrators | Hypervisor, SRK | Access to all systems at once, bypassing their own rights |
| Contractor Accounts | VPN, terminal servers | External entity in the loop, often with perpetual access |
| Emergency (break-glass) | Safe, envelope, secrets manager | Rarely needed, but must be - and must be controlled |
Inventory is the first and most underestimated step: before it, talking about choosing a product is pointless. We do it within comprehensive IS audit.
What does PAM do technically?
Behind the abbreviation is a set of mechanisms. It is useful to understand them separately: some give an effect immediately, some require a restructuring of processes.
Secrets Vault and Rotation
Passwords for privileged accounts cease to exist in heads and configurations: they lie in a secure storage and are changed on a schedule or after each use. The key consequence is that the dismissal of an administrator ceases to be an incident.
Breaking direct access
The administrator does not connect to the server, but to the broker, which itself establishes the connection. The user does not see the password at all. This also covers a whole class of attacks: there is no point in stealing credentials from an administrator’s workstation.
Recording sessions
Video recording and text log of commands. The value is not in supervision, but in analysis: after the incident, it is clear what exactly was done in the system and in what sequence. For critical systems, real-time analysis with the ability to interrupt the session is also useful.
Access on demand (JIT)
Rights are not issued forever, but for the duration of the task and with justification. There are only a few permanent administrators instead of dozens. This is the most visible mechanism for people - and the main source of resistance if introduced without explanation.
Administrator workstation isolation
Administrative operations are performed from a dedicated machine or in an isolated environment, rather than from the same station as mail and browser. The measure is complemented by control at the end points - Endpoint Security.
Link to monitoring
PAM events - login, elevation, access to secret, abnormal time - go to SIEM. Without this, PAM remains a password store, not a discovery tool.
Implementation procedure
- Stage 1. Inventory and owners. A complete list of privileged accounts with the person responsible for each. Already at this step, part of the risk is closed: usually there are 10–20% of records that are simply not needed.
- Stage 2. Critical segment. Not all systems are taken under control at once, but the most sensitive ones: directory, backup, security tools, productive bases. Trying to cover the entire park in one go stretches out the project for years.
- Stage 3. Breaking direct access and recording sessions. Gives an immediate effect for auditing and analyzing incidents, almost without changing the habits of administrators.
- Stage 4. Rotation. It starts with interactive accounts, then service accounts. Service ones require caution: changing the service password without updating the dependencies crashes the product, so first you need a dependency map.
- Stage 5. Access on request. Transition to temporary rights. Requires an agreed upon confirmation process and a clear SLA, otherwise administrators will find a workaround - and they will be right.
- Stage 6. Contractors and automation. External Actors and Pipeline Accounts come last because they do the most integration work.
Errors that cause the project to stall
- We started with the product, not the inventory. Licenses were purchased for 200 accounts, real ones - 900.
- Bypassed emergency access. If the break-glass is not thought out, at the first serious failure PAM will be bypassed - and the bypass will remain forever.
- Rotation of service accounts without a dependency map. The classic reason for overnight downtime.
- We record sessions, but no one watches them. A record without sampling and without correlation rules is an archive, not a security measure.
- Administrators were not involved in the project. Implementation without them provides formal coverage and informal workarounds.
- The local administrator is not closed. As long as all stations have the same local password, control by domain administrators is almost meaningless.
Metrics
- Percentage of privileged accounts under management - from inventory, not from license.
- Number of permanent administrators — should fall as we move to on-demand access.
- Age of the oldest unrotated password - one figure showing the real state.
- Share of sessions passed through the broker - workarounds can be seen here.
- Time to revoke access upon dismissal - from personnel events to actual blocking.
- Number of accounts without owner - goal zero is achieved surprisingly rarely.
What do regulators require?
Privileged access management is not a voluntary practice: identification, authentication, and access control measures are required across multiple loops.
- Significant CII objects. Access control, event registration and control of administrator actions are part of the measures under Federal Law No. 187-FZ - "Protection of CII / Federal Law No. 187-FZ".
- Personal data information systems. Access control and recording of security events are mandatory regardless of the level of security - “Federal Law No. 152-FZ and personal data”.
- State systems. Security class requirements include account management and privilege control - "GIS protection".
- Industry standards. For the financial sector, the Central Bank is adding requirements for monitoring the actions of administrators and storing logs.
Checklist
- There is an up-to-date list of privileged accounts of all types, including SSH keys and automation tokens.
- Each entry has an owner and a reason for its existence.
- Passwords for built-in and service accounts are not stored in configurations and scripts.
- Local administrators at stations have different passwords.
- Administrative access to critical systems goes through a broker, direct access is closed by network rules.
- Administrators' sessions are recorded, and some are selectively analyzed.
- Permanent rights have been replaced by issuance upon request, at least in the critical segment.
- Emergency access has been thought out and tested, and its use is recorded.
- PAM events are included in information security monitoring and participate in correlation rules.
- Revocation of access upon dismissal or change of role occurs automatically based on a personnel event.
- Contractor access is limited by time and by the list of systems.
How we connect
Capability IDM and Access Management: Implementing IDM, IAM and PAM closes both the account life cycle and the privilege loop: from inventory and target role model to implementation and handover.
- Survey and inventory - comprehensive IS audit.
- Project stage - HLD and LLDso that rotation of service accounts does not turn into downtime; about why this is important - separate material.
- Implementation and acceptance - "Implementation of information security".
- Checking the result from outside - pentest: Horizontal movement and privilege escalation are checked this way.
We need analysis of your environment - write to us.
Let's discuss your environment
Describe the task, current systems, constraints, and expected results. We will offer a practical first step: diagnostics, pilot, audit, roadmap or project team.
