Privileged Access Management (PAM) covers the tools and strategies used to secure accounts with elevated system access, preventing unauthorized use and reducing insider risk. PAM solutions go beyond standard password managers by controlling, monitoring, and auditing how privileged credentials are granted and used.
Privileged Access Management
We should not be sharing usernames and passwords, neither should we have shared accounts that are shared amongst multiple people. The problem is there are some of our most sensitive accounts that we end up sharing amongst the admin team, and this is very problematic.
First of all, let's understand what a privileged account is, and even more so, let's discuss what this word privilege means. Privilege means a special right, advantage or immunity granted to someone. So a privileged account is just an account that has a greater level of access, that has access to more things than the general account has.
It could be into software, it could be into computers, servers, hardware — really anything that has an account to it will have a privileged account, something with greater access into it. A great example of this is Linux. Linux has a root account to it. The root account is something that we use to do a greater level of administration, so we will log into a Linux machine with our regular account, but then, when we need to do certain things on that computer, we'll escalate it to these root privileges.
We should be taking greater care of these privileged accounts and this privileged access. When we have privileged access into machines, we need to take safeguards to make sure that we are treating that accordingly. There are specific PAM tools that we can use to manage privileged access — there are programs and software out there that allow us to do this.
Before we get into a privileged access management tool, let's take a look at regular password management with a password manager. In this case right here, we have a user that needs to gain access, privileged access, to a server. What they're going to do is take the username and password from a password manager and input it into this server right here.
The problem is that when we have privileged accounts — things like root accounts, where we can only have one and we have to share that amongst our admin team — this is problematic, because now what they see is the username and password, and they're entering it into the server. They can easily grab that information and store it, or be able to have access to all of the passwords. This is really problematic from a security standpoint. What happens if that employee leaves the company and now they still have access to all of those systems? What we would have to do is go and change all of the passwords on all of the systems to maintain a level of security, and this is a ton of work.
So regular password management and regular password managers aren't going to cut it. We have to use a special tool in order to manage these types of accounts.
The difference with a PAM tool is that it sits between the user and the server, so the user has to go through the PAM tool in order to gain this privileged access. A PAM tool can do this in many different ways. It could do it through password vaulting, it could do it with just-in-time permissions, or through ephemeral credentials.
The idea of password vaulting is that the password is vaulted. You can think of the vault as being just a safe, and it doesn't really come out of the safe, at least from the user's perspective. So the user never gains access to the password. Instead, what will happen is the user will go log into the system through the PAM tool, and the password just gets exposed to the system directly. The PAM tool is what is allowing the access into the system, and then the PAM tool is entering the credentials into the system, and that's how you gain this greater level of access.
There's also this idea of just-in-time permissions. Maybe it is your regular account that you're using to log into systems, but you need to have some sort of privilege-level access into the system. What this PAM tool is going to do is go in and change the permission levels that you have, so that when you go into it you can execute and do whatever you need to do on the system that this PAM tool has allowed you to do. It's going to escalate your privilege, and then once you've done what you do and you log out of the system, it will de-escalate your permissions. The next time you log into the system, you're not going to have that same level of access into it. So it's just whatever level you need to access at the time — it's going to give you that level of access.
There's also this idea of ephemeral credentials, temporary credentials. What happens here is you're going to ask and request into a system, the PAM tool is going to set up that credential account that's specifically just for that session, you'll use it to log into the system and gain access to whatever it is that you need in that system, and then once it's done it will remove that account from the system and you will no longer have access. So it's temporary credentials to log into the system.
Whichever method you're going to use, the great advantage of this is that you're going to have an accounting piece with this. What that means is that any action the user takes is going to get recorded into the system. So if something goes wrong with this system right here, then you can go and start researching, taking a look at this PAM tool, at what happened and where things went awry. You can implement this accounting piece to really audit things and have these checks and balances, and hold people accountable for the actions that they have.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →