What is a Privileged Access Management Tool?
Due to their access rights, privileged accounts are a critical target for attackers looking to extend their reach deeper throughout a targeted environment, from the smallest companies to large organizations.
Privileged Access Management (PAM) tools are software solutions designed to manage and secure privileged accounts and access within an organization. PAM tools help organizations mitigate security risks associated with unauthorized access and misuse of privileged accounts. These tools typically offer features like password management, access control, session monitoring, auditing, and more.
Related reading: Our Top 15 PAM Tools--they're free!
Privileged Access Management Tools: Features
According to Gartner (Magic Quadrant for Privileged Access Management, August 2020), Privileged Access Management tools offer one or more of the following features:
- Discover, manage, and govern privileged accounts (i.e., accounts with superuser/administrator privileges) on multiple systems and applications.
- Control access to privileged accounts, including shared and emergency access.
- Randomize, manage, and vault credentials (password, keys, etc.) for administrative, service, and application accounts.
- Provide single sign-on (SSO) for privileged access to prevent credentials from being revealed.
- Control, filter, and orchestrate privileged commands, actions, and tasks.
- Manage and broker credentials to applications, services, and devices to avoid exposure.
PAM tools fall into three categories:
- Privileged Account and Session Management (PASM)
- Privilege Elevation and Delegation Management (PEDM)
- Secrets Management
Privileged account and session management solutions provide protection by vaulting account credentials, enabling full-session recording at the vault-/gateway-level, and brokering access for users, services, and applications. Modern privileged account and session management solutions are characterized by being delivered as a cloud-architected, highly scalable service.
Privilege elevation and delegation management solutions, meanwhile, provide host-based command control (filtering) as well as privilege elevation and allow organizations to strengthen security by only granting admin rights for individual tasks, applications, or scripts that require them on a limited basis. This type of fine-grained capability allows an organization to effectively implement the principle of least privilege and provide workers with just enough access to do their jobs.
The final category of Privileged Access Management tools is secrets management software. These tools manage credentials and secrets for software applications as well as machines and programmatically manage them through APIs and SDKs.
Each of these tools needs to support a much more diverse IT ecosystem today than in the past. Legacy Privileged Access Management (PAM) solutions were effective when all privileged access was limited to systems located inside an organization’s network but are insufficient to meet the needs of the modern enterprise. PAM must now integrate with an ecosystem that includes Infrastructure-as-a-Service (IaaS) offerings such as Amazon Web Services (AWS) and Microsoft Azure, as well as DevOps tools like Puppet and Chef. It must also integrate with container solutions like Docker and Kubernetes.
Privileged Access Management is different from Identity and Access Management (IAM) focuses on handling authentication and authorization for all manner of accounts. PAM, however, is centered on privileged accounts, which have access to business-critical resources and data. Implemented properly, PAM systems reduce risk and enhance regulatory compliance efforts. With effective monitoring and management, organizations can detect malicious activity, eliminate orphaned accounts, and provide an audit trail necessary to demonstrate that the requirements of various standards and government regulations have been met.
Selecting your PAM tools
When selecting your privileged access management tools, you should ideally go for a vendor that offers privileged account and session management, privilege elevation and delegation management, as well as secrets management solutions that are fully integrated into an underlying PAM platform. This approach would allow you to grow with your business needs and minimize the amount of siloed point solutions you typically have to maintain to address all the different uses case associated with PAM.
Work you have done for one use case can easily be applied to another use case as the underlying data objects allow for reusability. This shortens time-to-value significantly. Another consideration in your selection process should be the vendor’s flexibility to offer you a client as well as a client-less approach to managing individual use cases. The client-based approach should establish a root of trust for your systems, providing granular, host-based access controls down to the command level, as well as host-based, DVR-like session monitoring that is more and more mandated by newer regulations.
Free Delinea PAM Tools:
Privileged Access Management Checklist
Privileged Access Management Policy Template
View our full range of professional PAM tools
Try Our Free IT Tools