Privileged Access Management

Privileged access management, or PAM, controls how people and software obtain and use elevated access. A privileged identity can change security settings, create accounts, read protected data, deploy code, or interrupt a service. PAM places policy, credential protection, session control, and audit evidence around that power.

PAM is a focused part of identity and access management. General IAM establishes identities and ordinary application access. PAM concentrates on administrative accounts, root and local administrator access, cloud control-plane roles, database owners, emergency accounts, service accounts, automation identities, and other paths that can change a system's security state.

The control plane

A PAM design usually connects six functions:

Discovery and inventory find privileged accounts, credentials, roles, SSH keys, service accounts, and target systems. Each record needs an owner, purpose, scope, and lifecycle state.
Identity and authentication establish who or what is requesting access. Human administrators normally use a named identity and strong authentication rather than signing in directly with a shared administrator account.
Policy and workflow decide whether the requester may reach a target, with which role, for what reason, and for how long. High-risk requests can require approval, a ticket, or extra authentication.
Credential and privilege control vaults and rotates passwords or keys, injects a credential without revealing it, or creates temporary privilege for the approved window.
Session brokering places a controlled proxy between the requester and the target. The broker can enforce the destination and protocol, record activity, and terminate a session.
Audit and monitoring preserve request, approval, authentication, credential, session, and target events. Security teams correlate these records with target and identity logs.

These functions can exist in one platform or across several integrated systems. The security result depends on the entire path. A vault protects a password at rest, but it does not govern a direct login that bypasses the vault. A recorded proxy session improves attribution, but it does not remove an old standing role on the target.

Privileged Access Management

The control plane

Relevant careers