1
00:00:00,720 --> 00:00:01,560
In this lesson,

2
00:00:01,560 --> 00:00:04,260
we will cover privileged access management.

3
00:00:04,260 --> 00:00:06,390
Privileged access management, or PAM,

4
00:00:06,390 --> 00:00:08,580
is a solution that helps organizations restrict

5
00:00:08,580 --> 00:00:12,300
and monitor privileged accounts within an IT environment.

6
00:00:12,300 --> 00:00:14,610
Privileged access management is a critical aspect

7
00:00:14,610 --> 00:00:16,530
of any organization security framework

8
00:00:16,530 --> 00:00:18,960
because it can help to prevent data breaches

9
00:00:18,960 --> 00:00:21,240
by providing the least privileged access necessary

10
00:00:21,240 --> 00:00:23,910
to complete any given task or role.

11
00:00:23,910 --> 00:00:26,340
Privileged access management refers to the policies,

12
00:00:26,340 --> 00:00:28,230
procedures, and technical controls

13
00:00:28,230 --> 00:00:30,210
that are used to prevent the malicious abuse

14
00:00:30,210 --> 00:00:32,640
of privileged accounts and to mitigate risk

15
00:00:32,640 --> 00:00:35,760
from weak configuration control over privileges.

16
00:00:35,760 --> 00:00:37,290
Privileged access management consists

17
00:00:37,290 --> 00:00:40,410
of three key components: just-in-time permissions,

18
00:00:40,410 --> 00:00:43,740
password vaulting, and temporal accounts.

19
00:00:43,740 --> 00:00:46,320
First, we have Just-In-Time permissions.

20
00:00:46,320 --> 00:00:49,170
Just-In-Time permissions, or JIT permissions,

21
00:00:49,170 --> 00:00:52,470
is a security model where administrative access is granted

22
00:00:52,470 --> 00:00:54,870
only when needed for a specific period.

23
00:00:54,870 --> 00:00:57,655
This approach minimizes the risk of unauthorized access

24
00:00:57,655 --> 00:01:02,040
or misuse of administrative privileges on a given system.

25
00:01:02,040 --> 00:01:05,129
For example, if an administrator just need to perform

26
00:01:05,129 --> 00:01:08,250
a maintenance task on a server, just-in-time permissions

27
00:01:08,250 --> 00:01:10,440
would grant them the necessary access rights

28
00:01:10,440 --> 00:01:12,900
when the task begins, and then those access rights

29
00:01:12,900 --> 00:01:15,330
will be revoked as soon as the task is complete.

30
00:01:15,330 --> 00:01:18,180
This way, the administrator doesn't have continuous,

31
00:01:18,180 --> 00:01:19,800
unnecessary privileged access

32
00:01:19,800 --> 00:01:22,980
to your organization's sensitive systems and data.

33
00:01:22,980 --> 00:01:25,080
Second, privileged access management

34
00:01:25,080 --> 00:01:28,050
uses password vaulting to secure your systems.

35
00:01:28,050 --> 00:01:30,360
Password vaulting is a technique used to store

36
00:01:30,360 --> 00:01:32,580
and manage passwords in a secure environment,

37
00:01:32,580 --> 00:01:34,620
such as a digital vault that requires

38
00:01:34,620 --> 00:01:38,160
multi-factor authentication to access the stored passwords.

39
00:01:38,160 --> 00:01:41,280
For example, Dion Training uses a shared password vault

40
00:01:41,280 --> 00:01:43,680
to store the credentials of our privileged accounts

41
00:01:43,680 --> 00:01:45,900
like our administrative accounts in Windows

42
00:01:45,900 --> 00:01:48,840
or our root accounts for our Linux servers.

43
00:01:48,840 --> 00:01:50,610
When an authorized system administrator

44
00:01:50,610 --> 00:01:53,370
needs to use one of these privileged sets of credentials,

45
00:01:53,370 --> 00:01:55,620
they must go through a secure process to access them

46
00:01:55,620 --> 00:01:58,020
from the vault, which includes logging their access

47
00:01:58,020 --> 00:02:00,000
to those credentials so that there's a record

48
00:02:00,000 --> 00:02:02,880
of who is using those credentials and when.

49
00:02:02,880 --> 00:02:04,500
Third, we have the use of temporal accounts

50
00:02:04,500 --> 00:02:06,180
in privileged access management.

51
00:02:06,180 --> 00:02:08,729
Temporal accounts, also known as temporary accounts,

52
00:02:08,729 --> 00:02:11,940
are used to provide time-limited access to resources.

53
00:02:11,940 --> 00:02:14,070
They are created for a specific purpose

54
00:02:14,070 --> 00:02:16,500
and they're automatically disabled or deleted

55
00:02:16,500 --> 00:02:18,600
after a certain period of time.

56
00:02:18,600 --> 00:02:21,450
For example, a contractor might be given a temporal account

57
00:02:21,450 --> 00:02:22,770
to access the company's network

58
00:02:22,770 --> 00:02:25,620
for the duration of a software installation project.

59
00:02:25,620 --> 00:02:27,150
Once this project is completed,

60
00:02:27,150 --> 00:02:29,280
the account will be automatically deactivated

61
00:02:29,280 --> 00:02:31,740
to ensure that this contractor no longer has access

62
00:02:31,740 --> 00:02:34,050
to your organization's network or systems.

63
00:02:34,050 --> 00:02:37,650
So remember, privileged access management, or PAM,

64
00:02:37,650 --> 00:02:40,890
refers to the policies, procedures, and technical controls

65
00:02:40,890 --> 00:02:43,020
that are used to prevent the malicious abuse

66
00:02:43,020 --> 00:02:45,360
of privileged accounts and to mitigate risk

67
00:02:45,360 --> 00:02:48,510
from weak configuration controls over privileges.

68
00:02:48,510 --> 00:02:51,300
Privileged access management consists of three components:

69
00:02:51,300 --> 00:02:53,790
just-in-time permissions, password vaulting,

70
00:02:53,790 --> 00:02:55,560
and temporal accounts.

71
00:02:55,560 --> 00:02:58,440
Just-in-time permissions grant administrative access

72
00:02:58,440 --> 00:03:01,590
only when needed and for a specific period of time.

73
00:03:01,590 --> 00:03:03,300
Password vaulting is a secure method

74
00:03:03,300 --> 00:03:05,310
to store and manage passwords.

75
00:03:05,310 --> 00:03:07,590
And temporal accounts are time-limited accounts

76
00:03:07,590 --> 00:03:09,360
created for a specific purpose

77
00:03:09,360 --> 00:03:11,400
and are automatically disabled or deleted

78
00:03:11,400 --> 00:03:12,780
after a certain period of time

79
00:03:12,780 --> 00:03:15,090
to ensure that access to sensitive resources

80
00:03:15,090 --> 00:03:17,703
no longer exists once the project is complete.