In this lesson,
we will cover privileged access management.
Privileged access management, or PAM,
is a solution that helps organizations restrict
and monitor privileged accounts within an IT environment.
Privileged access management is a critical aspect
of any organization security framework
because it can help to prevent data breaches
by providing the least privileged access necessary
to complete any given task or role.
Privileged access management refers to the policies,
procedures, and technical controls
that are used to prevent the malicious abuse
of privileged accounts and to mitigate risk
from weak configuration control over privileges.
Privileged access management consists
of three key components: just-in-time permissions,
password vaulting, and temporal accounts.
First, we have Just-In-Time permissions.
Just-In-Time permissions, or JIT permissions,
is a security model where administrative access is granted
only when needed for a specific period.
This approach minimizes the risk of unauthorized access
or misuse of administrative privileges on a given system.
For example, if an administrator just need to perform
a maintenance task on a server, just-in-time permissions
would grant them the necessary access rights
when the task begins, and then those access rights
will be revoked as soon as the task is complete.
This way, the administrator doesn't have continuous,
unnecessary privileged access
to your organization's sensitive systems and data.
Second, privileged access management
uses password vaulting to secure your systems.
Password vaulting is a technique used to store
and manage passwords in a secure environment,
such as a digital vault that requires
multi-factor authentication to access the stored passwords.
For example, Dion Training uses a shared password vault
to store the credentials of our privileged accounts
like our administrative accounts in Windows
or our root accounts for our Linux servers.
When an authorized system administrator
needs to use one of these privileged sets of credentials,
they must go through a secure process to access them
from the vault, which includes logging their access
to those credentials so that there's a record
of who is using those credentials and when.
Third, we have the use of temporal accounts
in privileged access management.
Temporal accounts, also known as temporary accounts,
are used to provide time-limited access to resources.
They are created for a specific purpose
and they're automatically disabled or deleted
after a certain period of time.
For example, a contractor might be given a temporal account
to access the company's network
for the duration of a software installation project.
Once this project is completed,
the account will be automatically deactivated
to ensure that this contractor no longer has access
to your organization's network or systems.
So remember, privileged access management, or PAM,
refers to the policies, procedures, and technical controls
that are used to prevent the malicious abuse
of privileged accounts and to mitigate risk
from weak configuration controls over privileges.
Privileged access management consists of three components:
just-in-time permissions, password vaulting,
and temporal accounts.
Just-in-time permissions grant administrative access
only when needed and for a specific period of time.
Password vaulting is a secure method
to store and manage passwords.
And temporal accounts are time-limited accounts
created for a specific purpose
and are automatically disabled or deleted
after a certain period of time
to ensure that access to sensitive resources
no longer exists once the project is complete.