Cyberstudy
PDF p.100 In progress

Privileged Access Management

Open PDF at p.100 20 flashcards

Summary

PDF p.100

Privileged access management (PAM) involves policies, procedures, and technical controls to prevent the compromise of privileged accounts. These accounts can make significant configuration changes and manage critical systems. PAM aims to restrict the number of privileged accounts, enforce strong credential management, and implement just-in-time (JIT) permissions.

In plain words

Supplementary — not from your PDF

Privileged accounts (admins, service accounts) can change everything, so they need extra protection: fewer of them, strong MFA, dedicated secure admin workstations, and just-in-time access instead of permanent admin rights.

Detailed explanation

PDF p.100
  • Standard vs. Privileged Accounts
    • Standard Users: Limited privileges, can run programs and modify their own files.
    • Privileged Accounts: Can make significant configuration changes, manage network appliances, application servers, and databases.
  • Privileged Access Management (PAM)
    • Purpose: Prevents compromise of privileged accounts by identifying, documenting, and managing their use and credentials.
    • Account Restriction: Limits the number of administrative accounts to reduce the risk of compromise.
    • Credential Management: Requires strong passwords and ideally multifactor authentication (MFA) or passwordless authentication.
    • Secure Administrative Workstations (SAW): Low attack surface computers for administrative tasks.
  • Just-in-Time (JIT) Permissions
    • Zero Standing Privileges (ZSP): Elevated privileges are not assigned at log-in but must be explicitly requested and granted for a limited period.
    • Implementation Models
      • Temporary Elevation: Administrative rights granted for a limited period (e.g., UAC in Windows, sudo in Linux).
      • Password Vaulting/Brokering: Privileged accounts are "checked out" from a repository for a limited time, with justification and possible manual approval.
      • Ephemeral Credentials: Temporary accounts or group memberships created for specific tasks and then destroyed or disabled.
  • Application to Service Accounts
    • **PAM also applies to service accounts, ensuring they are managed and monitored similarly to human administrator accounts.

Important terms

taken from the text above
Standard Users
Limited privileges, can run programs and modify their own files.
Privileged Accounts
Can make significant configuration changes, manage network appliances, application servers, and databases.
Account Restriction
Limits the number of administrative accounts to reduce the risk of compromise.
Credential Management
Requires strong passwords and ideally multifactor authentication (MFA) or passwordless authentication.
Secure Administrative Workstations (SAW)
Low attack surface computers for administrative tasks.
Zero Standing Privileges (ZSP)
Elevated privileges are not assigned at log-in but must be explicitly requested and granted for a limited period.
Temporary Elevation
Administrative rights granted for a limited period (e.g., UAC in Windows, sudo in Linux).
Password Vaulting/Brokering
Privileged accounts are "checked out" from a repository for a limited time, with justification and possible manual approval.
Ephemeral Credentials
Temporary accounts or group memberships created for specific tasks and then destroyed or disabled.
PAM Privileged access management SAW Secure Administrative Workstations JIT Just-in-Time ZSP Zero Standing Privileges

Examples & real-world scenarios

Supplementary — not from your PDF
  • An admin 'checks out' a domain admin password from a vault for one hour.
  • Using a hardened admin-only PC (SAW) for server management.
  • Temporary group membership that expires automatically.

Scenario

After an audit finds 40 permanent domain admins, the company moves to zero standing privileges: admins request elevation when needed, with approval and logging.

Common mistakes

Supplementary — not from your PDF
  • Letting admins browse the web or read email with their admin accounts.
  • Forgetting that service accounts are privileged accounts too.

Practical skills

Supplementary — not from your PDF
  • Describe how just-in-time elevation works.

What I should remember

Key Points PDF p.100
  • Standard vs. Privileged Accounts
    • Standard Users: Limited privileges.
    • Privileged Accounts: Significant configuration capabilities.
  • Privileged Access Management (PAM)
    • Purpose: Prevents account compromise.
    • Account Restriction: Limits administrative accounts.
    • Credential Management: Strong passwords, MFA, passwordless authentication.
    • SAW: Secure workstations for admin tasks.
  • Just-in-Time (JIT) Permissions
    • Zero Standing Privileges: No automatic elevated privileges.
    • Models
    • Temporary Elevation: Limited period rights.
    • Password Vaulting/Brokering: Time-limited account access.
    • Ephemeral Credentials: Temporary accounts for specific tasks.
  • Service Accounts
    • PAM Application: Managed and monitored like human accounts.