Introduction: The Keys to the Kingdom

In Lessons 6.1 through 6.3, we established the foundations of Identity and Access Management (IAM), explored authentication mechanisms, and analyzed authorization and access control models. We examined the core IAM concepts, the identity lifecycle, authentication factors, MFA, biometrics, certificates, RBAC, ABAC, DAC, and MAC. Each of these components contributes to managing digital identities and controlling access to resources.

However, there is a special category of access that requires exceptional security controls: privileged access. Privileged access is the ability to perform actions that bypass or override normal security controls. Users with privileged access—such as system administrators, database administrators, and security officers—have the “keys to the kingdom.” A compromise of privileged access can lead to catastrophic consequences: data breaches, system compromise, financial fraud, and regulatory fines.

Privileged Access Management (PAM) is the practice of managing, monitoring, and securing privileged access. It encompasses the tools, processes, and controls used to protect privileged accounts and ensure that privileged access is only used appropriately.

In financial institutions, PAM is of paramount importance because:

  • Privileged Accounts are the highest-value targets for attackers.

  • Regulatory Requirements mandate strong controls for privileged access (NYDFS, GLBA, PCI DSS).

  • Insider Threats with privileged access can cause significant damage.

  • Compliance requires auditing and monitoring of privileged access.

This lesson provides a comprehensive analysis of Privileged Access Management. We begin by examining Privileged Accounts, including types of privileged accounts and their risks. We derive the Privileged Account Risk Score: P_ARS = A_ccess * P_rivilege * I_mpact.

We then examine Privileged Access Management Controls, including least privilege, just-in-time access, and privileged access monitoring. We derive the PAM Effectiveness Score: P_ES = C_ontrols * M_onitoring * A_uditing.

We also examine Privileged Access Management Tools, including privileged access management platforms, privileged session management, and privileged account discovery. We derive the PAM Tool Score: P_TS = F_eatures * I_ntegration * U_sability.

By the end, you will have a complete understanding of Privileged Access Management, and be able to design and implement PAM for financial institutions.

Learning Objectives

Upon completion of this lesson, you will be able to:

  1. Analyze Privileged Accounts: Types, risks, and security considerations.

  2. Derive the Privileged Account Risk Score: P_ARS = A_ccess * P_rivilege * I_mpact.

  3. Analyze Privileged Access Management Controls: Least privilege, just-in-time access, and monitoring.

  4. Derive the PAM Effectiveness Score: P_ES = C_ontrols * M_onitoring * A_uditing.

  5. Analyze Privileged Access Management Tools: Platforms, session management, and discovery.

  6. Derive the PAM Tool Score: P_TS = F_eatures * I_ntegration * U_sability.

Part 1: Privileged Accounts

1.1 The Privileged Account Definition

A privileged account is an account that has elevated permissions, allowing the user to bypass or override normal security controls.

text
Privileged Account = {Account, Privileges, Access}

1.2 Types of Privileged Accounts

 
 
Account Type Description Examples
Administrative Accounts System and application administrators Domain Admin, Root, Local Admin
Service Accounts Accounts for services and applications Database accounts, application accounts
Emergency Accounts Accounts for emergency use Break-glass accounts
Application Accounts Accounts for applications Application-to-application accounts
Cloud Accounts Cloud administrator accounts AWS root, Azure Global Admin

1.3 Privileged Account Risks

 
 
Risk Description Impact
Account Compromise Privileged account compromised Full system compromise
Insider Abuse Insider with privileged access Fraud, data theft
Credential Theft Credentials stolen Lateral movement, privilege escalation
Misuse Privileged access used inappropriately Compliance violations
Lack of Monitoring Privileged access not monitored Undetected abuse

1.4 The Privileged Account Risk Score

The Privileged Account Risk Score quantifies the risk of privileged accounts:

text
P_ARS = A_ccess * P_rivilege * I_mpact

Where:

  • A_ccess is the Access Score (0-1)

  • P_rivilege is the Privilege Score (0-1)

  • I_mpact is the Impact Score (0-1)

 
 
Component Description Scoring Factors
Access (A) Level of access Scope, breadth, depth
Privilege (P) Level of privilege Permissions, capabilities
Impact (I) Potential impact Data, systems, financial
text
Privileged Accounts (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Administrative Accounts                                        ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Domain Admin                                                 ║  |
|  ║  • Root                                                         ║  |
|  ║  • Local Admin                                                  ║  |
|  ║  • Risk: Very High                                              ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Service Accounts                                               ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Database Accounts                                            ║  |
|  ║  • Application Accounts                                         ║  |
|  ║  • System Accounts                                              ║  |
|  ║  • Risk: High                                                   ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Emergency Accounts                                             ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Break-glass Accounts                                          ║  |
|  ║  • Emergency Admin                                              ║  |
|  ║  • Risk: High                                                   ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Application Accounts                                           ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Application-to-Application Accounts                          ║  |
|  ║  • Service-to-Service Accounts                                  ║  |
|  ║  • Risk: Medium-High                                            ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Cloud Accounts                                                 ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • AWS Root                                                     ║  |
|  ║  • Azure Global Admin                                           ║  |
|  ║  • GCP Organization Admin                                       ║  |
|  ║  • Risk: Very High                                              ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  Formula: P_ARS = A_ccess * P_rivilege * I_mpact                      │
└─────────────────────────────────────────────────────────────────────────┘

Part 2: Privileged Access Management Controls

2.1 The PAM Definition

Privileged Access Management (PAM) is the practice of managing, monitoring, and securing privileged access.

text
PAM = {Controls, Monitoring, Auditing}

2.2 PAM Controls

 
 
Control Description Implementation
Least Privilege Grant minimum necessary privileges Role-based access, just-in-time
Just-in-Time Access Grant access only when needed Time-limited access, approvals
Privileged Access Privileged access management PAM platforms, session management
Password Management Secure privileged passwords Password vaults, rotation
Session Management Monitor privileged sessions Session recording, monitoring

2.3 Just-in-Time Access (JIT)

Definition: Just-in-Time Access grants privileged access only when it is needed and for a limited time.

text
JIT = {Request, Approval, Duration, Revocation}

JIT Benefits:

 
 
Benefit Description
Reduced Attack Surface Privileges only available when needed
Auditability Access is logged and audited
Least Privilege Permissions granted only for specific tasks
Approval Access requires approval

2.4 The PAM Effectiveness Score

The PAM Effectiveness Score quantifies the effectiveness of PAM:

text
P_ES = C_ontrols * M_onitoring * A_uditing

Where:

  • C_ontrols is the Control Score (0-1)

  • M_onitoring is the Monitoring Score (0-1)

  • A_uditing is the Auditing Score (0-1)

 
 
Component Description Scoring Factors
Controls (C) Quality of PAM controls Least privilege, JIT, password management
Monitoring (M) Quality of monitoring Session monitoring, alerting
Auditing (A) Quality of auditing Logging, review, reporting
text
PAM Controls (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  Least Privilege                                                      │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Grant minimum necessary privileges                           │  │
|  │  • Role-based access                                             │  │
|  │  • Just-in-time access                                           │  │
|  │  • Benefits: Reduced attack surface, least privilege            │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  Just-in-Time Access (JIT)                                           │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Request → Approval → Duration → Revocation                  │  │
|  │  • Time-limited access                                          │  │
|  │  • Approval required                                            │  │
|  │  • Benefits: Reduced attack surface, auditability              │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  Privileged Access Management (PAM)                                 │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • PAM Platforms                                               │  │
|  │  • Session Management                                           │  │
|  │  • Password Vaults                                              │  │
|  │  • Benefits: Secure privileged access, monitoring              │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
|  Formula: P_ES = C_ontrols * M_onitoring * A_uditing                  │
└─────────────────────────────────────────────────────────────────────────┘

Part 3: Privileged Access Management Tools

3.1 The PAM Tool Definition

PAM tools are software solutions that provide privileged access management capabilities.

text
PAM Tools = {Platforms, Session Management, Discovery}

3.2 PAM Tool Capabilities

 
 
Capability Description Examples
Privileged Account Discovery Discover privileged accounts Automated discovery
Privileged Password Vaulting Store privileged passwords securely Encrypted vaults
Privileged Session Management Monitor and record privileged sessions Session recording
Just-in-Time Access Grant time-limited access Request/approval workflows
Privileged Access Workflows Workflow automation Approval, notification

3.3 PAM Tool Evaluation Criteria

 
 
Criteria Description Weight
Features Capabilities and functionality 40%
Integration Integration with existing systems 30%
Usability Ease of use and administration 30%

3.4 The PAM Tool Score

The PAM Tool Score quantifies the effectiveness of PAM tools:

text
P_TS = F_eatures * I_ntegration * U_sability

Where:

  • F_eatures is the Feature Score (0-1)

  • I_ntegration is the Integration Score (0-1)

  • U_sability is the Usability Score (0-1)

 
 
Component Description Scoring Factors
Features (F) Quality of features Discovery, vaulting, session management
Integration (I) Quality of integration APIs, connectors, compatibility
Usability (U) Quality of usability Interface, administration, reporting

3.5 PAM Tool Examples

 
 
Tool Description Key Features
CyberArk Privileged Access Management Password vaulting, session management, discovery
BeyondTrust Privileged Access Management Password vaulting, session management, discovery
Thycotic Privileged Access Management Password vaulting, session management, discovery
Okta Identity and Access Management MFA, SSO, privileged access
text
PAM Tools (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  CyberArk                                                       ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Password Vaulting                                            ║  |
|  ║  • Session Management                                           ║  |
|  ║  • Account Discovery                                             ║  |
|  ║  • Just-in-Time Access                                          ║  |
|  ║  • Reporting                                                    ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  BeyondTrust                                                   ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Password Vaulting                                            ║  |
|  ║  • Session Management                                           ║  |
|  ║  • Account Discovery                                             ║  |
|  ║  • Just-in-Time Access                                          ║  |
|  ║  • Reporting                                                    ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Thycotic                                                       ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Password Vaulting                                            ║  |
|  ║  • Session Management                                           ║  |
|  ║  • Account Discovery                                             ║  |
|  ║  • Just-in-Time Access                                          ║  |
|  ║  • Reporting                                                    ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Okta                                                           ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  • Identity and Access Management                               ║  |
|  ║  • MFA                                                           ║  |
|  ║  • SSO                                                           ║  |
|  ║  • Privileged Access                                            ║  |
|  ║  • Reporting                                                    ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  Formula: P_TS = F_eatures * I_ntegration * U_sability                 │
└─────────────────────────────────────────────────────────────────────────┘

Summary and Bridge to Lesson 6.5

We have now completed the comprehensive analysis of Privileged Access Management. You have learned:

  1. Privileged Accounts: Types, risks, and security considerations.

  2. Privileged Account Risk Score: P_ARS = A_ccess * P_rivilege * I_mpact.

  3. Privileged Access Management Controls: Least privilege, just-in-time access, and monitoring.

  4. PAM Effectiveness Score: P_ES = C_ontrols * M_onitoring * A_uditing.

  5. Privileged Access Management Tools: Platforms, session management, and discovery.

  6. PAM Tool Score: P_TS = F_eatures * I_ntegration * U_sability.

In Lesson 6.5, we will explore Identity Governance and Administration (IGA) for financial institutions, including identity lifecycle management, access certification, and compliance

PreviousNext