Privileged access management (PAM)
In identity security, privileged access management (PAM) is the set of controls applied specifically to the accounts that can change a system rather than use it: vaulting their credentials, brokering their sessions, granting rights only when needed and recording what was done. It is the control that breaks the routes an internal test finds.
How it works
Four capabilities carry the discipline. Vaulting stores privileged credentials centrally, rotates them and hands them out under policy, so no human knows the password of a shared administrative account. Session brokering makes administrators connect through an intermediary that establishes the session on their behalf, so the credential never reaches the workstation. Just-in-time elevation grants the privilege for a defined window against a stated reason and removes it automatically, which is least privilege applied to time rather than to scope. Recording and audit produce the evidence, which is what an ISO 27001 or ENS assessor asks to see.
Of the four, just-in-time elevation is the one that changes the attacker’s position most, because it removes standing privilege. Membership of a privileged group that exists only for two hours a fortnight is a far smaller target than one that exists permanently.
What goes wrong
Coverage, always. A vault is deployed for the accounts the project knew about and the estate keeps working through the ones it did not: local administrator accounts on servers, service accounts that run scheduled tasks, appliance and hypervisor consoles, database superusers, network device credentials, cloud root accounts and the break-glass accounts themselves. On an internal test the account we use is nearly always one that was out of scope of the deployment.
The second failure is bypass. If an administrator can still connect directly to a server with a privileged account, the broker is optional, and optional controls are not controls. Enforcing it means network and identity restrictions so that privileged accounts can only authenticate from brokered sources, which is the part that gets deferred.
The third is the platform itself. A vault holds everything, so it is the highest-value target in the estate, and we regularly find it administered by the same directory it protects, which makes the whole chain circular: compromise the directory and you own the vault that was meant to protect the directory. It has to be isolated to break the path.
Where this shows up in an audit
We test whether the broker can be bypassed rather than whether it is installed, and we enumerate privileged accounts from the directory rather than from the vault’s inventory, because the difference between those two lists is the finding. We also check whether elevation is time-bound in practice and who can approve their own request. This is part of how we test whether privileged access is actually brokered.