Privileged Access Management Explained: Vaulting and JIT for Security+

Privileged access management controls the accounts that can do the most damage: domain administrators, root, service accounts, database owners, cloud root accounts and network device credentials.

The premise is that these accounts are the real prize in almost every intrusion, so they deserve controls that ordinary accounts do not.

The problem with standing privilege

Traditionally an administrator holds privileged credentials permanently. Those credentials exist continuously, which means they can be stolen continuously — by phishing, by credential dumping on a machine the administrator logged into, or by an attacker finding them in a script.

Shared administrative accounts make it worse. If five people know the root password, an action taken by that account cannot be attributed to a person, which destroys accountability and makes investigation guesswork.

PAM attacks both problems: remove standing privilege, and make every privileged action attributable.

The core capabilities

Credential vaulting. Privileged passwords are stored in an encrypted vault rather than known to humans. An administrator authenticates to the vault with their own identity and multifactor authentication, and the vault provides access without disclosing the password.

Automatic rotation. Passwords are changed on a schedule and often after every use, so a credential that leaked is valid for a very short time.

Session brokering and recording. Connections are proxied through the PAM system, which can record the session — keystrokes, commands, or full video. This produces attribution and an audit trail, and it has a deterrent effect of its own.

Just-in-time access. Privilege is granted for a specific task and a specific window, then automatically revoked. This is the most important idea here: an account that is not privileged most of the time cannot be abused most of the time.

Ephemeral credentials. Going further, credentials are generated for a single session and never exist again — nothing persistent to steal.

Approval workflows for the most sensitive access, requiring a second person to authorise.

Discovery. Finding privileged accounts that nobody documented — and there are always some, particularly service accounts and local administrators.

The principles behind it

Least privilege — the minimum access needed, nothing more.
Separation of duties — no single person can complete a sensitive action alone.
Zero standing privilege — the goal state, where no account holds privilege at rest.
Break-glass accounts — emergency credentials for when the PAM system itself is unavailable, held securely, heavily monitored, and alerting immediately on use.

Break-glass deserves emphasis because it is the thing organisations forget. If all privileged access depends on the PAM platform and the PAM platform is down, you cannot fix anything — including the PAM platform.

Related mechanisms

LAPS — Local Administrator Password Solution — gives every machine a unique, automatically rotated local administrator password. Cheap and highly effective: it stops one recovered local hash opening every workstation.

Tiered administration. Administrative accounts are restricted to a tier of systems, and a tier-0 account that controls identity infrastructure may never log into a workstation. This prevents credential material for high-value accounts being left on low-value machines — the mechanism behind a great many real breaches.

Privileged access workstations — hardened, dedicated machines used only for administration, with no email or general web browsing.

Service account management. Frequently the weakest area: passwords set once years ago, shared across systems, never rotated because nobody is sure what will break. Managed service accounts with automatic rotation are the answer, and Kerberoasting is the attack that exploits the alternative.

What PAM is not

Distinctions the exam draws. IAM manages identities and access generally; PAM is the subset dealing with privileged accounts. SSO is about user convenience and credential exposure across applications, not about controlling administrative power. MFA is one control within PAM rather than a substitute for it.

Where deployments fail

Worth knowing, because it is usually organisational rather than technical. Administrators route around a system that makes their job slower, so usability matters. Discovery is incomplete, leaving privileged accounts outside the vault — and an account outside the vault is the one an attacker will find. Break-glass procedures are undefined or untested. And service accounts are left out of scope because changing them is frightening, which leaves the largest population of privileged credentials unmanaged.

What to remember

PAM vaults privileged credentials, rotates them, brokers and records sessions, and grants access just in time so privilege does not stand idle waiting to be stolen. Zero standing privilege is the objective. Break-glass accounts are mandatory and must be monitored. LAPS gives unique local administrator passwords, and tiered administration stops high-value credentials being exposed on low-value machines.

Related reading: Credential dumping · Access control models · Lateral movement