Privileged Access Management (PAM)

With just-in-time administration, an administrator's credential is used to request access instead of reaching the administration interface directly. If the request is approved, the administrator receives a temporary credential for the high-privilege interfaces. A stolen temporary credential only works for a short period before it becomes useless.

With just-enough administration, the administrator is granted only the permissions needed for a specific job, instead of full root, administrator, or superuser rights. The NCSC describes this as another way of stating the concept of least privilege. Requests can be approved by a different authorized person, by a vote of two or more people, or automatically by rules, for example through integration with ticket tracking software.

PAM makes it harder for an attacker on a compromised administration workstation to pivot into critical services, adds a source of audit records, and deters malicious insiders, because each request must be justified and is logged. CISA and NSA guidance recommends managing privileged accounts separately with a PAM solution, and notes that just-in-time provisioning reduces the number of privileged accounts an attacker could target.

The PAM system controls access to other systems, which makes it an attractive target for attackers. Access to it should be constrained, it should be patched and monitored, and its credentials should be cryptographically strong and valid only for a limited time. Because administrators depend on it, PAM needs a high availability design and a carefully protected emergency break-glass process.