Cyber Defense eMagazine May Edition for 2022

via compromised accounts and servers to gain additional rights and maximize their damage potential.
For this, dedicated Privileged Account Management (PAM) is required.
What Is PAM?
When it comes to protecting identities and accounts, the so-called ‘least privilege principle’ has always
been an important best practice: It ensures that each authenticated user is only granted the minimum
level of privileges sufficient to perform their intended task. This ensures that even if an attacker gains
access to a user account, the maximum damage they can cause is limited by the privileges of the user
in question: For example, if a user only has read access to selected resources, the risk is relatively
manageable. For optimum protection, it is also recommended to assign privileged roles (i.e., roles with
particularly extensive rights) only for a brief period and never permanently. This just-in-time access will
help companies minimize the attack surface of critical network functions.
Additional Recommended Measures
Most vendors support this basic PAM solution with a wide range of additional technologies, and at first
sight, the strategies of the manufacturers differ in many details. However, closer examination reveals
many common traits and key components:
• High-level Tier 0 or Tier 1 resources, such as domain controllers, require the highest degree of
protection. As a result, most vendors grant privileged access to them only in an isolated
environment and protect access with robust Multi-Factor Authentication.
• Equally strict are the requirements to access the identities and credentials of SaaS admins and
privileged business users. Here, the focus lies on robust Password Management strategies, e.g.,
enforcing strong passwords and automatic regular password changes.
• It should always be possible for critical credentials for infrastructure accounts, DevOps accounts,
and SSH key pairs to be stored in secure vaults.
• To ensure additional cyber resilience, most vendors recommend further measures such as red team
exercises or enhanced auditing and reporting features.
Which Solution Fits Best?
When evaluating the PAM market for the first time, the wide selection of available solutions can look a
bit intimidating. To find the right product for their organization, identity leaders should ask themselves the
following key questions:
• Which assets and accounts are we looking to protect? Which specific risks are we looking to
mitigate?
• Are we facing a true greenfield project? Or do we already have standalone PAM solutions in use in
certain areas or even an enterprise-wide legacy solution with which we are not satisfied?
Cyber Defense eMagazine – May 2022 Edition 90
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.