CS Jul-Aug 2023

technology focus
'PAM BEFORE IAM'?
PAM AND IAM ARE BOTH CRUCIAL AREAS OF PROTECTION - THOUGH PAM
SHOULD LEAD THE WAY, ARGUES ONE ADVOCATE OF THE TECHNOLOGIES
Graham Hawkey, Osirium.
Identity and Access Management is a
critical consideration in cybersecurity,
says the National Institute of Standards
and Technology, which is working on an
IAM roadmap (see pages 20-21) - that is
welcomed by Graham Hawkey, PAM
specialist, Osirium.
"NIST says the purpose is to present 'a set
of strategic objectives, priorities, and
initiatives' and it's clear that this is a project
looking at the long-term strategy and
requirements," he says. "With that in mind,
it is important that this roadmap should
also seriously consider and factor in the role
of Privileged Access Management (PAM)
and the way it couples with and complements
IAM, combining to create a powerful,
complete solution for a modern IT
environment. NIST says IAM is a 'key
component to creating trusted, modern
digital services' and 'a fundamental and
critical cybersecurity capability'. Some
would view IAM as being so critical that
it is the central view of truth, delivering a
'single pane of glass' to control everything
they can do within an organisation by
knowing everything about a person's
identity. Somewhat akin to George Orwell's
dystopian view of the future."
But this is an illusion, he adds, and breaks
down when it is realised you need to take
into account what a privilege (or attribute
that maps to a privilege) means. "Because
these privileges are so contextual, the
further you are from a device, the further
you are from the truth of privilege-based
risk," states Hawkey. "So, although IAM is
one piece of the puzzle in building robust
cyber resilience, it leaves a hole in the
bigger picture, with a crucial component
missing. What it boils down to is that IAM
is essentially about proving who you are,
but it doesn't provide any help in controlling
what users can do once they've
retrieved credentials and logged in. You
also need to be able to control what you
can do and how you do it. IAM tools authenticate
the person, then PAM manages the
system access for that user. It's a powerful
combination."
Furthermore, he states, IAM and PAM
users enter applications through different
interfaces. "Whilst the audience of IAM
enter through the 'shop door', PAM users
are 'back office' based. Consequently, there
is a difference in attack surface. While both
areas of protection are crucial, it's not a
chicken-and-egg situation. AM should
always come first. This is because PAM
delivers a connection between privileged
users and the role-based accounts that they
need. These accounts exist on the raw
systems before deployment and continue
throughout the lifetime of system, device or
application. In fact, they are so important
that they are the very accounts that are
needed to set up a connection to an IAM
system in the first place. In summary, it's
'PAM' before 'IAM', to protect the 'I' in IAM."
08
computing security July/August 2023 @CSMagAndAwards www.computingsecurity.co.uk