A specialized sub-discipline of Identity and Access Management (IAM) focused on securing, controlling, and monitoring accounts that have elevated permissions. While standard IAM manages the average user, PAM focuses on the superusers, those with the power to change configurations, access sensitive databases, or bypass security controls.
Why PAM is Critical
Privileged accounts are the primary targets for cyberattackers. If a standard user account is compromised, the damage is often contained; if a privileged account is compromised, an attacker can seize control of the entire network, deploy ransomware, or exfiltrate massive amounts of data undetected.
The “Three Pillars” of PAM
A robust PAM solution typically functions through three core mechanisms:
- Credential Vaulting: Storing administrative passwords and SSH keys in a highly secure, encrypted digital vault. Instead of knowing the password, admins check out credentials as needed.
- Isolated Sessions: Creating a jump server or intermediary proxy so that the administrator never connects their local (potentially infected) machine directly to the sensitive asset.
- Just-In-Time (JIT) Access: Rather than having always-on privileges, users are granted elevated rights only for the time required to complete a task.
Key Terminology
| Term | Definition |
| Privileged Account | Any account that has capabilities beyond those of a regular user, such as Domain Admin, Root, or Service accounts. |
| Session Recording | The practice of capturing a full video or text log of everything a privileged user does while connected to a sensitive system for audit purposes. |
| Secrets Management | The management of non-human privileged credentials, such as API keys and passwords used by applications to talk to one another. |
| Break-Glass Account | An emergency-only account with high privileges, used when standard authentication systems (like SSO) fail. |
PAM vs. Standard IAM
Think of IAM as the front door key to an office building—it lets everyone in to do their jobs. PAM is the building manager’s heavy-duty keycard that grants access to the electrical room, the server closet, and the executive safes.
Industry Standard: Most modern security frameworks now recommend a Zero Standing Privileges (ZSP) approach, where no one has administrative rights by default; they must be requested and verified dynamically.