A security strategy and an evolution of Privileged Access Management (PAM) that aims to eliminate always-on or persistent access. In a ZSP environment, no user or service account possesses administrative rights by default. Instead, privileges are granted dynamically and revoked immediately after the required task is completed.
ZSP is the practical application of the Never Trust, Always Verify mantra within Zero Trust architecture.
How ZSP Functions: The “Just-In-Time Model
Traditional PAM often relies on vaulting credentials for permanent admin accounts. ZSP shifts the focus from managing accounts to managing tasks.
- Request: A user requests access to a specific resource for a specific duration.
- Validation: The system verifies the user’s identity (via MFA) and checks if the request aligns with their job role or a specific ticket.
- Ephemeral Access: The system creates a temporary account or adds the user to a high-privilege group for a limited window (e.g., 30 minutes).
- Automated Removal: Once the time expires or the task is complete, the privileges are stripped away, returning the user to Zero Privilege.
ZSP Core Benefits
| Feature | Benefit |
| Reduced Attack Surface | Since there are no permanent admin accounts, there are no “dormant” high-value targets for hackers to hijack. |
| Lateral Movement Defense | If an attacker compromises a user, they cannot move through the network using “inherited” admin rights. |
| Simplified Auditing | Because every privilege grant is tied to a specific request and timeframe, the audit trail is incredibly precise. |
| Blast Radius Limitation | Errors or malicious actions are confined to the brief window in which the privileges were active. |
Comparison: Traditional PAM vs. ZSP
- Traditional PAM (Standing Privileges): Admins have accounts with always-on power. These credentials are stored in a vault. If the vault is breached or a session is hijacked, the attacker has a persistent foothold.
- ZSP (No Standing Privileges): No one is an admin until they need to be. Access is “ephemeral” (short-lived). This effectively removes the target from the map when it isn’t being used.
The “Zero Trust” Connection: ZSP is considered the gold standard for access control because it assumes that any standing privilege is a vulnerability waiting to be exploited.