Privileged Access Management Best Practices

Privileged Access Management (PAM)

Best practices for privileged access management (PAM) have developed over time to enhance security. Traditionally, organizations maintained dozens or even hundreds of privileged accounts to enable administrators to complete essential tasks. These privileged credentials are a serious security risk because they can be misused by their owners or taken over by attackers. 

To reduce risk, PAM tools initially focused on locking down those accounts using techniques like credential vaults, which resulted in complex and never-ending management struggles. Modern privileged access management takes a completely different approach: Replace standing privileges with just-in-time privileges that provide just enough access to perform a specific task, for only as long as required. This strategy slashes security risks and management overhead at the same time. 

Best Practices for Traditional Privileged Account Management 

Organizations that follow the traditional approach to PAM need to implement many best practices to try to secure their many privileged accounts, including the following:

• Maintain an inventory of all privileged accounts. The inventory should identify the owner of each privileged account, their contact information and their primary locations in the office, as well as all the access rights the account has. Be sure to include all of the following types of accounts:
  • All members of powerful Active Directory groups like Domain Admins and Enterprise Admins
  • All root accounts for "*nix" servers
  • All system admins for your mainframe systems, databases and key applications
  • All system admins for your network devices like firewalls, routers and phone switches
  • All service accounts that have elevated access to data, resources and infrastructure
  • Privileged accounts beyond your firewall, including those associated with social media, SaaS applications, partners, contractors and customers
  • Cloud-based privileged accounts, such as those for managing Microsoft Entra (formerly Azure Active Directory)
• Regularly review privileged access rights. Keep your inventory of privileged accounts up to date by reviewing it at least once a month. Promptly remove any unneeded privileged accounts and any unneeded permissions for accounts that remain, and document all changes in detail.
• Do not allow admins to share accounts. This privileged account management best practice holds administrators accountable for their actions by assigning a separate privileged account to each individual. Use the default administrator, root and similar accounts only when absolutely necessary; it's better to rename or disable them.
• Minimize the number of privileged accounts. Ideally, each admin should have only one privileged account for all systems.
• Create a password policy and strictly enforce it. Follow password best practices, including the following:
  • Change the password on each device so you aren't using a default or temporary password.
  • Avoid using hard-coded passwords in applications and appliances.
  • Require privileged account passwords to be changed regularly to reduce the risk of departing employees compromising your systems.
• Require multifactor authentication (MFA) for privileged accounts. Options include hard tokens, soft tokens, push-to-authenticate/approve, near-field communication Bluetooth beacons, GPS/location information and fingerprints. A password alone is not enough.
• Limit the permissions for each privileged account. No few privileged accounts should have full access to everything. Rather, to minimize risk, you should enforce both of the following key principles:
  • Separation of duties: No employee can perform all privileged actions for a given system or application. This ensures that no single person has all the power.
  • Least privilege: Each user is granted only the bare-minimum privileges needed to perform their job. This limits the damage any user can do, either deliberately or accidentally, as well as the power that an attacker will gain by compromising the account.

Useful strategies for limiting permissions include delegating permissions in Active Directory and setting up role-based access control (RBAC) for every system that you use. 

• Use privilege-elevation best practices. When users need additional access rights, they should follow a documented request and approval process, either on paper or using a ticket in a privileged access management system. Upon approval, elevate the user’s privileges for only the time period required to perform the specified task. Similarly, an IT admin should use their privileged account only when they need its elevated permissions for a specific task; they should use their regular account otherwise.
• Log all privileged activity. To reduce the risk of costly data breaches and  downtime, be vigilant about what actions privileged users are taking by using a variety of logging and monitoring techniques. Enable logging for firewalls, network access control tools and other systems that limit access to systems — particularly critical systems like your intrusion detection system (IDS) and identity and access management (IAM) solution. You should also enable system logging for logon/logoff events and other actions privileged users take.
• Implement privileged activity monitoring and alerting. You also need real-time monitoring of privileged user activity and the ability to alert appropriate staff members about critical actions. Creating these alerts requires the information in the logs to be clear and understandable; this is not natively available for many computing platforms, but you can get this information from third-party IT auditing software.
• Analyze the risk of each privileged user. Regularly assess the risk each privileged user poses and focus on investigating and securing the riskiest accounts first.
• Educate users. Everyone — not just admins but all users — should know how to properly manage and use privileged credentials. Give your staff the information they need to succeed, and be sure to update them about relevant policies and procedures whenever there's a change to their responsibilities.
• Document your account management policies and practices. Last but certainly not least, make sure your rules and processes are explicitly written down and signed by the management team so everything is clear and enforceable. This is especially important when compliance comes into scope.

Modern Privileged Access Management

Rigorously following all of these best practices for dozens or hundreds of privileged accounts is a steep challenge. Moreover, even if you manage to accomplish this goal, you are still left with a huge attack surface area, since every privileged account that exists is at risk of being taken over by an attacker or being misused by its owner. 

Enter third-generation privileged access management. This modern approach involves the following practices:

• Enforce zero standing privilege (ZSP). Whenever possible, replace always-on privileges with just-in-time privileges to provide just enough access to perform the task at hand and remove the privileges immediately afterward. ZSP minimizes the risk of privileged credentials being misused by insiders or compromised by attackers.
• Implement approvals for privileged session requests. For most critical tasks, there should be an approval workflow in which the privileged session request must be approved or denied by appropriate personnel. With the right PAM solution, you can easily establish an workflow that is both effective and convenient.
• Maintain an audit trail and recordings for all privileged sessions. Organizations need to track all actions administrators are taking. Some modern PAM solutions provide both real-time monitoring of privileged user activity and session recording & playback capabilities.

Next Step: Slash Your Attack Surface with the Netwrix Privileged Access Management Solution 

Netwrix's privileged access management solution helps you protect your sensitive data and critical systems and comply with industry and government regulations. It empowers you to easily replace your risky standing privilege with just-in-time privilege that provides just enough access for the task at hand — without hurting administrator productivity. You can quickly establish request/approval workflows that makes achieving Zero Standing Privilege easy and convenient. Plus, the Netwrix PAM solution maintains a detailed audit trail of all privileged account activity, immediately alerts you about suspicious behavior so you can respond quickly, and enables easy playback of recorded privileged sessions to facilitate investigations and enforce accountability. 

More broadly, the Netwrix PAM solution is easy to deploy and use, with a user-friendly interface and customizable dashboards. And it's scalable to meet the needs of your organization today and in the future, paving the way for tight security.