Introduction

Why PAM?

PAM allows you to manage accounts that are necessary to perform scheduled configuration and maintenance tasks, as well as supervening tasks such as the recovery of a hardware or software failure or the restoration of a backup. Due precisely to the need to use these accounts in an unplanned manner, their management must combine security, procedures and flexibility.

PAM Goals

Reduce the attack surface

• Have an up to date global cataloge of accounts and permissions.
• Close the gap between the user and administrator accounts.
• Assign the ownership and responsabilities for each account.
• Complex and rotated passwords.
• Use strong autentication.
• Track accounts ownership and warn when an account loses its last owner.

Minimize the potential impact

• Rectification campaigns to confirm the permissions assigned to each service account.
• Apply dynamic authorization engine (XAML) to grant access to critical resources.

Rapid attack detection

Detection phase

• Exexecution of dangerous commands.
• Usage of dangerous applications.

Response actions

• Drop offending session.
• Lock account.

 Notification

• Account owner notification by SMS/Email.
• Creation of a ticket.

Generate and keep legal evidence

• Record privileged account sessions (Screen, KeyBoard, Clipboard and File transfers).
• Keep encrypted in a secure storage.