Privileged access management

What it means

PAM, or privileged access management, covers the tools and procedures for controlling accounts with the highest permissions, such as administrators of servers, databases, the accounting system or cloud services. These accounts are the most valuable target for attackers, because they open the way to everything else.

The principle is simple: passwords for privileged accounts live in a vault, not in people's heads or spreadsheets. Access is granted only for the time a specific task requires, after approval and with two-factor authentication. Every action is logged.

PAM is a specialised part of access control and one of the pillars of the zero trust approach. Whereas an ordinary password manager helps employees with their own accounts, PAM deals with shared and technical accounts that have unlimited power over systems.

How it works in practice

In a small firm PAM often begins with an inventory: who has admin rights, to what and why. It usually turns out that former suppliers still have access, staff routinely work under an admin account and half the office knows the server password.

The next step is separating everyday and privileged accounts, so an administrator reads email under a normal account and uses the admin one only for interventions. An external IT supplier's access is opened on request and closed automatically when the work is done.

Records of privileged sessions are kept in an audit log that even the administrator cannot alter. For companies covered by NIS2, control of privileged access is one of the security measures supervisors expect to see.

What to watch out for

The biggest risk is often a break-glass emergency account that nobody monitors. If one exists, it must be sealed, its use reported and its password changed after every use, otherwise the exception becomes a permanent back door.

The tool alone is not enough if people work around it. An overly complex process leads administrators to write passwords down on the side again. The rules must fit the size of the company and be backed by regular reviews of who really needs access.