Privileged accounts are one of the riskiest aspects of any organization’s digital landscape. However, they are still a necessity for the proper functionality of many workflows. Identities have become a preferred attack vector by adversaries looking to compromise business environments. In the 2020s, enterprise digital landscapes have become perimeterless because of modern trends such as Work From Anywhere (WFA) and the cloud. As a result, adversaries know they can strike gold better by attacking online identities instead of old-fashioned perimeter firewalls and routers.

By their very design, privileged accounts provide varying degrees of high-level access to critical business resources. A privileged account is any account that provides access and permissions beyond those of non-privileged accounts. A privileged user is any user currently leveraging privileged access, such as through a privileged account. A specific type of privileged account is the Superuser Account. These are found in most environments that use desktop operating systems. A superuser account is primarily used for administration by specialized IT employees and provides virtually unrestrained power to execute commands and make system changes. These are the Windows Administrator and Linux root accounts. There are other subcategories of privileged accounts, including:

  • Local Admin Accounts: Non-personal accounts used for administrative access to local hosts. Examples include the Windows Administrator Account and Linux Root Account.
  • Domain Admin Accounts: Used on either local or cloud-based directory networks to provide admin access to all computers and services enrolled in the domain.
  • Break Glass Accounts: backup accounts used to provide emergency access to a device or resource. An example would be a basic user account configured on a domain-enrolled Windows workstation for IT staff to use in the event that the domain goes offline.
  • Service Accounts: non-human accounts used by apps to interact with the underlying operating system
  • Service Principals: similar to service accounts, only they are used by cloud applications to interact with cloud resources
  • Domain Service Accounts: non-human accounts used by Active Directory Domains for various domain maintenance tasks
  • Application Accounts: accounts attached to applications on behalf of a human administrator for specific tasks such as running batch jobs and scripts or querying databases.

All of these privileged accounts share one underlying factor: they hold lots of power. All of them are used to perform high-level tasks within an organization’s digital environments that other users should not be able to do.

Every day, employees, even IT or management employees, never use privileged accounts in their daily workflows. Instead, they use one of two non-privileged accounts, also known as Least Privileged Accounts (LUAs):

  1. Standard User Accounts: personal accounts assigned to individual employees that enable them to perform basic workplace activities and nothing more. Using these accounts, employees can browse the web, use an office suite, print, and run a variety of company-approved applications. Depending on how stringent the work environment is, standard account users can sometimes customize their desktop experience by changing themes and wallpapers.
  2. Guest User Accounts: While not recommended for use, some businesses require a way for temporary visitors to perform digital tasks. Guest user accounts are used to perform a variety of heavily restricted activities. Guests may be able to access a web app, print to a guest printer, or fill out a digital form.

In the 2020s, the use of privileged accounts has evolved to encompass non-human machine identities. These are accounts used to control and manage automated technologies such as IoT devices, ICS/SCADA systems, Robotic Process Automation (RPA), and Agentic Artificial Intelligence (AI). Since these accounts control the well-being of an entire process/system, they carry a special level of risk. An adversary who compromises one of these accounts could wreak physical havoc on a facility and potentially an entire community, such as an adversary who compromises a water filtration system and changes settings to release unfiltered water to the public.

Privileged accounts are everywhere, even in the smallest of organizations. The problem is that many business owners and management teams do not realize that they even have them enabled. Orphaned Accounts are privileged accounts that are left sprawled throughout an organization with no oversight or even usage, creating a backdoor for adversaries to sneak into the organization’s environment.

The burden of securing privileged accounts has stumped many businesses in the past. However, mainstream IAM platforms implement Privileged Access Management (PAM) capabilities to secure the usage of these accounts. PAM goes hand in hand with IAM. While IAM controls the authentication of identities to ensure the right user has the right access at the right time, PAM enables more granular visibility, control, and auditing over privileged identities and session activities.

The ultimate goal of PAM is to allow authorized personnel/processes to access privileged accounts only when they need them, only for approved activities, and for only as long as they need them. PAM also seeks to guarantee end-to-end session monitoring and logging to ensure total auditability and accountability for privileged sessions. Once upon a time, a user could simply use privileged credentials to access the account and use it for as long as they wanted. With advanced PAM solutions, all users use non-privileged accounts until they need to perform a privileged activity. To do so, they must authenticate with multiple authentication factors. As soon as the user is authorized to elevate to a privileged account, the session is monitored and often timed to leave no room for suspicious activities. If strange activity is detected, the user can be kicked out of the privileged account or required to reauthenticate. Environmental attributes regarding the end user and end device can be constantly analyzed during the session to make decisions regarding the trustworthiness of the entity using the privileged account. As soon as the user finishes performing the necessary privileged actions, their privileged session is ended, and they return to their normal standard account.

Today, most mainstream IAM platforms, such as Microsoft Entra ID and Amazon Web Services (AWS), provide PAM capabilities in their IAM maintenance dashboards. IT administrators can select the necessary PAM controls based on the risk tolerance of the organization, as decided upon by senior management. Due to the critical need for secure privileged accounts, PAM solutions must be thoroughly tested and piloted before being implemented organization wide.