Previously, it was established that privileged accounts are one of the largest attack vectors in modern digital environments. Therefore, organizations need to implement Privileged Access Management (PAM) solutions to tighten the attack vector and ensure 24/7 control over privileged account usage. But what exactly does that entail?
The end goal of PAM controls is to achieve Zero Standing Privilege (ZSP). Standing privileges are user privileges enabled indefinitely, regardless of context. No matter what the account user is doing, they have the privileges attached. A very common and very dangerous example of sanding privileges is all employees in a business environment performing their daily workflows on Windows Administrator Accounts. When a Windows PC is configured out of the box, the Out of Box Experience (OOBE) directs the user to create an account with admin privileges. However, no employees should ever be using accounts with this level of privilege. Administrator accounts on Windows are extremely powerful and can be used to make almost any high-level changes to the operating system. You can put two and two together and see how giving every single employee an account with this level of access is a disaster waiting to happen.
Zero Standing Privilege (ZSP) entails an environment where there are no persistent, always-on privileged access rights provisioned to identities and accounts—whether human or machine. No administrative or authorized access is allotted based on predefined trust conditions. Instead, privileges are distributed for a singular purpose—and for as briefly as possible.
PAM uses two specific controls to help achieve ZSP: Just Enough Access (JEA) and Just in Time (JIT) Access. Both of these controls shrink privileged sessions to the bare minimum time and size needed for authorized activities to be performed.
Just Enough Access (JEA) provides privileged account users with the least privileges necessary to perform the necessary activities. Historically, privilege has been an all-or-nothing concept. Users either have privileges or they don’t. If a user needs to perform a privileged activity, such as uninstalling an application, they are given the privilege to perform all other privileged activities, even though they don’t need to. JEA tightens privileges so that privileged sessions only provide users with the subset of special rights they need for the task at hand. All other special privileges are disabled.
Just In Time (JIT) Access ensures that users are only allowed to perform privileged activities when needed and for only as long as it takes to perform the task(s). Privileged accounts remain disabled until they are summoned, and end users must provide the proper credentials to be authorized to use them. By keeping the privileged accounts disabled until needed, adversaries cannot find or access them in the background as part of an attack. With JIT access, there is no always-on privileged account. It turns on when needed, stays on for as long as needed, and then turns back off.
By combining JEA and JIT access, the privileged account attack surface is significantly reduced. Privileged sessions can be hardened even further through conditional access policies, context-based reauthentication, and 24/7 session monitoring. This way, the PAM solution can apply even more scrutiny to privileged access requests, revoke privilege early based on suspicious environmental variables, and maintain a clear audit trail.