Kinetic Gain · Identity & Access Governance
Pillar guide

Privileged access management (PAM)

By Kinetic Gain, Identity & Access Governance Last updated

Privileged access is the access that can change the system itself, not just use it. Admin consoles, root shells, service accounts, cloud owner roles, and the secrets that unlock them are the accounts an attacker wants most, because one of them is usually enough to reach everything else. Privileged access management, or PAM, is the practice of removing standing power from those accounts and handing it out in small, recorded, time-boxed pieces.

The PAM flow: the credential is vaulted, elevation is requested and approved, access is granted just-in-time, and the session is recorded before access expires. Vault Request + approve Grant just-in-time Record + expire
Vault the credential, broker elevation through request and approval, grant it just-in-time, and record the session before it expires.

What PAM is, and why privileged accounts are the crown jewels

PAM is a discipline for controlling, securing, and monitoring accounts that hold elevated rights. A normal identity reads a record or files a ticket. A privileged identity can create other accounts, disable logging, read every mailbox, rotate encryption keys, or delete a production database. That gap in blast radius is the whole reason PAM exists as its own control set, separate from ordinary access. It sits next to entitlement management, which governs the everyday permissions a normal identity carries, and identity lifecycle management, which governs how identities are created and retired. PAM is the layer for the small number of paths that can change or destroy the environment.

Attackers concentrate here because of leverage. Standing privileged access means a credential exists, all day every day, that is worth stealing. Least privilege is the countermeasure, and NIST SP 800-53 states it directly. AC-6(5) restricts privileged accounts to a defined, small set of roles, and AC-6(2) requires that people with admin rights use non-privileged accounts for ordinary work. SOC 2 frames the same idea in CC6.1, which expects logical access to be restricted to protect assets. The posture PAM aims for is simple to say and hard to reach. No human or machine holds a privileged credential it is not using right now.

The privileged account types

You cannot protect what you have not named

Vaulting and rotation: no standing shared passwords

Control who reaches the secret, limit how long it is worth anything

The first move in PAM is to stop shared privileged passwords from standing still. Vaulting means the credential lives in a secured store, not in a person's head, a wiki, or a config file. Access to the vault is brokered, so a request to use root is authenticated, authorized, and logged before the secret is ever revealed, and often the secret is injected into the session so the user never sees it. Rotation means the credential changes on a schedule and after every checkout, so a password captured today is useless tomorrow. For service accounts and keys, the same logic runs through secrets management: store the secret centrally, hand it to the workload at runtime, rotate it automatically, and never let it sit in plaintext in a repository or an environment file. NIST covers credential handling under IA-5, authenticator management, and account handling under AC-2.

Just-in-time and zero-standing-privilege access

Limit not just what an account can do, but when

Vaulting a standing password beats a sticky note, but the credential still exists all the time. Just-in-time access, or JIT, goes further. Privilege is granted only when it is requested, only for the task at hand, and only for a set window, then it is removed automatically. Zero standing privilege, or ZSP, is the end state that JIT moves toward. Between tasks the account has no elevated rights at all, so there is no standing credential to steal and no idle admin session to hijack. In practice this looks like an engineer requesting one hour of database-admin access, an approver granting it, the rights activating, and the rights expiring on their own.

The exposure window shrinks from always to minutes. Least privilege applied to time, not just scope: no account holds power it is not using right now.

Review who holds standing access

Session monitoring and recording: the evidence layer

Granting privilege narrowly is half the job. The other half is being able to show what was done with it. Privileged session monitoring records the actions taken during an elevated session: commands run, systems touched, and in higher-assurance setups a full keystroke or screen recording. This does two things. It deters misuse, because people behave differently when the session is on the record, and it produces evidence you can hand to an incident responder or a reviewer without reconstructing events from scattered logs. NIST maps to this directly. AC-6(9) calls for logging the use of privileged functions, AU-2 defines which events are logged, and AU-12 requires the system to generate those audit records. The word to hold onto is evidence. Access controls set intent, recorded sessions prove what actually happened, and that gap is where most audits and most breach investigations either succeed or stall.

What to measure

Standing privileged accounts

The count of identities, human and machine, holding always-on elevated rights.

Target: down and to the right

JIT coverage

The share of privileged access granted through request-and-expire instead of standing rights.

Target: high, toward zero standing privilege

Credential age

How long shared secrets and service-account passwords go between rotations. Old credentials compound exposure.

Target: short, rotated on schedule + after use

Session coverage

The share of privileged sessions that are recorded and reviewable. Also watch orphaned service accounts with no owner or recent use.

Target: every privileged session evidenced
Standing privileged accessJust-in-time PAM
Access modelRights are always on, assigned once and left in placeRights are granted per request, for one task, then removed
CredentialA long-lived shared or admin password that rarely changesVaulted and rotated, often injected so the user never sees it
Exposure windowContinuous. The account is a target 24/7Minutes to hours, bounded by the grant, then zero
AuditabilityShared logins blur who did what. Attribution is weakEach elevation ties to a person, a reason, and a session record
Failure modeOne stolen credential grants durable, unnoticed accessA missed approval or expiry blocks work, it does not hand over the keys
Illustrative scenarioA team shares one root password for a production server, stored in a pinned chat message. An engineer leaves. The password does not change because too many jobs depend on it, so a former employee still holds standing access that no one can attribute. A vaulted, rotated, just-in-time model would have removed the shared secret, rotated it on the engineer's exit, and tied every use to a person and a session.
Illustrative scenarioA deployment script authenticates with an API key hardcoded in a config file committed to a repository. The key never rotates, and nobody owns it. Anyone with read access to that repo, now or anywhere in its history, holds a standing privileged credential. Secrets management would keep the key in a vault, inject it at runtime, rotate it on a schedule, and leave nothing in the repo to find.

FAQ

What is the difference between IAM and PAM?
IAM manages the identities and everyday access of your general user population. PAM is the subset focused on privileged accounts, the admin, root, service, and break-glass identities whose access can change or destroy the environment. PAM adds vaulting, just-in-time elevation, and session recording that ordinary access does not need.
What is zero standing privilege?
Zero standing privilege, or ZSP, means an account holds no elevated rights between tasks. Privilege is granted just in time when it is requested and removed when the task is done. Because there is no always-on privileged credential, there is nothing for an attacker to steal while the account sits idle.
What is a break-glass account and how should it be protected?
A break-glass account is an emergency privileged account used when normal access or MFA fails. Because it holds high privilege, it should be vaulted, its use should trigger an alert, and every activation should be reviewed afterward. It is a fire alarm, not a daily-use login.
Do service accounts need privileged access management?
Yes. Service accounts are non-human identities that run jobs and connect systems, and they often hold broad rights, lack an owner, and never rotate. Managing them means storing their secrets in a vault, rotating them automatically, scoping their rights to the job, and retiring the ones nothing uses.