Exploring Privileged Access Management (PAM)

In previous sections, the principle of least privilege was introduced: users only get the minimum set of rights to the systems that they are authorized for/require. Least privilege works with non-privileged accounts or least-privileged user accounts (LUA). Typically, there are two types of LUA:

• Standard user accounts
• Guest user accounts

Both types of accounts are very limited in terms of user rights.

There are situations where these accounts simply aren't sufficient and inhibit people from trying to do their job. The user would then need elevated rights: rights that are temporarily assigned so that the user can continue with their work. An account with such elevated rights is called a privileged account. Examples of privileged accounts are the following:

• Domain administrative accounts: Accessing all resources in the domain
• AD accounts: Accessing AD with rights to, for example, add or remove identities...