DefinitionPAM (privileged access management) is the set of processes and tools that controls, monitors and records the use of accounts with elevated permissions, such as system administrators, service accounts and vendor access.
How it works
Privileged accounts can change configurations, create users, disable defenses and access large volumes of data. That makes them attackers' favorite target: with an administrator credential, an intruder can move through the environment and, in ransomware attacks, shut down backups and antivirus before encrypting. A PAM program usually brings together:
- Credential vault: administrative passwords stored in a vault, without users needing to know them.
- Automatic rotation: periodic or per-use rotation of privileged passwords.
- Just-in-time access: privilege granted on demand, for a task, and revoked at the end.
- Session recording and auditing: a record of what was done with each privileged access.
- MFA required for any privilege elevation.
PAM vs IAM vs IGA
IAM (identity and access management) is the umbrella that authenticates and authorizes all users. IGA (identity governance and administration) handles the lifecycle and periodic reviews of all access. PAM is the slice focused on the highest-risk access, with stricter controls. The three complement each other.
Why it matters
Standing privilege is privilege that can be stolen. By reducing the number of permanent administrative accounts and recording every use, PAM shrinks the room for lateral movement and produces evidence for audits. Frameworks such as ISO/IEC 27001 and the NIST CSF treat the management of privileged access rights as an expected control, and PAM is one of the practical pillars of a Zero Trust strategy.
Network Secure helps assess and define privileged access controls within GRC programs.
Frequently asked questions
What is the difference between PAM and IAM?
IAM manages identities and access for all users. PAM is the part focused on privileged access, with password vaulting, on-demand access and session recording.
Does PAM help against ransomware?
Yes. Ransomware groups rely on administrative credentials to spread and disable defenses; limiting and monitoring that access makes the attack harder and speeds up detection.