{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/privileged-access-management","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/privileged-access-management/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/privileged-access-management/"},"term":{"en":"Privileged access management (PAM)","da":"Styring af privilegeret adgang (PAM)"},"aka":{"en":["PAM","privileged account management"],"da":["PAM"]},"domain":["cs","security"],"cluster":"identity","layer":"identity","status":"current","summary":{"en":"Tools and rules that lock away admin rights, hand them out only when needed and record what is done with them.","da":"Værktøjer og regler, der låser administratorrettigheder inde, kun udleverer dem ved behov og registrerer, hvad de bruges til."},"body":{"formal":{"en":"The controls and tooling that keep privileged account passwords in a guarded store, grant admin rights only for a set task and time after approval, and record each privileged session for later review.","da":"De kontroller og værktøjer, der opbevarer adgangskoder til privilegerede konti i et beskyttet lager, kun giver administratorrettigheder til en bestemt opgave og i en bestemt tid efter godkendelse, og optager hver privilegeret session til senere gennemgang."},"plain":{"en":"Like the key cabinet in a bank - the vault key is signed out for one job, the time is written down, a camera watches, and the key goes back afterwards.","da":"Som nøgleskabet i en bank - nøglen til boksen kvitteres ud til én opgave, tidspunktet noteres, et kamera ser med, og nøglen afleveres bagefter."},"inPractice":{"en":"A database administrator at a pension fund asks for server rights to install an update; her manager approves, and the tool opens a recorded two-hour session with a one-time password, then closes it.","da":"En databaseadministrator i en pensionskasse beder om serverrettigheder for at installere en opdatering; hendes leder godkender, og værktøjet åbner en optaget session på to timer med en engangsadgangskode og lukker den bagefter."},"whyItMatters":{"en":"Admin accounts are what attackers want most; if nobody holds standing admin rights, a stolen login or an unhappy employee has far less to use.","da":"Administratorkonti er det, angribere helst vil have; når ingen har faste administratorrettigheder, har et stjålet login eller en utilfreds medarbejder langt mindre at gøre skade med."}},"deepDive":{"en":"A PAM platform is typically built from several cooperating components. A credential vault stores passwords and keys of privileged accounts, releases them through check-out and check-in with approval, and rotates them automatically after each use or on a schedule. A session manager, usually a jump host or protocol proxy for RDP, SSH and database connections, injects the credential so the administrator never sees it, and records video, keystrokes or commands for review. Just-in-time elevation grants a role only for a bounded period after approval or justification; Microsoft's variant for Entra ID and Azure roles is Privileged Identity Management, which requires Entra ID P2. Endpoint privilege management removes local administrator rights from users and elevates specific applications instead, while Windows LAPS gives each machine's local administrator a unique, rotated password. Discovery scans find privileged and service accounts that nobody onboarded.\n\nThe goal the market now talks about is zero standing privilege: no human holds permanent administrative rights, and every elevation is requested, time-bound, attributable and logged. Around it sit architectural controls. Microsoft's Enterprise Access Model, successor to the Active Directory tier 0/1/2 model, separates control-plane assets such as domain controllers, identity providers and PAM servers from management and workload planes, and requires administrators to work from privileged access workstations so their credentials are never exposed on ordinary endpoints.\n\nSeveral standards map directly to PAM functions. NIST SP 800-53 Rev. 5 covers privileged accounts in AC-2(7) and AC-6(5), and logging of privileged functions in AC-6(9); ISO/IEC 27001:2022 Annex A 8.2 addresses privileged access rights; CIS Controls v8.1 requires dedicated administrator accounts (Safeguard 5.4) and MFA for all administrative access (6.5); and NIS2 Article 21(2) lists access control policies in point (i) and multi-factor or continuous authentication in point (j). NIST SP 1800-18 is a practice guide showing a reference PAM build for the financial sector.\n\nThe value of PAM depends on coverage and review. Typical gaps are administrators who keep a standing account outside the vault \"for emergencies\", service accounts and API keys never onboarded, session recordings nobody watches, and approval workflows that approve everything. The PAM platform itself is a control-plane asset: compromise of the vault or its admin console hands over every secret it holds, so it needs the same protection as a domain controller. Recordings can capture personal data and must be covered by retention rules and data protection review. PAM is a specialised part of access management; identity governance handles who should have which role in the first place, and PAM handles how the most powerful of those roles are used.","da":"En PAM-platform er typisk bygget af flere samarbejdende komponenter. Et credential vault gemmer adgangskoder og nøgler til privilegerede konti, udleverer dem ved udtjekning og indtjekning efter godkendelse og roterer dem automatisk efter hver brug eller efter en tidsplan. En sessionsmanager, som regel en jump host eller protokolproxy for RDP, SSH og databaseforbindelser, indsætter loginoplysningen, så administratoren aldrig ser den, og optager video, tastetryk eller kommandoer til senere gennemgang. Just-in-time-eskalering giver kun en rolle i en afgrænset periode efter godkendelse eller begrundelse; Microsofts variant til Entra ID- og Azure-roller er Privileged Identity Management, der kræver Entra ID P2. Endpoint privilege management fjerner lokale administratorrettigheder fra brugerne og eskalerer i stedet bestemte programmer, mens Windows LAPS giver hver maskines lokale administrator en unik, roteret adgangskode. Discovery-scanninger finder privilegerede konti og servicekonti, som ingen har fået registreret.\n\nMålet, som markedet nu taler om, er zero standing privilege: Intet menneske har faste administratorrettigheder, og hver eskalering er anmodet, tidsbegrænset, kan henføres til en person og logges. Omkring det ligger arkitekturmæssige kontroller. Microsofts Enterprise Access Model, efterfølgeren til Active Directorys tier 0/1/2-model, adskiller kontrolplanets aktiver som domænecontrollere, identitetsudbydere og PAM-servere fra administrations- og workload-planerne og kræver, at administratorer arbejder fra privilegerede arbejdsstationer (PAW), så deres loginoplysninger aldrig eksponeres på almindelige endpoints.\n\nFlere standarder svarer direkte til PAM-funktioner. NIST SP 800-53 Rev. 5 dækker privilegerede konti i AC-2(7) og AC-6(5) og logning af privilegerede funktioner i AC-6(9); ISO/IEC 27001:2022 bilag A 8.2 omhandler privilegerede adgangsrettigheder; CIS Controls v8.1 kræver dedikerede administratorkonti (Safeguard 5.4) og MFA for al administrativ adgang (6.5); og NIS2 artikel 21, stk. 2, nævner politikker for adgangskontrol i litra i og multifaktor- eller kontinuerlig autentificering i litra j. NIST SP 1800-18 er en praksisvejledning, der viser en referenceopbygning af PAM for finanssektoren.\n\nVærdien af PAM afhænger af dækning og opfølgning. Typiske huller er administratorer, der beholder en fast konto uden for vaultet \"til nødstilfælde\", servicekonti og API-nøgler, der aldrig er registreret, sessionsoptagelser, som ingen ser, og godkendelsesforløb, der godkender alt. PAM-platformen er selv et aktiv i kontrolplanet: Kompromittering af vaultet eller dets administrationskonsol udleverer alle de hemmeligheder, det rummer, så det kræver samme beskyttelse som en domænecontroller. Optagelser kan indeholde personoplysninger og skal være omfattet af regler for opbevaring og en databeskyttelsesvurdering. PAM er en specialiseret del af adgangsstyringen; identity governance afgør, hvem der overhovedet skal have hvilken rolle, og PAM styrer, hvordan de mest magtfulde af de roller bruges."},"edges":[{"type":"requires","to":"cs/privileged-account","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/access-management","confidence":"high","strength":"normal"},{"type":"implements","to":"cs/least-privilege","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/privilege-escalation","why":{"en":"With no standing admin rights to steal and every use approved and recorded, there is little higher access left to grab.","da":"Uden faste administratorrettigheder at stjæle og med hver brug godkendt og optaget er der kun lidt højere adgang tilbage at snuppe."},"confidence":"medium","strength":"normal"},{"type":"mitigates","to":"security/insider-threat","why":{"en":"Time-limited, recorded admin sessions make it hard for a trusted insider to misuse far-reaching rights unseen.","da":"Tidsbegrænsede, optagede administratorsessioner gør det svært for en betroet insider at misbruge vidtgående rettigheder ubemærket."},"confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"NIST SP 1800-18 - Privileged Account Management for the Financial Services Sector","tier":"standard","publisher":"NIST"},{"title":"CIS Controls v8 - Control 5 (Account Management) and Control 6 (Access Control Management)","tier":"standard","publisher":"Center for Internet Security"}],"draft":true}