Privileged Access Management (PAM)

NIST describes a privileged account as a system account with the permissions of a privileged user; this includes local and Domain Admins, break-glass accounts as well as application and Service Accounts. It is precisely these accounts that open up security-relevant functions denied to ordinary users - and they are therefore attacked deliberately. According to the Verizon DBIR 2025, credential abuse at 22 percent is the most common entry vector, and 88 percent of attacks on web applications used stolen credentials.

Central building blocks are the encrypted Credential Vaulting of credentials, SSH keys and API tokens, their regular rotation, as well as the proxying and tamper-proof Session Recording of privileged sessions. Just-in-Time (JIT) access grants rights only temporarily and after activation - Microsoft defines JIT as a model in which permissions are granted exclusively when needed and expire afterwards. The target state is Zero Standing Privilege: no permanently dormant permissions, combined with Least Privilege and approval workflows before every issuance.

The Microsoft Enterprise Access Model builds on the tier model: Tier 0 forms the Control Plane for all access controls, Tier 1 separates the Management Plane from the workload layer, Tier 2 distinguishes user and app access. The core rule is the enforced hierarchy - a higher plane must never be controllable from a lower one. The model is complemented by Privileged Access Workstations: dedicated, hardened devices used exclusively for privileged tasks, isolated from email and general web browsing.

Microsoft Entra Privileged Identity Management (PIM) manages, controls and monitors privileged roles and distinguishes 'eligible' from 'active': eligible users must first activate the role - with an MFA check, justification and optional approval, time-limited. PIM requires licensing via Entra ID P2 or Entra ID Governance. Via Conditional Access, phishing-resistant MFA can be enforced for roles such as Global Administrator; 'Protected Actions' additionally tie particularly sensitive actions to such conditions.

ISO/IEC 27001:2022 addresses privileged access explicitly in Control A.8.2, complemented by A.5.15, A.5.18 and A.8.5. NIS2 requires access control policies and the use of multi-factor authentication in Article 21(2); DORA governs privileged, emergency and administrator access in Article 21 of the Delegated Regulation (EU) 2024/1774 following the need-to-use principle. The BSI building block ORP.4 requires Least Privilege (A2), MFA for far-reaching permissions (A10) and the four-eyes principle for administrative activities (A24).

VamiSec supports PAM initiatives vendor-neutrally: we create the requirements catalog and an assessment of the current state, develop the tiering and zoning concept and support vendor-neutral tool selection. We then accompany rollout, handover to operations and ongoing operation, including recertification, exception management and audit preparation. The approach integrates with our services for ISO 27001, NIS2 and IT security audits.