Zero Standing Privileges • JIT Access • Session Recording
Blue TeamPrivileged AccessJIT AccessInteractive
What is Privileged Access Management?
Privileged Access Management (PAM) controls who can access critical systems, when they can access them, and what they can do. Unlike standard user accounts, privileged accounts (admin, root, service accounts) have elevated permissions that can modify systems, access sensitive data, or deploy code.
Core PAM Principles:
Zero Standing Privileges (ZSP)
No permanent admin access - request when needed
Just-In-Time (JIT) Access
Temporary elevation for specific time windows
Least Privilege
Minimum permissions needed for the task
Session Recording & Audit
Every privileged action is logged and reviewable
Why PAM Matters: Real Breaches
Many of the largest breaches in history resulted from compromised privileged credentials. Once attackers gain admin access, they can move laterally, exfiltrate data, and deploy ransomware.
SolarWinds Supply Chain Attack (2020)
•Attackers compromised admin credentials for SolarWinds Orion build system
•Injected malicious code into software updates sent to 18,000+ customers
•PAM Gap: No session recording or anomaly detection on build server access
MGM Resorts Ransomware (2023)
•Social engineering against IT helpdesk to reset admin credentials
•Attackers used elevated privileges to deploy ransomware across 100+ ESXi servers
•PAM Gap: Permanent admin credentials without MFA or approval workflow
CircleCl Token Breach (2023)
•Malware on engineer's laptop stole GitHub session token with write access
•Attackers used token to access production secrets and encryption keys
•PAM Gap: Long-lived tokens without rotation or anomaly detection
Zero Standing Privileges (ZSP) Architecture
Traditional model: Users have permanent admin access "just in case" they need it. ZSP model: No one has admin access by default. Request it when needed, for a limited time, with justification.
❌ Old Model (Standing Privileges)
• User "alice@corp.com" is in "Domain Admins" group 24/7
• If Alice's credentials are stolen, attacker has full access
• No audit trail of why admin privileges were used
• Harder to detect malicious activity vs. legitimate admin work
✓ ZSP Model (JIT Access)
• Alice requests "Domain Admin" for "2 hours" with justification
• Manager/Security approves (or AI auto-approves low-risk requests)
• Alice gets temporary elevation, all actions are logged
• After 2 hours, privileges auto-revoke
Just-In-Time (JIT) Access Workflow
1
User Requests Privilege Elevation
Engineer needs to restart production database. Requests "DB Admin" role for "30 minutes" with justification: "Emergency restart for incident #1234"
2
Risk Assessment (Automated)
PAM system checks: Is this user authorized for this role? Is the request time reasonable? Are there active incidents? Is the user's device compliant?