This Gartner article explores the five key strategies organizations should follow to successfully implement privileged access management (PAM). PAM tools deliver significant cybersecurity value, but implementing them involves many challenges and potential pitfalls. SRM leaders responsible for identity and access management must plan for success by focusing on culture, discovery, least privilege, visibility and operational efficiency.
Introduction
PAM (privileged access management) projects are hard. For most SRM (security and risk management) leaders, the biggest challenge is gaining a comprehensive understanding of which privileged accounts exist across the many environments that power a modern business. On top of that, migrating administrative use cases from the conventional direct-access models administrators have used for decades to more modern PAM practices and JIT (Just In Time) approaches is complicated and risky.
SRM leaders often face strong resistance when they try to introduce PAM practices, which frequently delays or even prevents the full implementation of a PAM practice, leaving the organization exposed.
Yet PAM is a fundamental security control, and cyber insurers are pushing organizations to adopt PAM on top of more conventional drivers such as compliance, audit and legal. In this context, how can SRM leaders build a game plan (i.e. a roadmap) that accounts for the challenges and obstacles others have faced before them, which in many cases have hindered the PAM practice or at least turned it into a shadow of what it should be? How can organizations effectively mitigate the risks associated with privileged accounts?
SRM leaders responsible for identity and access management (IAM) can use the five interdependent PAM strategies (see Figure 1) to move the organization beyond analysis paralysis at the start, overcome fear of change in the middle and progress toward realizing value through a mature PAM practice.