Protected: Risk Management Best Practices for Privileged Access Management (PAM)

Access management includes all activities to ensure that only approved users have access to the resources that they need given their work responsibilities during allowed times. To achieve this, it is necessary to answer the following questions:

• Who are the approved users of a system?
• Which work activities do they perform?
• Are they a privileged user or standard business user?
• Which permissions do they need?
• What are the required authentication processes?
• How are a user’s work permissions and activities certified/approved?
• What is the regulatory framework for these processes and work activities?
• How long should the user’s permissions be valid?

Once the different types of users have been identified – which can include standard business users, contractors, customers and privileged users – it is of utmost importance to create a Privileged Access Management (PAM) program. This is a collection of practices, policies and tools that control privileged access to critical systems. This is crucial since these privileged users (administrators) often have unlimited access to systems and data.

For standard business users it is recommended that organizations use an Identity Governance and Administration (IGA) solution that supports the automation of general access-management activities, processes and workflows. Without automation, manual processes are necessary to perform all activities, which carries the risk of human errors and outdated and inaccurate data. By integrating your IGA solution with your PAM solution, you can achieve privileged account governance (PAG) and provide unified governance for all employees, regardless of their role and level of access.