Privileged Access Management
Core concepts
Privileged Access Management (PAM) protects accounts with elevated rights-administrators, root, service accounts, and emergency "break-glass" identities. Core capabilities: a credential vault (secure storage and checkout of secrets), session brokering and recording, just-in-time (JIT) elevation, and password rotation for shared/admin accounts. Understand least privilege for admins, separation of duties between requesters and approvers, and dual control for the most sensitive actions.
Know the account types: personal privileged accounts, shared/generic admin accounts, service accounts (non-human, often over-privileged and rarely rotated), and break-glass accounts (sealed, monitored, used only in emergencies). Study privilege creep and the risk of standing admin rights versus on-demand elevation. Understand that PAM integrates with IGA (governance of who may check out which credential) and with SIEM (alerting on privileged activity).
Traps
Questions often equate "PAM" with "password vault" alone-PAM also includes session monitoring, JIT, and rotation. Another trap: recommending shared admin accounts as a fix; shared credentials destroy accountability, so vaulting plus checkout plus recording is the answer. Watch for service-account scenarios where the correct response is discovery, ownership assignment, and rotation-not simply disabling everything.
Rule of thumb
Default to zero standing privilege: grant elevation just-in-time, scoped, time-bound, approved, and recorded. Reserve permanent admin rights for break-glass identities that are sealed, alarmed, and reviewed after every use.