Privileged Access Management Tools vs Native Admin Controls

This guide helps you decide between privileged access management tools and the admin controls already built into the platforms you run. It is not a vendor list. In our working words, a tool here is an added product meant for managing admin accounts. Native admin controls, in the same words, are the admin settings of platforms you already own. The route starts with your own accounts. It covers what you can show today and which gaps remain. Each gap is then sorted by kind. A rule of ours then tells you which gaps, if any, to put to a supplier. Signisys’ own interest is stated in the section before the FAQ.

Privileged Access Management Tools or Native Admin Controls: What Can You Show Today?

Before you read any proposal, try to produce three kinds of proof from the admin screens you already use.

The three groups are Signisys’ own. They draw on points in the NCSC’s 10 Steps to Cyber Security, published on 11 May 2021 for cyber security professionals, which recommends using full-privilege accounts “when absolutely necessary”, multi-factor authentication for administrative accounts, separate accounts for day-to-day and admin work, a review for unnecessary privileges, and logs that tie actions to a person or account. The NCSC’s Introduction to identity and access management, published on 22 January 2018, adds that anyone whose access can cause change felt beyond their immediate job role could be considered a privileged user. That is why this guide does not limit its list to the IT team.

Try each proof in one sitting, on one real account. Also write down what you could produce and what you could not. A proof you could not produce is a gap. In addition, the next sections sort the gaps.

Privileged Access Management Tools: Questions for Each Side

Each proof gives you one question for the documentation you hold and one for a supplier. The table is Signisys’ own working list. Its cells are questions, not findings about any product or platform.

Monitoring, Friction and the Admin Accounts of Anything You Add

The NCSC’s introduction (22 January 2018, for cyber security professionals, large organisations and the public sector) describes monitoring privileged user actions as “not just logging”. In other words, it means rules that could detect suspicious activity, as well as active review of events. When you pick either route, name a person for that review, and write down what they do when an event looks wrong.

The same page notes that some techniques can have a detrimental effect on usability and may be unpopular with privileged users. It also adds that thoughtful design can reduce the impact. For example, ask your administrators which of today’s steps they dislike, and which new step they would.

It also says the identity system itself will be of interest to attackers. That is a 2018 principle for identity systems. In our view, the same questions apply to any product you add for admin sign-ins. Who administers it, from which account, and with which second check? Also, any admin accounts it has join the list from the first section.

What CISA and NSA Say About Privileged Access Management Tools

The US guide from CISA and the NSA, Recommended Best Practices for Administrators, is for IAM administrators. It states no publication date, so check for a current edition. The guide also describes itself as “advisory in nature”. It says privileged accounts “require additional monitoring and control and should be separately managed using a Privileged Access Management (PAM) solution with strong identity governance”.

Weigh that as one pair of agencies’ advice. Also, in the text we read, no test is given for choosing between that approach and built-in features. As well as that, the two NCSC pages above name no product category for privileged accounts. We draw no conclusion for or against adding a product from any of the three, because the choice is a decision for your team. The gap rule below is our way of making it.

Trade-Offs to Weigh Between Native Controls and an Added Product

These are trade-offs for a person to weigh when comparing privileged access management tools with the settings you own. None is a finding about any product or platform. Instead, each is a cost or a gain for your team to weigh.

Privileged Access Management Tools: Signisys’ Gap Rule

This rule is Signisys’ own working method and not a standard. Its thresholds are our judgement. Sort each gap from the first section into one of three kinds.

• Setting gap: you could produce the proof if a setting or report were switched on in a platform you own. Instead of buying anything, check the documentation you hold, and ask the platform’s administrator.
• Routine gap: the proof exists, but nobody runs the review or keeps the record. Name an owner and a date.
• Spread gap: you can produce each proof platform by platform, but not for one person across every platform in one sitting. The same label fits a platform whose documentation shows no way to produce a proof. This is the kind to put to suppliers.

Close setting and routine gaps first. After that, take only the spread gaps to suppliers, with the table questions for those proofs. If no spread gap is left, there is nothing to put to a supplier yet. Also repeat the three proofs on the date you set. For a wider scored pass, fifteen yes-or-no checks on admin and service accounts are in a separate guide. Use a second account as well, because one account is a small sample. If you are unsure which kind a gap is, that is the point to ask for outside help.

A Worked Example Across Three Platforms, Illustrative

Here is an illustrative example, not a client. A firm of 250 people runs admin accounts on three platforms. The firm can list holders and show sign-in methods on all three. It runs no review of rights on one, and it can show administrator actions on each platform but not for one person across the three. Under the rule, the missing review is a routine gap, and the firm names an owner. The trail across three platforms is a spread gap. In addition, the firm asks suppliers the Trail questions only.

What This Guide Leaves Out, and When to Ask for Help

This guide names and ranks no product. It covers staff administrator accounts, while questions for service accounts and for customer sign-in are outside it. It also makes no claim about India or GCC regulation. For why attackers go after admin accounts, read our guide to that risk; for the order of work on admin accounts, see our step-by-step guide; for the same kind of choice about staff sign-in, see choosing sign-in software for staff.

Signisys, which wrote this guide, is a services firm with technology partnerships, and the guide names no product. Weigh the gap rule with that in mind.

In our view, get outside help when you are unsure which kind a gap is. Do the same if nobody can own the review, or when your auditor’s wording asks for a proof your records do not show.

Signisys provides identity and access management, helping organisations control who can access what, with single sign-on, strong authentication, privileged access and automated provisioning. Signisys agrees the exact scope for each engagement. Our Solution: Identity and Access Management (IAM). Our Service: Cybersecurity Services. The matching use case is Privileged Access Management for Admin Accounts.

Privileged Access Management Tools FAQ