What is PIM?
Privileged Identity Management (PIM) is the practice of securing and managing privileged accounts. It enables people to manage, control, and monitor access to important resources in their organizations.
Organizations want to minimize the number of people who have access to secure information or resources because that reduces the chance of a malicious actor getting access or an authorized user inadvertently impacting a sensitive resource. An organization may implement PIM via a specialized, standalone tool or a set of tools and processes.
Contents
The difference of PIM, PAM, and IAM
The core elements of PIM
A deeper look into the aspects of Privileged Identity Management
What roles does PIM support?
Why should organizations use PIM?
The difference of PIM, PAM, and IAM
PIM, Privileged Access Management (PAM), and Identity & Access Management (IAM) are all connected, but they have different areas of focus.
IAM is a broad term that refers to the policies, processes, and technologies used to manage digital identities and their access to resources. IAM manages the identity of basic users, authorizations, and access to resources. PIM manages root user identities and authorizations, and PAM manages root user access to sensitive resources. PIM focuses on managing and securing the identities of privileged accounts, including the creation, maintenance, and revocation of accounts with elevated permissions. PAM solutions provide a broader range of functionalities for managing and securing privileged accounts. They all are connected and together build comprehensive layers of security.
Some PAM solutions have the same functionalities as PIM, so there is a feature overlap, one premium example being SSH’s PrivX Hybrid PAM. The important thing to ensure is that the right identity is linked to the right role with the right level of privilege and that the identity only gets access to the right target for the right duration of time.
The core elements of PIM
The core PIM elements are:
-
Just enough access
-
Privileged admin workflow
-
Audit-ready
PIM helps organizations that are migrating their infrastructure into the cloud to reduce the risk of compromising sensitive information. The risk of compromising is more at risk when it comes to privileged admins. These privileged admins can activate or elevate their accounts for a short period of time by using PIM. This will reduce compromising significantly.
A deeper look into the aspects of Privileged Identity Management
Just-in-time access
The just-in-time aspect is supported through an activation period. Inside the role setting for a role, an IT admin can pick a time period between zero and 24 hours. This means that this role is activated only for the configured period of time and after that the user will lose their access. If they want to use that role again, they will need to go through the activation process again.
Time-bound access
PIM allows the assigning of time-bound access to resources using start/end dates. If, for example, a guest is coming to work in the organization, the guest can have a time-bound access role. This role will be closed after a certain amount of time.
Approval
PIM supports submitting an approval to activate privileged roles. Once the activation request is submitted, the approver will receive an email to go approve that request inside PIM. Only through approval, the role assignment will be enabled for a certain period of time.
Multi-factor authentication, justification, notifications, and access reviews
Privileged accounts can activate their approvals to privileged roles by enforcing multi-factor authentication. The administrator responds to their trusted device, phone call, or SMS. Once the administrator has completed the step, the role has been approved.
PIM supports justification to understand why users activate. You can also get notifications when privileged roles are activated. Access reviews can help role administrators discover who has privileged roles in their organization and if they still need them. This is facilitated by an "Access Review", commonly known as the "At the Station Campaign". The campaign can be delegated to a group of reviewers or role members themselves. When the review is complete you can remove any unnecessary assignments.
Audit
A detailed audit log will keep track of all the events that are happening inside PIM.
What roles does PIM support?
PIM supports all roles such as:
-
Global Administrators
-
Billing Administrator
-
Exchange Administrators
-
User Administrators
-
Password Administrators
Why should organizations use PIM?
Privileged Identity Management (PIM) is crucial for organizations because it helps control and secure access to sensitive systems and data. PIM enables organizations to monitor, manage, and audit privileged accounts, reducing the risk of unauthorized access or misuse.
By implementing PIM, organizations can enhance their overall cybersecurity posture, ensuring that only authorized individuals have elevated access rights, which is crucial for protecting sensitive information and preventing security breaches.
PIM + PAM = PrivX
PIM helps you manage root user identities and authorizations. PAM helps you manage root user access to critical resources. PrivX is a holistic solution that combines both.
PrivX offers all features of PIM and PAM combined into one:
- Create, manage, secure, and revoke identities of privileged accounts & manage and secure your privileged accounts
- Manage everything centrally, under a single pane of glass
- Automate access and link the right identities to the right roles with the right level of privilege
- Link the identities only to the right targets, only for the defined period of time (just-in-time and just enough access)
- Track, record, monitor, and audit your privileged sessions
See PrivX functionality in action - check out the PrivX test drive here >>>
