Your PAM is only as safe as the laptop in front of it
Apr 7th, 2023 by Jesper Kråkhede
I meet more and more organisations that have bought a PAM solution, a privileged access management system that keeps the admin passwords in a vault and lets admins connect through it. Good. Then I ask what device the admins use to connect to the PAM.
‘Their normal laptop.’
That is the problem. The PAM protects the password and the session from the PAM onwards. It can´t protect what happens before. If the admin´s laptop is compromised, the attacker sits right there when the admin logs on to the PAM. He can capture the credentials for the PAM itself, ride on the session, take screenshots, inject keystrokes or simply wait for the admin to open a connection and take it over. In some setups he can even steal the session cookie and connect from his own machine.
All the expensive controls behind the PAM, the vault, the password rotation, the approval workflows, work perfectly. They just protect a session that the attacker already controls.
That is why privileged access always starts with the device. A PAW, or at least a hardened and isolated device, used only for admin work. Then the PAM adds real value on top: rotation, just in time access and audit.
I understand why the PAW gets dropped. It costs money, it needs people to run it and the admins don´t like carrying two devices. But without it, the PAM is a lock on a door in a house without walls.
Start with the device. Then add the vault.