Session recording: the video nobody watches
May 3rd, 2023 by Jesper Kråkhede
Many PAM solutions come with session recording. Every admin session is recorded as video, so you can see exactly what was done. It sounds great in an audit. In an incident, I have very rarely seen it make a difference.
Why? First, nobody watches the videos. There are thousands of hours of admin sessions and no one has the time. They are only opened when something has already gone wrong.
Second, video is hard to search. During an incident I need to know which accounts were used, which commands were run and which files were touched, across hundreds of machines. A log I can query in seconds. A video I have to watch, one session at a time.
Third, the attacker usually doesn´t go through the PAM. Why would he? He uses stolen credentials or tokens directly from a compromised machine, or he moves laterally in ways the PAM never sees. The recording shows the admins doing their normal work, while the attack happens somewhere else.
Fourth, retention. Video takes a lot of space, so recordings are often kept for a short time. Many attacks are discovered months after they started.
What helps instead? Command line and process logging on the servers, good identity logs, and an EDR that records what actually happens on the machine, searchable across the whole environment.
A recording shows what you expected to happen. Logs show what actually did.