Privileged Access Management

Privileged Users
    ↓
PAM Portal (check-in/check-out, approval, MFA)
    ↓
PAM Vault (encrypted credential storage)
    ↓
Credential Checkout → Session Launched → Session Recorded → Credential Rotated
    ↓
Target System (SSH, RDP, Web Console, Database)

Administrator needs to access server FIN-SRV-03

1. Admin → PAM Portal
2. Authenticate (password + phishing-resistant MFA)
3. Select target system: FIN-SRV-03
4. Enter justification: "Patching CVE-2026-1234, ticket SEC-45678"
5. Request approved by: Senior Admin (automatic for standard access, manual for critical)
6. Credential checked out: password revealed for 2-hour window
7. Session launched via PAM proxy (recorded)
8. Admin completes patching
9. Credential checked in (or auto-expired)
10. Password automatically rotated → old password is invalid

Tier 0 Accounts (Domain Admins, etc.):
- Account is SEPARATE from user email account
- Password is 25+ characters, randomly generated
- Requires phishing-resistant MFA (YubiKey or smart card)
- Admin workstations are dedicated (PAW — Privileged Access Workstation):
  → Clean OS, no email/web browsing, no USB except smart card reader
  → Only admin tools installed
  → Connected to isolated management network
  → No internet access
- Session is proxied through PAM with recording
- Password is rotated after every use

Activities:
  └─ Discover all privileged accounts:
    └─ Domain admins, enterprise admins, schema admins
    └─ Local admin accounts on servers and workstations
    └─ Service accounts with admin rights
    └─ Cloud admin roles (AWS IAM, Azure Global Admin, GCP Org Admin)
    └─ Application admin accounts (SaaS, databases, network devices)
    └─ SSH keys with root access
  └─ Classify by privilege level:
    └─ Tier 0: Domain/cloud admin (highest privilege)
    └─ Tier 1: Server admin (medium privilege)
    └─ Tier 2: Workstation admin (lowest privilege)
  └─ Identify shared/emergency accounts:
    └─ root, Administrator, localadmin
    └─ Break-glass accounts (emergency access)

Activities:
  └─ Onboard privileged accounts into PAM vault (CyberArk, beyondtrust, Delinea)
  └─ Enable automatic password rotation:
    └─ Tier 0: Rotate after every use (check-out/check-in)
    └─ Tier 1: Rotate weekly or after each use
    └─ Tier 2: Rotate monthly
    └─ Service accounts: Rotate quarterly (coordinate with application owners)
  └─ Configure session recording for all interactive privileged sessions
  └─ Set up access workflows:
    └─ Request → Approval (manager/security) → Time-bound access → Auto-revoke

Activities:
  └─ Session recording review:
    └─ Flag commands: whoami, net use, reg save, ntdsutil, mimikatz
    └─ Flag unusual hours: admin activity outside business hours
  └─ Alerts on:
    └─ Failed login attempts to vault (possible compromise)
    └─ Password check-out outside approved schedule
    └─ Session recording stopped or tampered with
  └─ Monthly reports:
    └─ Privileged access usage by user
    └─ Password rotation compliance
    └─ Session recording audit trail
    └─ Emergency (break-glass) account usage

Activities:
  └─ Quarterly access certification for all privileged accounts
  └─ Annual architecture review:
    └─ Are admin tier boundaries still intact?
    └─ Are there new privileged attack paths (cloud, SaaS, APIs)?
    └─ Is JIT coverage expanding to more use cases?
  └─ Post-incident review:
    └─ Did PAM controls work as expected?
    └─ Were there PAM bypasses?
    └─ What PAM improvements would reduce future risk?

#!/usr/bin/env python3
"""
Automated privileged account check-out workflow
CyberArk REST API example
"""
import requests
import json
from datetime import datetime, timedelta

CYBERARK_URL = "https://cyberark.example.com"
API_TOKEN = "your-api-token"

def check_out_account(safe, account_name, reason, duration_hours=2):
    """Check out a privileged account from CyberArk vault"""

    headers = {
        "Authorization": f"Bearer {API_TOKEN}",
        "Content-Type": "application/json"
    }

    # Request account access
    response = requests.post(
        f"{CYBERARK_URL}/API/Accounts/{account_name}/CheckOut",
        headers=headers,
        json={
            "Reason": reason,
            "DurationHours": duration_hours,
            "Safe": safe
        }
    )

    if response.status_code == 200:
        account_data = response.json()
        return {
            "username": account_data["UserName"],
            "password": account_data["Content"],
            "expires_at": datetime.now() + timedelta(hours=duration_hours),
            "checkout_id": account_data["CheckOutID"]
        }
    else:
        raise Exception(f"Checkout failed: {response.text}")

def check_in_account(checkout_id):
    """Check in the account (auto-rotate password)"""

    headers = {"Authorization": f"Bearer {API_TOKEN}"}

    response = requests.post(
        f"{CYBERARK_URL}/API/Accounts/{checkout_id}/CheckIn",
        headers=headers
    )

    if response.status_code == 200:
        print(f"Account {checkout_id} checked in — password rotated")
    else:
        print(f"Check-in failed: {response.text}")

# Usage
account = check_out_account(
    safe="Linux-Admins",
    account_name="root@web-prod-01",
    reason="Emergency patch deployment",
    duration_hours=1
)

print(f"Logged in as {account['username']}")
print(f"Password expires at {account['expires_at']}")

# After work is done:
check_in_account(account['checkout_id'])