Privileged access management (PAM)
The tools and procedures that control, limit and log the use of administrator accounts, whose compromise turns an ordinary intrusion into total takeover.
Privileged accounts, domain administrators, service accounts, root access, cloud console accounts, allow anything on a system: creating users, disabling protections, wiping backups, deploying software to every machine. Their compromise is therefore the step every serious attacker seeks, and the one that turns a local incident into a widespread loss. Privileged access management gathers the practices that reduce this risk: inventory of accounts, removal of standing rights in favor of temporary elevation, storage of secrets in a vault that rotates them automatically, strong authentication, session recording and alerts on abnormal use. For insurance, the measure acts both on frequency, by closing an escalation path, and on severity, by preventing backup destruction and mass deployment of ransomware. Underwriting applications question it ever more precisely, because multi-factor authentication on remote access alone does not protect an administrator account whose password sits in a script.
In September 2022, an attacker who entered Uber through social engineering found, on a network share, a script containing in plain text the administrator credentials for the company's privileged access management tool, which opened access to many internal systems and cloud consoles.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.