Privileged Access Management: vaulting, session control, and break glass

What Is Privileged Access Management?

A single compromised domain administrator account can disable security controls, exfiltrate data, or establish persistence across an entire Active Directory forest. Privileged Access Management (PAM) controls high-risk accounts that can change system configurations, access sensitive data, or execute administrative functions. PAM operates through three core mechanisms: credential vaulting that stores and rotates privileged passwords, session proxying that mediates connections to target systems, and just-in-time access that provisions temporary elevated privileges.

Removing standing access to privileged credentials and requiring approval workflows for elevation are what change security outcomes in most organizations.

The break glass component provides emergency access when normal PAM controls would prevent critical incident response. Break glass access bypasses standard approval workflows but should trigger enhanced logging and mandatory post-incident review — not reduced oversight. The real tradeoff in break glass design is containment speed versus approval controls, not audit trail integrity. Break glass, done correctly, produces more audit data than a normal session, not less.

Core capabilities

Credential vaulting stores privileged passwords in encrypted repositories and automatically rotates them on scheduled intervals. The vault becomes the single source of truth for privileged credentials, replacing shared passwords stored in spreadsheets or static service account configurations. Vaulting eliminates password reuse across the accounts the vault manages — unvaulted accounts remain outside this control, which is why account discovery must precede vault deployment.

Session recording and proxying capture privileged user activity and mediate connections between users and target systems. The PAM solution intercepts SSH, RDP, database, and web-based sessions, logging keystrokes, commands, and screen activity. Session proxying allows the PAM system to terminate suspicious sessions in real-time and apply policy controls mid-session. Organizations should be aware that keystroke logging can capture credentials entered during sessions and may raise privacy or works council compliance obligations in certain jurisdictions.

Just-in-time (JIT) access provisioning grants temporary elevated privileges when users request access and removes them after a predetermined window. Creating and deleting ephemeral accounts is one JIT model, but many deployments instead use time-bound role or group membership activation — Azure Entra Privileged Identity Management is a common example — or vaulted credential checkout. In cloud environments, JIT typically means activating a role assignment rather than creating a new administrative account. The core goal across all models is eliminating standing privileged access that remains active indefinitely.

Access request workflows route privileged access requests through approval chains based on risk levels and business impact. Workflows can require multi-person authorization for sensitive systems or automatically approve low-risk requests based on predefined criteria. Integration with ticketing systems links privileged access to business justification and change management processes.

Secrets management for non-human identities addresses service accounts, automation pipelines, and machine-to-machine authentication, which collectively represent a large and often undercontrolled segment of privileged access. Applications that previously held hardcoded credentials can instead retrieve secrets dynamically from the vault. This is distinct from session-based human access and typically requires purpose-built secrets management capabilities or dedicated platforms.

Implementation considerations

Account discovery and inventory is the foundational implementation step. Organizations must identify all privileged accounts across domain controllers, databases, network devices, cloud platforms, and applications before implementing vault controls. Incomplete account inventory creates blind spots where unmanaged privileged credentials persist outside PAM oversight, and attackers can leverage those unvaulted accounts to maintain persistence.

Target system integration determines which privileged access methods PAM can control. Systems that support programmatic password changes enable automated rotation, while legacy applications may require manual updates. SSH access can be managed through two distinct models: rotating individual key pairs, or deploying a certificate authority that issues short-lived certificates. Short-lived certificates are generally preferred because they expire automatically without requiring active rotation. For application-to-application credential management — where an application pulls secrets from the vault at runtime — application code or configuration must be modified to support vault API calls. This is different from session proxying, where the PAM system injects credentials on behalf of the human user and no application changes are required.

PAM platform security deserves explicit attention. The PAM system itself is a high-value target: whoever can administer the vault has effective access to everything it manages. PAM administrative access should require strong authentication, be restricted to dedicated privileged access workstations, and be subject to its own session recording and approval controls. Monitoring for anomalous access to the vault's administrative interfaces is as important as monitoring what users do after they check out credentials.

MFA for PAM access should be treated as a baseline requirement, not an optional enhancement. All access to the PAM portal and credential checkout workflows should require phishing-resistant MFA where feasible. For break-glass accounts specifically, Microsoft and other cloud providers now enforce MFA on administrative portals, making FIDO2 security keys or equivalent phishing-resistant methods the practical standard for emergency accounts. A break glass account that depends on a password alone may be inaccessible when needed or accessible to an attacker who has compromised the password.

Endpoint and workstation controls limit what an attacker can accomplish even when PAM controls are in place. Vaulting does not prevent credential theft if an administrator authenticates from a compromised host — the session itself can be hijacked. Privileged access workstations, Windows Credential Guard, Protected Users security group membership, and tiered administration models address the endpoint exposure that credential vaulting alone cannot close. Endpoint local administrator account management — through Windows LAPS or equivalent tooling — and the removal of standing local admin rights from general-purpose workstations are related controls that belong in any comprehensive privileged access program.

Session recording storage and retention create significant infrastructure requirements. Recordings of privileged sessions generate substantial data volumes requiring secure storage with tamper protection. Organizations must balance retention periods for compliance requirements against storage costs and performance impact.

High availability and disaster recovery become critical when PAM controls all privileged access paths. PAM system failures can lock administrators out of critical systems during incident response. The answer is not simply choosing a higher availability target — it is ensuring that break-glass procedures work entirely independently of PAM availability. Clustering PAM components addresses planned maintenance and component failures; break glass handles scenarios where PAM itself is unavailable.

Performance impact on privileged workflows varies significantly based on implementation approach. Session proxying adds network latency and can affect database query performance or file transfer speeds. Password rotation can disrupt service accounts if applications cache credentials or lack graceful authentication failure handling.

Getting started checklist

Privileged account inventory
- [ ] Discover domain administrator, enterprise administrator, and schema administrator accounts across all Active Directory forests
- [ ] Identify database administrator accounts for SQL Server, Oracle, MySQL, and NoSQL platforms
- [ ] Catalog network device administrative accounts on firewalls, switches, routers, and load balancers
- [ ] Map cloud platform privileged roles including AWS IAM, Azure global administrators, and GCP organization administrators
- [ ] Document application administrative accounts and service accounts with elevated permissions
- [ ] Inventory non-human identities including service accounts, automation credentials, and API keys
- [ ] Establish account classification criteria separating emergency, regular administrative, and service accounts

PAM infrastructure deployment
- [ ] Size vault storage requirements based on account count and session recording retention policies
- [ ] Deploy PAM components with network segmentation isolating vault databases and session proxies
- [ ] Configure encrypted connections between PAM components and target systems
- [ ] Establish backup and disaster recovery procedures for vault databases and configuration data
- [ ] Test high availability failover scenarios and document recovery time objectives
- [ ] Require MFA for all PAM portal access and credential checkout workflows
- [ ] Restrict PAM administrative access to dedicated privileged access workstations
- [ ] Create monitoring for PAM system health, administrative access to the vault, and privileged access request volumes

Access control configuration
- [ ] Define approval workflows mapping privilege levels to authorization requirements
- [ ] Configure automatic password rotation schedules based on account risk classifications
- [ ] Establish session recording policies specifying which activities require full capture, accounting for any applicable privacy or works council requirements
- [ ] Set maximum session durations and idle timeout values for different account types
- [ ] Create access request templates linking business justification to privileged account types
- [ ] Test JIT access provisioning (account creation, role activation, or credential checkout as appropriate) and verify automated cleanup after access windows expire
- [ ] Deploy Windows LAPS or equivalent for endpoint local administrator account management

Break glass procedures
- [ ] Document emergency access scenarios requiring break glass activation
- [ ] Create offline privileged account credentials stored in secured physical locations, with phishing-resistant MFA credentials (such as FIDO2 keys) for cloud and portal access
- [ ] Establish break glass notification procedures — break glass use should alert security teams immediately and automatically; approval is not required before use, but post-use review is mandatory
- [ ] Configure enhanced logging for all break glass access activities
- [ ] Define mandatory post-incident review processes and documentation requirements
- [ ] Rotate break glass credentials after each use
- [ ] Test break glass procedures during scheduled maintenance windows, including scenarios where PAM is unavailable

Integration and testing
- [ ] Integrate PAM with identity governance systems for access certification workflows
- [ ] Configure SIEM integration for privileged access logging and anomaly detection
- [ ] Test privileged workflows end-to-end including password rotation and session recording
- [ ] Validate application connectivity through PAM proxies and credential injection
- [ ] Verify compliance reporting capabilities meet regulatory documentation requirements
- [ ] Train administrators on PAM request procedures and emergency access protocols

Common use cases

Database administration through PAM eliminates shared DBA passwords and provides detailed audit trails of schema changes, data access, and privilege escalation. Database administrators request temporary elevated access through approval workflows rather than maintaining persistent administrative connections. Session recording captures SQL commands and data queries for compliance reporting and forensic investigation.

Cloud infrastructure management uses PAM to control access to highly privileged cloud roles and service accounts that can modify security configurations. Just-in-time role activation creates time-bound cloud administrative access linked to specific tasks such as security group modifications or resource deployments. AWS root account credentials for member accounts in an AWS Organization can now be centrally managed and effectively removed using AWS's centralized root access management capability, which is preferable to treating root as a standard JIT target. Break glass procedures provide emergency access to cloud platforms when normal authentication systems fail or require immediate security response, and should include phishing-resistant MFA given enforcement requirements on cloud administrative portals.

Network device administration centralizes router, switch, and firewall administrative credentials in PAM vaults while recording all configuration changes. Automated password rotation ensures network device passwords change regularly without manual intervention across large device inventories. Session proxying allows administrators to access network devices through PAM while maintaining detailed logs of command execution and configuration modifications.

Emergency incident response leverages break glass access when security incidents disable normal authentication systems or require immediate administrative action. Break glass procedures bypass standard approval workflows but trigger enhanced monitoring and mandatory post-incident documentation. Emergency accounts should be pre-tested, have working MFA credentials staged, and be rotated after each use.

Secrets management for automation and pipelines extends PAM controls to non-human identities, preventing hardcoded credentials in scripts, configuration files, and CI/CD pipelines. Applications retrieve secrets dynamically from the vault rather than storing them statically, and secrets can be rotated without redeploying applications.

Compliance implications

SOX compliance requires documented controls over privileged access to financial systems and audit trails of administrative activities. PAM supports the IT general controls — around access management, change management, and logging — that external auditors evaluate as part of SOX Section 404 assessments. Session recording and approval workflows can serve as supporting evidence, but SOX does not mandate specific PAM implementations. The connection is that strong PAM controls reduce the risk of control deficiencies auditors would otherwise flag.

PCI DSS 4.0 requirements (the current and only active standard since March 2024) mandate restricted access to cardholder data environments and logging of all administrative activities in systems processing payment information. PAM controls support PCI DSS requirement 8.2.1 for unique user identification, requirement 10.2.1.2 for audit logging of privileged user actions, and section 7.2 which establishes least privilege as a requirement. Just-in-time access provisioning directly supports least privilege by eliminating standing access to payment processing systems.

NIST Cybersecurity Framework 2.0, released in 2024, added a Govern function and reorganized identity and access management controls under the Protect function's PR.AA category. PAM implementation maps to these identity controls. Session recording and behavioral analysis support the Detect function by providing visibility into privileged user activities. Break glass procedures enable the Respond function by ensuring incident response teams can access critical systems during security events.

ISO 27001:2022 access control requirements apply to organizations certified under the 2022 revision, which completed its transition from the 2013 standard in October 2025. The relevant Annex A controls are now 5.15 through 5.18 (identity management, access control, authentication, and access rights) and 8.2 (privileged access rights specifically). Logging requirements fall under control 8.15. PAM approval workflows and access certification capabilities provide evidence across these controls, and session recording supports the logging and monitoring requirements in 8.15.