1.0 NetIQ Privileged Account Manager - An Overview

NetIQ Privileged Account Manager (PAM) helps IT administrators to control and monitor the administrative access to servers, network devices and databases. The administrators are allowed controlled delegated access to the systems without exposing the administrative credentials to these systems. It also provides a centralized activity log across multiple platforms. The introduction of NetIQ Privileged Account Manager enriches the NetIQ Identity and Access Management by providing comprehensive Privileged Identity Management as well as auditing and tracking of privileged user activities in the organization. Privileged Account Manager provides Shared Account Password Management (SAPM) and Super User Privilege Management (SUPM) to secure the privileged accounts in the organization.

Certain situations open potential back doors into systems and increase the likelihood of a security breach in an enterprise network. For example, when running some commands that require elevated privileges, users sometimes get exposed to the super user or root account credentials. Similarly, passwords are often not changed when a user is no more performing the administrative role.

Privileged Account Manager provides the capability to monitor, audit, and secure the actions of the users by using a centralized and automated management of privileged account. Privileged Account manager helps in overcoming the following challenges:

  • The superuser credentials are exposed.

  • The confidential data is exposed.

  • There is unrestricted access rights provided to the user.

  • The identity of the user who accessed a particular system remains unidentified.

Figure 1-1 Challenges of Using a Privileged Account in an Enterprise

The following sections provide details on how Privileged Account Manager provides solution to these challenges:

  • It limits corporate susceptibility to unauthorized transactions and information access by helping organizations rapidly deploy Superuser Privilege Management (SUPM) and tracking across all Windows, UNIX (AIX, Solaris, HPUX), and Linux environments.

  • It can manage passwords and control access to the shared accounts, that is, Shared Account Password Management (SAPM). For more information, see Privileged Access to Applications and Cloud Services.

  • It provides facility to monitor in real time and record the session, that is, Privileged Session Management (PSM). For more information, see Section 8.0, Reports.

  • It can securely generate and return random password for any application by using REST API calls, eliminating the use of hard coded password. Hence, facilitating Application-to-Application Password Management (AAPM). For more information about the REST API calls for password management, see the REST API documentation in the user console.

  • It provides facility to integrate with Security Information and Event Management (SIEM) system to analyze detailed usage data. For more information, see Privileged Access to Applications and Cloud Services.

  • It reduces management overhead and infrastructure costs, controls and records which privileged users have access to what, and reduces costs and errors through demonstrable compliance audits.

  • It works by delegating privileged access, which is authorized via a centralized database. The end result is that a user is authorized to run the privileged command and all activity is logged.

  • It can be deployed quickly, provides faster response time, better logging and auditing and improved administration. The centralized database provides easier administration.

  • It provides a more secure system and a fast return on investment.

Figure 1-2 Privileged Account Manager Provides Solution to the Challenges