The purpose of this article is to discuss the best privileged access management solutions in 2023. According to MarketsandMarkets.com, the Privileged Identity Management, or Privileged Account Management market is expected to grow at a 32% Compound Annual Growth Rate (CAGR). No doubt that the reasons for this is due to the growing concerns over cyber security and the effectiveness of cyber breaches due to attacks like pass the hash. Organizations are not only looking to bolster their traditional perimeter tools, but also invest in innovative ways to protect their most sensitive resources. And what a better way than to invest in protecting resources that are ultimately deemed the keys to the kingdom, or rather, Privileged Accounts.
What is Privileged Access Management (PAM)?
PAM tools help organizations mitigate the risk of an attacker gaining access to an account with elevated permissions — permissions to change the permissions of other users, permissions to access the most sensitive data in the organization, and permissions to change passwords of credentialed accounts.
PAM tools have a multitude of capabilities to help protect organizations, including:
- Privileged Account discovery. Finding all accounts within an environment that has elevated or administrative privileges. This could include not only those found in Active Directory, but also those
- Store passwords in an encrypted vault. Many organizations do not have a formal password management system and rely on plain text spreadsheets. Storing passwords in an encrypted vault mitigates the risk of an attacker finding more accounts with privileged access.
- Automatically rotate passwords and meet complexity requirements.
- Create an audit trail for activity under a privileged account by logging and recording its session.
- Enable the ability to temporarily provision accounts for use cases like third party vendors, and automatically remove those accounts after a time window threshold has been met
- Provide single sign on capabilities in tandem with multi-factor authentication in order to meet compliance requirements.
So, what are the best PAM tools in 2023?
BeyondTrust
The Good:
- Excellent Reputation for Customer Support
- Comprehensive set of PAM tools for securing, controlling, monitoring, alerting, and recording access to privileged accounts, especially for service/application accounts
- Continuously discover and on-board new accounts
- Has a good reputation for integrating with its vulnerability management solution as well as ServiceNow.
What to Consider and Be Careful About:
- BeyondTrust was recently acquired by Bomgar, a company that sells a competing product called Lieberman Software. The roadmap for Bomgar’s PAM products and BeyondTrust’s PAM products are unknown.
- Documentation is 190 pages and implementation in house is not for the faint of heart. An integration partner or implementation by the manufacturer is highly recommended for a successful outcome.
Centrify (Now Delinea)
The Good:
- Excellent reputation for Privileged Management of credentials between applications.
- Active Directory Briding with Unix/Linux so that Privileged Accounts from Unix/Linux can be managed within Active Directory.
- HTML5 web interface
- Integrates with Multi-factor authentication
- Has analytics option that uses machine learning to understand if there are any user escalations that meet anomalous / malicious behavior criteria.
What to Consider and Be Careful About:
- Centrify was recently acquired by Thoma Bravo, the same company that bought Bomgar who has a competing product (formerly Lieberman Software).
- Process for setting up alerts can be complex
- You can set this up inhouse but it is complex like all PAM solutions. Typically, if you think you will need support from Centrify, then it would be better to have an integration partner.
CyberArk
The Good:
- Very stable, scalable, and reliable system with broad integration across applications and other tools.
- CyberArk can manage large deployments well and as long as the deployments are designed and engineered well CyberArk can take on many use cases with stable implementations.
- There is flexibility in password management. You can create one time passwords for check outs, you have the ability to change passwords daily, and create different password strength criteria (for example, some applications allow varied special characters while others don’t.
- The interface and reporting features have been widely praised
What to Consider and Be Careful About:
- Although support is excellent it has been reported that there can be at times considerable leg work to get things resolved (i.e. gathering log data and sharing it with support). It has also been reported that getting through to the right person for specific issues can take some time and be challenging.
- Ensure that the critical infrastructure supporting CyberArk has enough capacity to fit the performance that CyberArk will require
- There have been reports that different versions have had their fair share of glitches, however, these have been remediated after working with support.
Thycotic (Now Delinea)
The Good:
- Thycotic has an excellent account discovery platform that scans through both Active Directory and the network to discover privileged accounts (VMware, Windows, Microsoft SQL, Oracle, UNIX, Linux, etc)
- Thycotic has been reported by many as easy to use with a well layed out and logical GUI interface.
- Thycotic is scalable for both small and large organizations and it has been reported by many as having excellent technical support who can get things done right away.
What to Consider and Be Careful About:
- Thycotic does not solve for every use case. For very large organizations who have structured teams it may not make sense.
- Although this solution is easy to manage, customization and implementation takes skilled engineering and should not be done in house.
- Implementation services should be purchased with the solution.
Although there are several PAM tools on the market to choose from, an evaluation of at least three should be done in order to understand which solution fits the mold of your specific use cases and needs. PAM tools are one of the primary tools in the security toolbelt to mitigate against the risk of a cyber breach and should be considered in the overall cyber security strategy.