PAM (Privileged Access Management) Principles
Controlling and limiting the most powerful accounts
Privileged access management, or PAM, groups the set of practices and tools aimed at controlling, limiting and monitoring the accounts that have elevated permissions within an organization, such as network administrators, server root accounts or users with access to entire databases, applying principles such as just-in-time access, which grants privileges only for the strictly necessary period, and permanent least privilege. This matters in practice because privileged accounts represent a risk disproportionate to their number, since compromising a single domain administrator account can give an attacker full control over the infrastructure, while compromising a standard user's account usually has a much more limited impact. A concrete example of PAM in action is removing permanent administrator accounts on workstations, so a technician must request and justify temporary privilege elevation every time they need to install software, instead of operating with administrative permissions all the time for convenience.