PAM During a Security Incident

An incident involving privileged access is the case the programme exists for. What it provides depends on decisions made long beforehand.

What it should provide

Who had access to the affected system, immediately, from the inventory.

Who actually accessed it, and when, from session records.

What they did, from recordings.

Which credentials may be exposed, from the account inventory.

A rotation capability that can be exercised under pressure.

A path to administer systems that does not depend on possibly-compromised credentials.

What to assume

If privileged credentials may have been exposed, assume all of them were. Partial rotation based on optimistic scoping is how incidents recur.

If the vault was reachable from the compromised environment, assume its contents are known.

If the attacker held tier zero, assume the audit log is unreliable, which is why logs should be shipped to a destination privileged users cannot alter.

If a host was compromised, assume every credential used on it is known, which is the tiering rule applied in reverse.

The rotation drill

The capability that determines recovery time, and the one almost nobody has practised.

Rotate in tier order: tier zero first, then downward.

Service accounts are the bottleneck, because of dependency mapping, which is why that mapping should exist before the incident.

Measure how long it takes in a drill, annually. Organisations that have never tried discover it takes weeks.

Have the order written down in advance, because deciding it during an incident wastes the first day.

Preserving evidence

Conflicts with speed, and the conflict must be resolved in advance rather than argued about at the time.

Decide who decides, and give them the authority.

Export session recordings for the relevant window before automatic retention deletes them, which is a real risk with short retention periods.

Preserve the inventory state at the time, which a periodic snapshot provides and a live system does not.

Preserve broker logs separately from the broker.

Administering during the incident

Assume the normal path may be compromised.

Prefer out-of-band access that an attacker in the environment cannot observe.

Use break-glass credentials where the normal path is suspect, and rotate them afterwards.

Do not authenticate tier zero credentials to systems you believe are compromised, which is the most common and most damaging error made under pressure.

Establish a clean administrative path first, even though it costs time at the start.

Afterwards

Rotate everything used during the response.

Review every session recorded during the incident window.

Unwind every emergency grant, verified.

Update the inventory with what the incident revealed, which is always something.

Feed the gaps back: which system was not onboarded, which path was not mapped, which account had rights nobody knew about.

Re-measure the rotation time, because the drill and the real thing differ and the difference is the finding.

The rotation runbook

Written in advance, because deciding the order during an incident costs the first day.

The tier order, explicitly, with the specific accounts in each.

Who performs each, and their deputies.

The dependency notes for service accounts, from the mapping work.

The verification step for each: confirm the old credential fails.

The clean administrative path to use, which must not rely on possibly-compromised credentials.

Estimated duration per tier, from the drill.

Held offline, with the rest of the recovery documentation.

Preserving before remediating

The conflict that must be resolved before it arises.

Remediation destroys evidence. Rotating a credential, rebuilding a host, revoking a session all remove information.

Preservation delays containment, which has its own cost.

Decide who decides, in advance, and give them authority.

Define the minimum preservation that happens regardless: export session recordings for the window, snapshot the inventory, preserve broker logs separately.

Note that short retention periods can delete evidence during the response, which is a reason to export early rather than to rely on the archive.