Symantec Privileged Access Manager

Privileged access is essential to configure, operate, and maintain IT applications and infrastructure because it enables capabilities and data access that normal users cannot obtain. Systems commonly include built-in privileged accounts to enable this elevated access, but these accounts and their usage must be tightly managed. Privileged access is no longer limited to IT administrators: business users and non-employees may also receive elevated access to sensitive assets such as HR records, payroll, financial information, intellectual property, and social media accounts. Digital transformation has expanded the privileged user population further, driven by cloud service delivery models and practices such as DevOps that require privileged capabilities.

Because privileged access can be abused with high impact, organizations must ensure trust through controls that address malicious abuse, unauthorized misuse (including privacy violations), and harmful mistakes. Privileged accounts are prime targets for cyber-adversaries because they can enable system takeover and unrestricted data access. Core controls include applying the Principle of Least Privilege, avoiding shared privileged accounts (or mitigating them via password vaulting), enforcing segregation of duties, using strong authentication, and continuously monitoring privileged activity to detect and respond to anomalies.

Symantec Privileged Access Management (PAM), now marketed by Broadcom following its acquisitions of CA Technologies (2018) and Symantec (2019), is presented as a mature PAM suite with roots going back to 1996 and additional capabilities via the Xceedium acquisition (2015). It provides credential vaulting, session recording, threat analytics with machine learning, host-based server control, and application-to-application password management to secure both human and non-human privileged actors across physical, virtual, and cloud environments. The platform emphasizes lifecycle governance, shared account controls, just-in-time provisioning integrations, fine-grained OS-level command control, and behavioral analytics, while noting challenges around DevOps maturity and potential acquisition-related continuity risks.

• Privileged accounts provide enhanced access to system components and functions that are not available to normal users.
• Business users can have privileged access to sensitive assets such as HR records, payroll details, financial information, intellectual property, and social media accounts.
• Cyber-adversaries regularly target privileged accounts because they can enable control over systems and unrestricted access to data.
• Broadcom acquired CA Technologies Inc. in late 2018.
• Broadcom acquired Symantec in November 2019 and markets the PAM solution under the Symantec brand.
• The solution evolved from Memco’s SeOS launched in 1996.
• A major component, Privileged Access Manager, came via the acquisition of Xceedium in 2015.
• A single appliance can support up to 3,000 concurrent privileged sessions with session recording.
• Symantec PAM supports out-of-the-box integration for Microsoft Azure, AWS, and Office 365.
• Symantec claims basic PAM functionality can be up and running in 2–3 days using auto-discovery of privileged accounts.

• “With privilege comes a greater need for trust; it is essential that steps are taken to assure this trust.”
• “Abuses of privilege can occur through malice, misuse, or mistake.”
• “Organizations must take steps to control the use of these privileged accounts.”
• “Avoid the use of shared accounts - many systems provide only a single privileged account – making it difficult to control and trace who did what.”
• “One way to control the use of shared accounts is to use tools that keep passwords to these accounts in a vault and that only release them as needed.”
• “Implement Strong Authentication for privileged accounts to make it more difficult for cyber-criminals to gain privileged access and to provide extra assurance over the identity of the administrator using it.”
• “Carefully monitor privileged account activity to assure trust in the way the accounts are used and act when abnormal activity is detected.”
• “Symantec Privileged Access Management is designed to prevent security breaches by protecting sensitive administrative credentials, controlling privileged user access, proactively enforcing security policies, and monitoring and recording privileged user activity across virtual, cloud, and physical environments.”
• “Just-in-time (JIT) privileged access management can help to reduce the privileged threat surface and reduce risk.”
• “Overall, this is a mature product with a comprehensive range of functionality.”