Micro Focus NetIQ Privileged Account Manager

Short Summary

Privileged Access Management (PAM) platforms reduce risk from privileged access misuse, a common factor in successful cyberattacks. Poor PAM software, policies, and processes enable abuse of shared credentials, unauthorized use of elevated privileges, theft of privileged credentials, and third-party privilege abuse. A 2020 report found potentially malicious privileged access from unknown sources made up 74% of privileged-access anomaly detections, creating costly investigation overhead even when events are benign. As attackers increasingly target privileged accounts to gain entry and launch ransomware, PAM is positioned as a core control against malware distribution, phishing, and data exfiltration.

PAM’s scope has expanded beyond administrators to task-based access across organizations, spanning legacy infrastructure, multiple clouds, on-premises networks, partner networks, and sometimes mainframes. This emerging “ultra-hybrid” environment is framed as part of a Dynamic Entitlement Resource and Access Management (DREAM) paradigm, pushing PAM platforms to deliver rapid, secure access to dynamic resources and to support Zero Trust Architecture goals.

Micro Focus markets NetIQ Privileged Account Manager within its CyberRes portfolio. The platform includes a credential vault, privileged session management and recording, endpoint privilege management, and SIEM integration (notably ArcSight and SYSLOG-compatible SIEMs) to correlate privileged behavior with policies and detect vulnerabilities. It offers connectors for SAP, Oracle DBMS, Salesforce, AWS, and Azure, plus an admin-friendly drag-and-drop policy workflow and an integrated “dry run” testing tool.

Recent enhancements include integration with Micro Focus Interset (UEBA) to calculate risk scores and influence session decisions, agentless Windows/Linux deployment, real-time session streaming for oversight and termination, improved interfaces, and a console for fast session switching. Key gaps remain around native DevOps support, missing continuous/scheduled discovery scans, and the need for a PAM-as-a-Service (PAMaaS) option and clearer product branding.

Interesting Facts

• Potentially malicious privileged access from an unknown source accounted for 74% of privileged-access anomaly behavior detections in a 2020 report.
• Micro Focus operates in 48 countries and has $3.0bn annual revenue.
• NetIQ Privileged Account Manager includes a credential vault, privileged session management, session recording, and endpoint privilege management.
• The platform integrates with ArcSight SIEM and also supports other SIEMs via SYSLOG.
• Direct connectors are available for SAP, Oracle DBMS, Salesforce, AWS, and Azure.
• Administrators can create privileged access rules and policies using a drag-and-drop interface.
• A fully integrated testing tool supports “dry running” new rules before production deployment.
• Integration with Micro Focus Interset provides UEBA-based risk scores derived from anomaly signals such as application, time, location, and device.
• The platform supports agentless capabilities for both Windows and Linux deployments.
• Real-time session streaming enables live monitoring and the ability to terminate a privileged session.

Notable Quotes

• “It is clear hackers are actively targeting privileged accounts as the best way to get inside an organization and increasingly use them to mount ransomware attacks.”
• “PAM is an essential component in protecting organizations against cyber-attacks, malware distribution, phishing, and data exfiltration.”
• “This is no longer the case as privilege management use cases extend across entire organizations, with users requiring task-based access to data, services and applications held on legacy and multi-cloud-based infrastructures.”
• “Interest in Zero Trust Architecture (ZTA) designs and policies has grown.”
• “This Dynamic Entitlement Resource and Access Management (DREAM) paradigm is what the next iteration of PAM platforms (and other identity and data governance tools) must be engineered to fit.”
• “These ultra-hybrid networks will test existing identity and security frameworks to their limit and call for solutions that provide rapid access to dynamic resources wherever they are held - to where they are required.”
• “Speed and ease of deployment will be a critical measure for PAM vendors in multi-hybrid environments.”
• “This capability allows a secondary user to audit a privileged session in real-time and make decisions based on detected risky behaviour, providing the ability to terminate the session if desired.”
• “One area we would like to see better addressed is support for DevOps and other agile Ops environments as capabilities remain limited…”
• “The platform is now positioned to become one of the leading lights in the PAM market with careful development”