Privileged Access Management (PAM)

Privileged access is where identity risk concentrates

Administrator and service accounts carry the most risk and often get the least governance. A PAM product may be in place, but privileged accounts are still provisioned by hand, certified separately from everything else, or left active after the people who used them have moved on.

We connect privileged access to the rest of your identity program, so the same lifecycle, approval, and certification controls apply to every account.

What we deliver

• Privileged access lifecycle management tied to the identity lifecycle
• Integration of PAM with identity governance, so privileged and standard access are governed from one interface
• Privileged access certification campaigns
• Role models for system administrators, help desk, and other privileged functions
• Strong authentication, including PIV-based MFA aligned with HSPD-12
• Identity Threat Detection and Response (ITDR)

If you already own a PAM product, we start by making it work with your governance processes rather than replacing it.

Platforms we know deeply

CyberArk, integrated with SailPoint IdentityIQ.

In practice: privileged access governance at the IRS

As a subcontractor to CDW Government, Zephon led major design, implementation, migration, and operational-support work on the IRS's SailPoint IdentityIQ identity governance system, deployed in AWS GovCloud in a FedRAMP Moderate environment. The environment covers 110,000+ user identities and 50,000+ non-human identities.

• One interface for privileged and standard access: CyberArk integrated with SailPoint IdentityIQ, so both are governed from a single interface.
• Certifications: privileged and non-privileged access certifications for all users, with multiple campaigns completed since go-live.
• Approvals: access request workflows with up to 10 levels of approval and different approver groups for each request type.
• Role models: role-based access for managers, approvers, help desk, system administrators, and reporting.
• Strong authentication: PIV-based MFA aligned with HSPD-12, with SAML federation.
• Audit: the system supported GAO, FISMA, FedRAMP, and TIGTA audit activities and maintained its Authorization to Operate.
• Operations: Zephon has provided 24x7 Tier 2/3 operational support, continuous patching, and POA&M resolution.

Read the IRS case study.

See also Identity Governance and Administration and ICAM.