PAMBP

PAM Academy › Module 2 — Crafting a PAM Strategy

Module 2: Crafting a PAM Strategy

A decision is not a programme. Follow Layla — PAM Programme Lead at Abby Steel — as she builds a complete PAM programme from the Monday after a security incident to a board-approved strategy, a working operating model, a closed JML lifecycle, five enforced controls, and a measurable maturity roadmap. Ten acts. Forty slides. One unbroken story.

Story-based cinematic learning

180–210 minutes

IT Directors · CISOs · Compliance

★★★★★ 4.9 · IT Directors, CISOs, Compliance Officers

PAM StrategyOperating ModelJML LifecycleFive ControlsMaturity ModelReal-World Cases

Included

Part of the PAM Best Practice Academy curriculum

Start Module 2 → ← Back to Module 1

40 cinematic slides across 10 acts
Story-based narrative: Layla & Abby Steel
JML lifecycle: Joiner, Mover, Leaver
Five PAM controls with real-world cases
PAM maturity model: 5 stages
5-question knowledge check with certificate

Overview

Curriculum

Instructors

Module Number

Slides

180+

Minutes

Quiz Questions

Module 2 — Crafting a PAM Strategy

180–210 min

COMING SOON

What you will learn

▶

Build a board-approved PAM strategy with five pillars aligned to business risk and compliance

▶

Design an operating model with named owners: Business approves, Security reviews, IT provisions

▶

Close the JML lifecycle — Joiner, Mover, Leaver — including the forgotten Mover step that caused Ahmed’s twelve years of privilege creep

▶

Apply the five PAM controls: Least Privilege, RBAC, Segregation of Duties, JIT Access, and MFA

▶

Understand the PAM maturity model — five stages from Chaos to Governance — and assess where your organisation sits today

▶

Learn from real-world cases: Uber (57M records), Colonial Pipeline, Target, and British Airways — all rooted in privileged access failures

Module curriculum

Act 1: The IncidentThe Monday after. Ahmed’s twelve years of privilege. Layla inherits the crisis.

Slides

Act 2: The StrategyFive pillars, board approval, and why a decision is not a programme.

Slides

Act 3: The Operating ModelBusiness approves. Security reviews. IT provisions. Named owners, not org charts.

Slides

Act 4: Processes — Part 1Access request (7 gates) and deprovisioning. The operating model in action.

Slides

Act 5: Processes — Part 2 (JML)Closing the lifecycle: Joiner, Mover, Leaver. The Mover — the forgotten beat behind Ahmed’s creep. Automation.

Slides

Act 6: ControlsFive controls: Least Privilege, RBAC, Segregation of Duties, JIT Access, MFA. Real-world cases.

Slides

Act 7: Reality CheckIndustry statistics, three converging pressures (attackers, insurers, regulators), and the cost of inaction ($4.88M average breach, IBM 2024).

Slides

Act 8: Maturity ModelFive stages from Chaos to Governance. Where most organisations sit. Where Abby Steel is six months on.

Slides

Act 9: The HandoverLayla hands the discovery phase to Priya. Module 3 bridge: “You cannot protect what you cannot see.”

Slides

Act 10: The ClosingAhmed didn’t change. The organisation did. Module 2 complete.

Slides

Knowledge Check5-question quiz covering JML, operating model, Verizon 2024 stats, the whole machine, and maturity stages. Pass mark: 4/5.

Quiz

Section 1:

Section 1: Defining PAM Scope

“A 2-week tool demo is not a PAM strategy. A strategy is built on requirements, not on what the vendor wants to sell.” — PAM Best Practice

The most common reason PAM programmes fail is not technology — it is scope creep. Organisations try to protect everything at once and end up protecting nothing properly. A PAM strategy must begin with a clear, bounded scope that prioritises the highest-risk assets first.

Scope definition answers three questions: What systems are in scope? (databases, servers, cloud, network devices, applications), Who is in scope? (human admins, service accounts, third-party vendors, contractors), and What is out of scope for now? (development environments, low-risk test systems).

Industry reality: 67% of PAM programmes that fail do so within the first 12 months. The #1 cause is undefined scope — teams attempt to vault every credential simultaneously and collapse under the operational weight.

Phase 1 Scope (Weeks 1–8)

Tier 0 assets only: domain controllers, credential vaults, backup systems, root accounts. Highest risk, highest reward.

Phase 2 Scope (Months 3–6)

Tier 1 assets: production databases, web servers, email systems, payment platforms. Core business systems.

Phase 3 Scope (Months 6–12)

Tier 2 assets: development systems, test environments, non-critical applications. Completion of full coverage.

Out of Scope (Initially)

Personal workstations, low-risk SaaS tools, read-only accounts. Revisit in Year 2 as programme matures.

Section 2: Stakeholder Mapping

PAM is not an IT project — it is a business risk programme. Every stakeholder has a different lens. Understanding what each stakeholder needs from PAM is the difference between a programme that gets funded and one that gets cancelled after the first budget review.

CISO

Breach risk, incident response time, threat detection

Real-time alerting, session recording, forensic evidence in 15 min vs. 7 days

IT Director

Operational efficiency, help desk load, deployment risk

60% reduction in password reset tickets; automated provisioning; phased rollout

CFO

Cost justification, ROI, insurance premiums

3–9 month payback period; $217K/year savings; 5–10% insurance premium reduction

Compliance Officer

Audit evidence, regulatory alignment, access reviews

Automated compliance reports; quarterly access review evidence; GDPR/SOX/PCI DSS alignment

IT Operations

Day-to-day usability, workflow disruption, training burden

Self-service portal; role-based training; JIT access that does not slow operations

“The CISO wants to prevent a breach. The CFO wants to justify the spend. The IT Director wants it not to break anything. Your PAM strategy must speak all three languages simultaneously.”

Section 3: Access Control Methodologies

Choosing the wrong access control model is one of the most expensive mistakes in PAM. RBAC applied without SoD creates compliance violations. PoLP without JEA creates operational friction. The right model depends on your organisation's risk profile, regulatory requirements, and operational maturity.

PoLP — Principle of Least Privilege

Every user gets the minimum access required to do their job — nothing more. The foundation of every PAM programme. Reduces blast radius from any single compromised account.

RBAC — Role-Based Access Control

Access is assigned by role, not by individual. DBA role gets database access; sysadmin role gets server access. Scalable and auditable — essential for organisations with 50+ privileged users.

SoD — Segregation of Duties

No single person can authorise AND execute a critical function. Prevents fraud, insider threats, and compliance violations. A direct SOX requirement.

JEA — Just Enough Administration

Users get only the specific commands/actions they need — not full admin rights. A DBA can run SELECT queries but not DROP DATABASE. Surgical precision reduces insider threat risk by 80%+.

Two-Person Integrity (TPI)

Critical actions require two authorised people simultaneously. Used for financial transactions, production deployments, and data deletion. Prevents single-point insider threat.

JIT — Just-In-Time Access

Access is provisioned on-demand and auto-expires after a set period. No standing admin access = zero insider threat risk from dormant credentials. The gold standard for privileged access.

Compliance alignment: SoD is a direct SOX requirement. PoLP is mandated by GDPR’s data minimisation principle. JIT satisfies NIST AC-2 and PCI DSS Requirement 7. Choosing the right model is not just best practice — it is regulatory compliance.

Section 4: Joiner-Mover-Leaver Process

“The most dangerous moment in privileged access is not when a hacker attacks — it is when an employee leaves and their credentials are not revoked within 24 hours.”

The Joiner-Mover-Leaver (JML) process is the operational backbone of any PAM programme. Without a formal JML process, organisations accumulate stale, orphaned, and over-privileged accounts that become the primary attack surface.

Joiner (New Employee)

Access provisioned on Day 1 only for stated role; MFA enrolled; probation = limited access; automatic expiry if probation fails

GDPR “purpose limitation” — access only for stated job function

Mover (Role Change)

Previous access revoked within 24 hours; new role follows SoD rules; overlap period access review; change documented in audit trail

SOX change control; audit trail of all transitions

Leaver (Termination)

Vault password changed immediately; MFA reset; session recording continues until final logout; access audit report before closeout

GDPR “data minimisation” — access ends when employment ends

Industry benchmark: Standard role provisioning should complete in under 1 business day. Leaver deprovisioning should complete within 2 hours of termination notice — not 2 weeks. Every hour of delay is an open door.

Section 5: Delegation & Temporary Access

Delegation is the process by which a user temporarily grants their access rights to another user for a specific, time-bounded purpose. Without a formal delegation framework, organisations rely on shared passwords and informal email approvals — both compliance violations and security risks.

Manager Vacation

Manager delegates approval authority to deputy for 5 days

PAM control: Formal request → time-boxed approval → auto-expiry on return date → full audit trail of all approvals made under delegation

Emergency Access

On-call engineer needs production database access at 2 AM

PAM control: JIT request → manager approves via mobile → 4-hour access window → session recorded → auto-revoked at expiry

Vendor Access

Third-party vendor needs server access for maintenance window

PAM control: Scoped access (specific server only) → time-limited (maintenance window only) → session recorded → access removed immediately after window

Audit Support

External auditor needs read-only access to compliance logs

PAM control: Read-only role provisioned → specific systems only → audit period only → all access logged and reported to compliance team

Knowledge Check

Q1: In the JML lifecycle, which stage is most commonly forgotten — and was the exact mechanism behind Ahmed’s twelve years of accumulated privilege?

B) Mover — removing old access when someone changes role ✓

A) Joiner — provisioning new access on day one

C) Leaver — revoking access on the last day

D) Reviewer — periodic access certification

Q2: Which of the following best describes the PAM operating model at Abby Steel?

B) Business approves, Security reviews, IT provisions — each with a named owner ✓

A) IT owns all access decisions end to end

C) The CISO approves all privileged access requests personally

D) Access is self-service with no approval required

Q3: According to the Verizon 2024 DBIR, what percentage of breaches involved a human element such as a mistake or stolen credential?

C) 68% ✓

A) 28%

B) 45%

D) 91%

Q4: The PAM programme is described as “four parts, one system”. Which four parts make up the whole machine?

B) Strategy, Operating Model, Processes, Controls ✓

A) Discovery, Vaulting, Session Recording, Reporting

C) Policy, Technology, Training, Audit

D) Risk, Compliance, Governance, Assurance

Q5: At which PAM maturity stage does Abby Steel sit six months after the incident — and what defines that stage?

C) Stage 3 — Control: least privilege, RBAC, MFA, and defined processes actively enforced ✓

A) Stage 1 — Chaos: unknown accounts, unmanaged privilege

B) Stage 2 — Visibility: discovered what exists but cannot yet stop it

D) Stage 4 — Automation: the lifecycle runs itself