What is privileged access management (PAM)?
Privileged access management (PAM) is the set of tools and practices used to control accounts with elevated rights, such as domain administrators, root accounts and the administrators of backup and storage systems. It aims to make privileged access rare, short-lived, attributable to a person and recorded.
What does PAM do?
PAM products and processes share a few core functions.
| Function | What it does |
|---|---|
| Credential vaulting | Stores privileged passwords and keys centrally and rotates them |
| Check-out and approval | Releases a credential on request, sometimes with a second approver |
| Just-in-time access | Grants rights for a limited period, then removes them |
| Session brokering and recording | Connects the administrator without revealing the password and records the session |
| Discovery | Finds privileged accounts that are not yet managed |
| Reporting | Shows who used which privilege and when |
How does PAM apply to backup systems?
Backup administrators hold some of the most consequential rights in an organization, since they can delete the copies everything else depends on. Bringing the backup console, the repository servers and the storage management interface under PAM means their administrative passwords are not known to individuals, each use is tied to a named person and unusual sessions are visible. The service accounts and access keys that backup jobs use can be rotated on a schedule in the same way.
Should the PAM system depend on production?
This is the design question that matters most. If the PAM vault runs on the production infrastructure and authenticates against the production directory, an incident that takes those down also blocks access to the credentials needed for recovery, and an attacker who controls the vault controls every account in it. Backup and recovery systems therefore need a path that does not depend on the PAM platform being available: a break-glass account held offline, and ideally backups of the vault itself that can be restored first.
What does PAM not cover?
PAM controls how people obtain privileged access. It does not limit what a legitimately obtained session can do, and it does not protect credentials that software uses outside the vault. For backups, the remaining gap is closed by role-based access control to narrow each account's rights, by the four-eyes principle for destructive actions and by immutability at the storage layer, which holds even when a privileged session is hijacked. Where MFA helps for backups maps the same boundaries for authentication.
Frequently asked questions
Is PAM the same as a password manager?
A password manager stores secrets. PAM adds approval, time limits, session control, rotation and audit for privileged accounts specifically.
Do small organizations need PAM?
The practices apply at any size: few privileged accounts, named users, rotated passwords and recorded use. A dedicated product becomes worthwhile as the number of systems grows.
Can PAM stop ransomware from deleting backups?
It makes privileged accounts harder to steal and misuse. It does not replace immutable storage, which protects backups even if an account is taken.