Privileged Access Management (PAM) Services
Ensuring your most sensitive credentials are kept secure and closely governed
Companies face numerous challenges in the ever-growing risk landscape:• Lack of centralized approach to securely storing,protecting, governing and managing the most sensitive
credentials both human and non-human.
• Lack of policies or standards that define requirementsfor protecting and managing privileged accounts.
• Inability or lack of formal process to rotate service
accounts or other application/system credentials.

• Improper storage of credentials by admins usingspreadsheets, file shares or databases, or high-riskprocesses run by RPA bots using credentials managed by
the RPA platform.
• Inability to manage privileged credentials used in theDevOps pipeline.
• Inability to adequately manage local admin rights onservers and workstations

How Protiviti Can Help
Protiviti’s end-to-end services to mature client's Privilege Access Security include:

ASSESS

PLAN• Development of• Development of PAM
strategy and roadmap
program (e.g., policies,to mature PAM
standards, risk model,program.
procedures, training).
• Plan strategic and• Privileged accounttactical approach to thediscovery and risk
rollout of the PAM tool,assessment.
including features and• Health check of PAM tool
functionality to support,
install to ensure proper
enable and secure thefoundation before
organization.
expanding usage.

DESIGN

BUILD• PAM solution
technical design andarchitecture.

• PAM tool installation,upgrade, enhancement
and optimization.
• Integration with thirdparty applications andservices.
• Execute and implement
communications,trainings, andprocedures for new
PAM implementation.

RUN• Managed services
offering for ongoing
management of PAM
tool and program.
• Remediation andcontinuation of
onboarding of accounts
into PAM tool.
• Implementation of
additional PAM
solution integrations.

Business Outcomes
A comprehensive analysis of the current state of yourorganization’s privileged access capabilities, deﬁned interms of benchmarking and maturity objectives.

A privileged access governance program based on real
and actionable data from your environment

An actionable, phased roadmap focused on actual
needs to “move the needle” and improve managementof privileged accounts over time.

A deployed or enhanced PAM solution to protect
key, high-risk privileged access

INNOVATE. TRANSFORM. SUCCEED.

Privileged Access Management (PAM) Services
The Protiviti PAM Methodology
Protiviti’s PAM Methodology is aimed to help customers better manage privileged access, spanning across human andnon-human static and ephemeral credentials, and on-prem and cloud assets.
Component

Description

Process Areas*

1

Discovery

Identify, detect anddocument privileged accounts••

Onboarding
Detection••

Account inventory
Definition2

Credential
Management

Protect, control and maintainprivileged credentials(passwords, secrets)•••

Session managementCredential lifecycle
Account review•••

Entitlements review
RequestCredential (secrets) repository

3

Monitoring andResiliency

Respond to incidents andmitigate threats•••

Forensics/recording
SIEM
Automated detection••

Incident response
Event identification

4

GovernanceLead, Educate and Continuing
Support•••

Application inventory
Risk prioritization
RACI

•
•

Service modelStandards*Protiviti process areas are mapped to NIST 800-53, NIST CSF, ISO 27001, ISO 27002, COBIT 5, HITRUST, HIPAA, Cloud Controls,CSC, PCI DSS, and FFIEC.

Client Challenge
One of the largest U.S. insurance providers requested a PAM assessment and 3-year
PAM roadmap to build a “gold standard” PAM program that met board-level obligations.
Additionally, the client needed assistance with aligning PAM tool practices with broader
PAM strategy and remediating existing privileged accounts to apply a risk-based
approach for managing passwords and governing access.

Solution Delivered
Insurance Provider
Client Case Study
PAM Assessment
and Technical
Enhancements

Assessed the client's PAM environment against Protiviti’s PAM Framework to identify gaps,
target state and a roadmap. Conducted assessment of current PAM tool environment.
Augmented current PAM tool implementation with improved design for grouping and managing
passwords and building additional plug-ins for multiple account platforms. Developed andimplemented approach to compile risk information for existing privileged accounts.

Business Results
Identified 40 gaps across five focus areas for remediation. Developed three-yearroadmap with two workstreams and seven total projects. Enhanced PAM governancewith development of PAM Standard, RACI and Service Model. Improved security andhealth of PAM tool installation. Remediated 2,000 accounts as part of new PAM tool
design. Met board obligation to onboard AS400, RACF and SAP privileged accounts.

For more information, contact:
Dusty Anderson

Contact Us

TechnologyConsulting@Protiviti.com

Managing Director
Direct: +1 816.582.2538
dusty.anderson@protiviti.com

Learn More

Protiviti.com/TechnologyConsulting© 2023 Protiviti Inc. An Equal Opportunity Employer M/F/Disability/Veterans. Protiviti is not licensed or registeredas a public accounting firm and does not issue opinions on financial statements or offer attestation services.