Privileged Access Management (PAM)

Make privileged access to critical systems visible, controlled, time-bound and auditable.

Administrator accounts, root accounts, service accounts, application identities and third-party access have broad privileges over an organization's most critical systems. The compromise of just one of these accounts can lead to serious consequences, including data loss, service disruption, ransomware, lateral movement and unauthorized configuration changes.

Privileged Access Management (PAM) provides reliable and auditable answers to the questions: Who accessed which system, with what privileges, when, and what did they do during the session? PAM discovers privileged identities and credentials, protects passwords in secure vaults, enforces access through roles, policies, approvals and time restrictions, and monitors and records privileged sessions.

BBS approach: BBS delivers end-to-end PAM solutions by aligning IBM, Fortinet and Delinea technologies with each organization's infrastructure, security architecture, operating model and regulatory obligations.

Why PAM Is Essential

Traditional access controls may be adequate for standard user accounts, but accounts with broad privileges over critical systems require stronger safeguards. Shared administrator passwords, standing privileges, forgotten service accounts, uncontrolled local administrator rights and unrecorded remote connections all create significant security exposure.

An effective PAM architecture gives organizations the ability to:

• Automatically discover privileged accounts, service accounts and credentials
• Protect passwords, SSH keys, certificates and other secrets in encrypted vaults
• Automatically rotate passwords according to policy or immediately after use
• Launch secure sessions for shared accounts without exposing passwords to users
• Apply role-based access, multi-factor authentication and multi-level approval workflows
• Use Just-in-Time and Just-Enough Privilege models instead of standing administrator rights
• Monitor, record and, when necessary, terminate RDP, SSH, web and other administrative sessions
• Remove local administrator rights from endpoints while securely elevating approved applications
• Restrict third-party and vendor access to authorized systems, time windows and actions
• Produce tamper-resistant records for audits, incident investigations and compliance activities

BBS PAM Solution Portfolio

PAM requirements differ from one organization to another. Some organizations prioritize vaulting shared administrator accounts, while others focus on removing endpoint administrator rights, enforcing command-level authorization on servers or securing vendor connections. BBS evaluates these needs and positions the right products within a unified security architecture.

Solution	Primary focus	Typical use case
IBM Privileged Identity Management	Privileged accounts, passwords, endpoint and server privileges	An integrated PAM approach within the IBM security and identity ecosystem
Fortinet FortiPAM	Credential vaulting, session management and secure remote access	IT and OT environments using Fortinet Security Fabric
Delinea PAM / Secret Server	Privileged account discovery, vaulting, password rotation and session auditing	Enterprise-scale centralized PAM and shared account management
Delinea Privilege Manager	Endpoint privilege management and application control	Removing local administrator rights on Windows and macOS devices
Delinea Connection Manager	Centralized RDP and SSH session management	System and support teams managing large numbers of remote sessions
Delinea Server Suite	Server identities and Just-in-Time / Just-Enough authorization	Centralized policy management across Linux, UNIX and Windows servers

IBM Privileged Identity Management (IBM-PAM)

The IBM Verify Privileged Identity product family enables organizations to discover, control, manage and protect privileged accounts across endpoints and hybrid multicloud environments. Powered by Delinea technologies, the portfolio addresses a broad range of PAM requirements through modular capabilities for password vaulting, endpoint control, server policies, DevOps secrets and service-account lifecycle management.

IBM Verify Privilege Vault

• Discovery and centralized inventory of privileged accounts and credentials
• Encrypted vaulting of passwords and other secrets
• Automated password rotation and policy-based credential management
• Access authorization based on role and business need
• Monitoring, recording and auditing of privileged sessions
• Support for hybrid environments through cloud and on-premises deployment options

IBM Verify Privilege Manager and Server Suite

IBM Verify Privilege Manager reduces standing local administrator rights on endpoints while allowing trusted applications to run under policy. Organizations can allow, block or provide controlled elevation for applications and commands.

IBM Verify Privilege Server Suite supports centralized management of access, authentication, privilege elevation and auditing policies for on-premises servers through Active Directory. Server administrators can therefore receive only the privileges required for their tasks, for the necessary duration and scope.

Fortinet PAM (FortiPAM)

FortiPAM is an enterprise PAM solution that combines privileged account management with secure remote access and session control, and can integrate with the Fortinet Security Fabric. It helps centralize privileged access management across both IT systems and operational technology environments.

FortiPAM brings account discovery, secure password and certificate storage, password rotation, session monitoring and recording, reporting, and policy-based access into a single platform. Connections can be established without revealing credentials to users, while authorized administrators can monitor active sessions and terminate suspicious activity.

Key capabilities

• AES-256 encryption for stored secrets
• Discovery and import of privileged and service accounts with policy-based password rotation
• Secure storage of passwords, SSH keys and certificates
• Connectivity options for RDP, SSH, VNC, web, SMB, SFTP and other management protocols
• Monitoring of sessions, keystrokes and user actions, with video recording and playback
• SSH command filtering and Windows application filtering controls
• SAML, RADIUS, LDAP and Active Directory integrations, with MFA and SSO support
• Device posture checks and ZTNA integration through FortiClient EMS
• Integrated security workflows with FortiToken, FortiAuthenticator and FortiSandbox
• Clientless access options for restricting OT and third-party connections
• High availability, disaster recovery, detailed reporting and audit trails

For organizations already using Fortinet infrastructure, FortiPAM supports a more integrated privileged access model spanning networking, endpoints, authentication and security operations.

Delinea (Thycotic) Privileged Identity Management - Delinea PAM

Delinea PAM brings the enterprise PAM capabilities of the former Thycotic portfolio to modern hybrid, cloud and on-premises environments. Delinea Secret Server, one of its core components, provides a centralized platform for discovering privileged accounts, protecting passwords and other secrets, managing access and auditing sessions.

Secret Server consolidates privileged credentials for human, machine, application and service identities under a single management point. Automated password generation and rotation, check-in/check-out, role-based access and approval workflows reduce errors and security risks caused by manual processes.

Key capabilities

• Automatic discovery and inventory of privileged accounts across the network
• Encrypted vault protection for passwords, keys and other secrets
• Automated password generation, change, expiration and rotation processes
• Check-in/check-out, role-based access and multi-stage approval workflows
• Secure connection launch without exposing passwords to users
• Privileged session monitoring, recording and detailed audit trails
• Reporting, automation and integration options for security tools
• Cloud and on-premises deployment alternatives
• Vaulted credential access designed to support resilience and business continuity

Delinea (Thycotic) Privilege Manager

Delinea Privilege Manager provides privilege management and application control for Windows and macOS endpoints. It enables organizations to grant the required privileges only to trusted applications and activities, based on policy, without giving users permanent local administrator rights.

The solution discovers applications and administrator rights, removes local administrator privileges, and classifies applications as allowed, blocked or restricted. When required, controlled elevation can incorporate user justification, administrator approval, MFA and Just-in-Time access steps.

Key capabilities

• Windows and macOS account and application discovery
• Support for endpoints that are not joined to a domain
• Removal of local administrator rights and management of local group membership
• Dynamic allow, block, restrict and sandbox policies
• Application-level privilege elevation and child-process control
• Workflows based on user justification and administrator approval
• Just-in-Time access and MFA for application elevation
• Centralized event logging, dashboards and scheduled reports
• Integrations with Active Directory, ServiceNow, Secret Server and SIEM platforms

Delinea (Thycotic) Connection Manager

Delinea Connection Manager is a remote connection management solution for launching, managing and monitoring RDP and SSH sessions from a single interface. It gives operations teams that manage large numbers of servers, customer environments or concurrent connections a centralized and efficient workspace.

When integrated with Secret Server, required credentials are retrieved from the vault and automatically injected into the session. Users do not need to search for, copy or view passwords. Session records and audit trails support both operational visibility and compliance activities.

Key capabilities

• Management of RDP and SSH connections from a single interface
• Fast switching between multiple active sessions
• Automatic credential injection into sessions
• Cloud or on-premises integration with Secret Server
• Monitoring and recording of concurrent remote sessions
• End-to-end session records for audit and compliance

Delinea Server Suite

Delinea Server Suite centrally manages user identities and privilege policies across Linux, UNIX and Windows servers. Through Active Directory integration, it helps reduce identity silos and unnecessary local accounts across heterogeneous server platforms.

Using Just-in-Time and Just-Enough Privilege, administrators receive only the permissions needed for their tasks. Role-based access, patented Zone technology, MFA at login and elevation, advanced session recording and reporting support consistent server-access governance.

Key capabilities

• Unification of Linux, UNIX and Windows identities under Active Directory
• Centralized management of privileged user and service accounts
• Role-based, granular and time-bound access policies
• Implementation of Just-in-Time and Just-Enough Privilege
• Adaptive MFA at login and during privilege elevation
• Management of local accounts, groups, authentication and Group Policy
• Advanced on-server session recording, auditing and reporting
• Support for Zero Trust and zero-standing-privilege objectives

Which PAM Solution Fits Which Requirement?

• To secure shared domain administrator, root and service-account passwords: IBM Verify Privilege Vault, FortiPAM or Delinea Secret Server
• For secure remote access integrated with Fortinet Security Fabric and OT environments: FortiPAM
• To remove local administrator rights from endpoints and grant privileges per application: Delinea Privilege Manager or IBM Verify Privilege Manager
• To manage large numbers of RDP and SSH sessions from a single interface: Delinea Connection Manager
• To apply centralized identity and privilege policies across Linux, UNIX and Windows servers: Delinea Server Suite or IBM Verify Privilege Server Suite
• For comprehensive password vaulting, rotation and session auditing across cloud and on-premises environments: Delinea Secret Server or IBM Verify Privilege Vault

The right product selection should consider the existing identity infrastructure, the number of accounts and systems to be managed, access protocols, high-availability requirements, third-party connections, compliance expectations and the operations team's working model.

BBS Privileged Access Management Services

BBS does not treat PAM projects as product installations alone. By addressing the people, process and technology dimensions of privileged access together, BBS adapts the solution to the organization's security policies and day-to-day operations.

Discovery and Current-State Assessment

• Identify privileged user, service, application and local administrator accounts
• Detect shared, standing, orphaned or non-rotating accounts
• Assess current access, password-sharing, remote-connection and approval processes
• Classify critical systems, use cases and priorities

Architecture Design and Product Positioning

• Select the IBM, Fortinet or Delinea components best suited to the organization
• Design an on-premises, cloud or hybrid PAM architecture
• Plan high availability, disaster recovery, network segmentation and capacity
• Conduct proof-of-concept, pilot and technical validation activities

Installation, Configuration and Integration

• Install and securely configure the PAM platform
• Integrate Active Directory, LDAP, SAML, RADIUS, MFA and SSO
• Integrate SIEM, ITSM, SOC, directory services and security products
• Onboard servers, network devices, databases, applications, endpoints and service accounts
• Configure password changers, connection launchers and custom workflows

Policy and Workflow Design

• Define role-based access policies aligned with least privilege
• Implement Just-in-Time and Just-Enough Privilege processes
• Design workflows for access requests, justification, approval, time limits and emergency access
• Define password complexity, rotation, check-in/check-out and post-use change policies
• Restrict third-party and vendor access

Migration, Go-Live and Knowledge Transfer

• Migrate in a controlled manner from existing password vaults or PAM products
• Develop a phased account and system onboarding plan
• Provide testing, user acceptance and go-live support
• Deliver technical training and documentation for administrators and operations teams

Maintenance, Support and Managed Services

• Perform version, patch, health and capacity checks
• Resolve policy, integration and password-rotation issues
• Monitor PAM events and link them to SOC processes where required
• Provide periodic improvement, reporting and onboarding of new systems
• Offer 5x8 or 24x7 maintenance and support models based on organizational needs