Just-in-Time (JIT) Access
Granting elevated permissions only when needed, for a limited duration, and revoking them automatically. JIT eliminates standing privilege, the largest contributor to blast radius after compromise.
Just-in-time access is the most effective single change available to a privileged access program, because it converts a permanent target into a time-boxed one. It only works if the request path is fast enough that engineers use it rather than routing around it, which usually means approval automation and chat-based requests rather than a ticket queue. Measure standing privilege count as the outcome, not the number of requests processed.
See also: best just-in-time access tools, best PAM tools for DevOps, zero standing privileges, what is PAM, least privilege, PAM vendors
Related on Start with Identity
- GlossarySession Recording
Session recording is the capture of what happens inside a privileged session (terminal output, commands, screen and mouse activity, database queries) so that it
- GlossaryPrivileged Access Workstation (PAW)
A privileged access workstation (PAW) is a dedicated, hardened computer used only for administrative work, with no email, no general web browsing and only appro
- GlossaryPrivileged Remote Access (PRA)
Privileged remote access (PRA) is the brokering of administrative sessions to servers, network devices, databases and OT systems for remote employees, vendors a
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a
- BlogRemote access appliances are credential vaults, so patch day has to be rotation day
Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A p
- CVEBeyondTrust PRA and Remote Support unauthenticated command injection
Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM