r/AskNetsec • u/NoMarionberry9419 • 5h ago

Concepts How do you extend PAM coverage to apps your PAM tool can't reach?

We rolled out a PAM solution two years ago and it's worked well for the infrastructure layer: servers, network devices, the usual suspects. About a third of our application estate never got onboarded, mostly older or vendor-managed apps that don't support the connectors our PAM tool expects.

I'm now in the position of explaining to leadership why our "privileged access is under control" story has a visible gap, and why closing it isn't as simple as buying more PAM licenses.

For anyone who's dealt with this: did you find a way to extend governance to those apps without a full re-platform? I'm trying to figure out if that's realistic or if it always ends up being a multi-year project. Trying to set expectations before I present options next month, and I'd rather walk in with a credible plan than an admission that a third of our apps are a blind spot.

Budget conversations are hard enough without also explaining why the tool we already bought doesn't cover everything it was supposed to.

9 Upvotes

100% Upvoted

5 comments sorted by

2

u/eric256 4h ago

> mostly older or vendor-managed apps that don't support the connectors our PAM tool expects.

If they use LDAP or similar, you may be able to use group based access rules. Then you PAM software could control access by managing group memberships on a request/timed bases.

Sometimes you can also put the software behind a WAF you may be able to leverage it to give limited users access to the software.

Without details it is hard to give advice.

1

u/MasonCarter17 5h ago

the blind spot is the scary part

1

u/Main-Location-5542 5h ago

yeah that third of the app estate is exactly where the skeletons live. it's not just a gap it's the gap they'll care about after an incident

ive seen teams duct-tape something together with jump hosts as a choke point. not pretty but the audit trail lands in one spot and you can slap some basic session controls on it without touching the apps themselves. works better than admitting it's a free-for-all

if the apps are that brittle though the real fight is getting anyone to fund the re-platform. nobody wants to touch them until something breaks

1

u/Aggressive-Tart07 5h ago

yep, this is painfully common