Zero › Module 3 › Lesson 3
Least Privilege
Privileged Access Management literacy — vault, session recording, JIT admin, break-glass — PAM checklist on YOUR $ZT_LAB identity folder.
Visual · t40_pam_literacy
PAM literacy. $ZT_LAB. Original Cyberlium.
Opening
Admin is the crown jewel — PAM separates standard IdP login from privileged session workflow on LAB-ZT-001 design stubs.
PAM components: credential vault, rotation, session proxy/recording, approval workflow, break-glass with audit. Vendors (CyberArk, Delinea, BeyondTrust literacy) — architecture concept matters more than product pick in lab. Document PAM checklist: vault coverage % target, JIT admin flow, break-glass procedure stub — fictional. Refused: extracting real vault passwords in lab. Next: Identity Lab.
1. PAM capabilities (named)
Vault: store admin credentials, check out with ticket. Session: record privileged RDP/SSH/SQL. Rotation: automatic password change. JIT: time-bound group membership.
Break-glass: emergency account with extra logging + post-incident review.
Command guide
Try these commands — PAM capabilities (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ZTMM Identity — https://www.cisa.gov/zero-trust-maturity-model NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_IDENTITY=${ZT_IDENTITY:-$ZT_LAB/LAB-ZT-001/identity}
cat > "$ZT_IDENTITY/pam-checklist.md" <<'EOF'
# PAM Literacy Checklist — LAB-ZT-001
| System | Vault? | Session record? | JIT? | Owner |
|--------|--------|-----------------|------|-------|
| Domain admin stub | Target | Yes | Yes | IT Sec |
| Cloud root stub | Target | Yes | Yes | Cloud Ops |
| DB admin stub | Target | Yes | Yes | DBA |
| Network gear stub | Partial | Planned | No | NetOps |
| CI/CD deploy stub | Target | Yes | Yes | Platform |
Break-glass: U-005 — 1hr max, post-incident review required
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'Break-glass|Vault|LAB SAMPLE' "$ZT_IDENTITY/pam-checklist.md"
python3 -c "print('PAM: vault + session + JIT — fictional systems only')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Identity (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Coverage metrics literacy
Target: 100% privileged accounts in vault (fictional KPI). Orphan admin detection quarterly. Session recording retention aligned to policy.
Link to roadmap module KPI rows.
3. LAB-ZT-001 PAM stub
Five fictional admin systems: domain controller stub, cloud root, db admin, network gear, CI/CD deploy — vault coverage table.
Ship: PAM checklist with break-glass row. Next: Identity Lab.
4. What you ship: PAM literacy checklist
Vault coverage table + JIT flow + break-glass stub. Fictional systems. chmod 600.
5. What you record before the next lesson
Date. PAM checklist. $ZT_LAB named. File t40-m03-l03-pam-literacy.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Store real admin passwords in lab markdown. Skip session recording because vault exists.
Right
Write PAM checklist with break-glass procedure stub. Next: Identity Lab.
Mission: PAM literacy checklist
1) List five fictional privileged systems. 2) Vault coverage target row per system. 3) Break-glass procedure stub. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Break-glass without post-review equals permanent backdoor culture.
Knowledge Check
APPLY: PAM primarily protects:
Multiple choice
Knowledge Check
APPLY: True or False: Break-glass accounts need extra audit review.
True or False
Knowledge Check
APPLY: Real vault passwords in lab notes:
Multiple choice