Least Privilege
Privileged Access Management literacy — vault, session recording, JIT admin, break-glass — PAM checklist on YOUR $ZT_LAB identity folder.
Visual · t40_pam_literacy
PAM literacy. $ZT_LAB. Original Cyberlium.
Admin is the crown jewel — PAM separates standard IdP login from privileged session workflow on LAB-ZT-001 design stubs.
PAM components: credential vault, rotation, session proxy/recording, approval workflow, break-glass with audit. Vendors (CyberArk, Delinea, BeyondTrust literacy) — architecture concept matters more than product pick in lab. Document PAM checklist: vault coverage % target, JIT admin flow, break-glass procedure stub — fictional. Refused: extracting real vault passwords in lab. Next: Identity Lab.
1. PAM capabilities (named)
Vault: store admin credentials, check out with ticket. Session: record privileged RDP/SSH/SQL. Rotation: automatic password change. JIT: time-bound group membership.
Break-glass: emergency account with extra logging + post-incident review.
Command guide
Try these commands — PAM capabilities (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Identity (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Coverage metrics literacy
Target: 100% privileged accounts in vault (fictional KPI). Orphan admin detection quarterly. Session recording retention aligned to policy.
Link to roadmap module KPI rows.
3. LAB-ZT-001 PAM stub
Five fictional admin systems: domain controller stub, cloud root, db admin, network gear, CI/CD deploy — vault coverage table.
Ship: PAM checklist with break-glass row. Next: Identity Lab.
4. What you ship: PAM literacy checklist
Vault coverage table + JIT flow + break-glass stub. Fictional systems. chmod 600.
5. What you record before the next lesson
Date. PAM checklist. $ZT_LAB named. File t40-m03-l03-pam-literacy.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Store real admin passwords in lab markdown. Skip session recording because vault exists.
- Right: Write PAM checklist with break-glass procedure stub. Next: Identity Lab.
Mission: PAM literacy checklist
1) List five fictional privileged systems. 2) Vault coverage target row per system. 3) Break-glass procedure stub. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Break-glass without post-review equals permanent backdoor culture.
APPLY: PAM primarily protects:
APPLY: True or False: Break-glass accounts need extra audit review.
APPLY: Real vault passwords in lab notes: