# PAM & MFA Solutions

**URL:** https://securesys.com.tr/en/services/pam-mfa-solutions

### Bring the Keys to Your Critical Systems Under Control

Domain Administrator, root, database administrator, network administrator and service accounts are an organization's most powerful user accounts.

The compromise of one of these accounts can allow an attacker to;

- Reach servers,
- Change security policy,
- View databases,
- Create user accounts,
- Manage critical systems,
- Disable security tools,
- Carry out lateral movement inside the organization

and similar actions.

Privileged accounts therefore need protecting with security policy different from that of normal user accounts.

**PAM – Privileged Access Management** is the identity security technology providing the central management, control, monitoring and logging of the privileged access carried out to critical systems.

Within SecureSys PAM & MFA Solutions we centralize organizations' privileged access security with the **senhasegura PAM and Keycyte PAM** technologies.

### What Is PAM?

PAM is the security approach ensuring the secure use of the highly privileged accounts inside an organization.

The core logic is this:

**User → PAM → Authorization → Critical System**

Rather than the user knowing the administrator password of the critical system directly, access is carried out through PAM.

It thereby becomes possible to answer the questions;

**Who accessed it? What did they reach? When did they access it? For how long? Which operations did they carry out? Who approved the access?**

these questions.

### What Is a Privileged Account?

A privileged account is an account holding higher privileges than a standard user.

For example;

**Active Directory**

- Domain Admin
- Enterprise Admin

**Windows**

- Administrator

**Linux**

- root

**Database**

- SYS
- SYSDBA
- sa
- postgres

**Network**

- Firewall Admin
- Switch Admin
- Router Admin

can be assessed within this scope.

The **service account** credentials used by applications are also an important part of privileged credential security.

### Password Vault

One of PAM's core components is **Password Vault** technology.

The administrator passwords belonging to critical systems are held in a secure vault.

A connection to the system concerned can be established through PAM without the user needing to know the real password.

**Administrator ↓ PAM Authentication ↓ Password Vault ↓ Target Server**

This approach considerably reduces the circulation of shared administrator passwords among users.

### Password Rotation

Administrator passwords going unchanged for a long time creates a serious security risk.

PAM systems can change privileged credentials automatically in line with defined policy.

For example, the;

**User gained access → Session completed → Password Rotation → The old password is no longer valid**

model can be applied.

### Privileged Session Management

PAM is not merely a password vault.

Administrator connections to critical systems can be passed through PAM so sessions are managed centrally.

For example, the;

**Admin → PAM → RDP → Windows Server**

or;

**Admin → PAM → SSH → Linux Server**

architecture can be used.

### Session Recording

The sessions privileged users carry out on critical systems can be recorded.

This capability is important particularly for;

- Incident investigation
- Internal audit
- Supplier access
- Privilege abuse
- Regulation
- Forensic examination

these purposes.

After a security incident, rather than holding only the;

**"The administrator connected to the system."**

information, being able to examine the activity the administrator carried out within the session forms a far stronger audit trail.

### Keystroke Logging

Depending on product capabilities and organizational policy, the commands and keyboard activity carried out during a privileged session can be recorded.

This capability can make incident investigation easier particularly in SSH and command-line management sessions.

### Just-in-Time – JIT Access

In traditional estates users may hold administrator privilege permanently.

This situation creates **Standing Privilege**.

In the modern PAM approach, by contrast, privileged rights can be granted only when needed and for a defined period.

**Standard Privilege → Access Request → Approval → 60 Minutes of Admin Privilege → End of Period → Privilege Removed**

This approach is called **Just-in-Time Access**.

### Least Privilege

One of PAM's core principles is the **Least Privilege** approach.

The aim is to grant the user access;

**at the minimum privilege they need + for as long as they need it**

on this basis.

The privilege scope an attacker could use through a compromised user account is thereby reduced.

### Privilege Elevation

Rather than some users being administrators permanently, temporary privilege elevation can be applied for the particular operations they need.

This approach is important particularly for;

- System administrators
- Help Desk
- DevOps
- Database teams
- Network teams

these groups.

### Approval Workflow

Access to critical systems can be tied to approval.

For example, a workflow can be built in the form of;

**DBA → requests Production Database access ↓ Manager / Security approval ↓ 2 hours of access ↓ Session Recording ↓ Automatic termination of access**

this sequence.

### Vendor Access Management

The access of external service providers to critical systems is one of PAM's most important use cases.

Rather than giving the supplier VPN + an administrator password directly, the;

**Vendor → MFA → PAM → Approval → Authorized Server Only → Session Recording**

model can be applied.

Third-party access can thereby be both restricted and audited.

### PAM and MFA

PAM and MFA are technologies complementing one another.

PAM provides the **authorization and auditing** of critical access, while MFA provides stronger verification of the identity of the user carrying out that access.

The ideal structure is:

**User ↓ MFA ↓ PAM ↓ Approval ↓ Privileged Session ↓ Critical System**

this sequence.

### What Is MFA?

**Multi-Factor Authentication** provides for more than one verification factor to be used in verifying a user's identity.

These factors are generally classified as;

**Something you know:** Password / PIN

**Something you have:** Phone / Token / Security Key

**Something you are:** Biometric verification

these categories.

### Why Is MFA Important?

An attacker can seize a user's password through phishing or credential theft.

On a system using a password alone;

**Password Stolen → Access Granted**

can happen.

When MFA is used, by contrast;

**Password Stolen → Second Factor Required → Access Denied**

an additional security layer of this kind forms.

### OTP

A One-Time Password is a single-use verification code valid for a defined period.

In MFA systems it can be applied through methods such as;

- TOTP
- Mobile application
- Hardware token

and similar mechanisms.

### Push Authentication

The user can be asked to approve the access request through a notification sent to their mobile device.

In push-based systems, however, **MFA Fatigue** attacks should be taken into account and stronger verification methods assessed.

### FIDO2 and Passwordless

In modern identity security, phishing-resistant authentication is becoming steadily more important.

FIDO2 and security key based methods can help build stronger authentication architectures by reducing dependence on the password.

### PAM + Active Directory

Integrating PAM with Active Directory allows privileged users to be related to the central identity infrastructure.

For example, the;

**AD User → PAM Role → Windows Administrator → A Particular Server Group**

mapping can be made.

**PAM + [SIEM](/en/services/siem-and-soar-security-service) \+ SOC**

The;

- Login
- Failed Login
- Privileged Access
- Session Start
- Session End
- Password Access
- Policy Violation
- Vendor Access

events produced by PAM can be carried into the SIEM system.

The SOC can thereby analyze the;

**PAM + AD + EDR + Firewall + VPN**

data together.

### PAM + DAM

In database administrator access, PAM and [DAM](/en/services/dam-database-activity-monitoring) together form a strong security layer.

**DBA → PAM → Database → DAM**

PAM controls **who can reach the database**.

DAM, in turn, monitors **what they do inside the database**.

Using the two technologies together therefore forms a strong security architecture particularly on critical database systems.

### PAM + Zero Trust

In the Zero Trust approach a user is not trusted merely for being inside the organization.

During privileged access, the;

**Identity + MFA + Device + Approval + Time + Target System**

context can be assessed together.

PAM is therefore one of the important identity security components of modern Zero Trust architectures.

### senhasegura PAM

#### Enterprise Privileged Access Management

senhasegura is a comprehensive PAM platform for protecting critical accounts and privileged access centrally.

In SecureSys's current product positioning the platform's core capabilities also appear as **Password Vault, Session Monitoring, Session Recording, Privilege Elevation, Vendor Access Management and Compliance Reporting**.

#### Password Vault

Privileged credentials are managed in a central secure vault so the direct sharing of administrator passwords among users can be reduced.

#### Session Monitoring & Recording

The privileged sessions carried out to critical systems can be monitored and recorded.

This structure is important particularly in auditing;

**RDP + SSH + Database + Critical System Management**

these sessions.

#### Privilege Elevation

Rather than granting users permanent administrator privilege, controlled privilege elevation can be applied when needed.

Standing privilege risk can thereby be reduced.

#### Vendor Access Management

The access of suppliers and third-party users to critical systems can be managed through PAM policy.

External support teams in particular are prevented from holding administrator credentials directly, so access can be centralized.

#### Compliance Reporting

Logging privileged access activity can support the technical evidence needs of different security and compliance processes such as;

- [ISO/IEC 27001](/en/services/iso-27001-isms-consulting-service)
- KVKK
- PCI DSS
- SOX
- Internal audit

and similar frameworks.

#### Who Is senhasegura Suitable For?

It can be assessed as a strong PAM alternative particularly in large-scale estates holding;

**Enterprise + Finance + Telecom + Public Sector + Critical Infrastructure + a large number of privileged accounts + Vendor Access**

these requirements.

### Keycyte PAM

#### Turkish-Made Privileged Access Management

**Keycyte** is the Turkish-made PAM solution providing the central management of the privileged access operations carried out to critical systems.

In the Türkiye Cyber Security Cluster catalogue, Keycyte also appears in the **Privileged Access Management (PAM)** category.

Keycyte offers capabilities for monitoring, adjusting and restricting all user privileges through a central interface.

#### HTML5 Web Proxy

One of Keycyte's important characteristics is that connections to critical systems can be carried out through an HTML5-based web proxy.

Rather than users connecting to the target system directly, access can thereby be centralized through PAM.

SecureSys's current product information states that Keycyte can manage;

**RDP SSH MySQL PostgreSQL**

access through the HTML5 web proxy.

#### Session Recording

The sessions privileged users carry out on critical systems can be recorded.

Security teams can thereby examine administrator activity after an incident.

#### Keystroke Logging

Keycyte offers a keystroke logging capability for recording the keyboard activity carried out during a privileged session.

This capability is important particularly in auditing;

**SSH + Linux + Network + Database**

management sessions.

#### Central Privilege Management

Users' privileged access rights can be centrally;

**Monitored → Adjusted → Restricted**

and the consistent application of security policy ensured.

#### Need-Based Access

Granting users privileged access only for the period and scope they need helps reduce unnecessary permanent administrator access. Need-based access and access request/approval processes are also brought to the fore in the vendor's own product descriptions of Keycyte.

#### Who Is Keycyte Suitable For?

It can be assessed particularly for;

- Organizations wanting a Turkish-made PAM
- Public sector
- Defence industry
- Critical infrastructure
- Organizations wanting to manage RDP/SSH access centrally
- Estates wanting to audit database administrator access
- Organizations needing local support

these estates.

### senhasegura or Keycyte?

Rather than positioning the two products directly as "which is better?", assessing them according to project requirements is more accurate.

#### senhasegura

**A broad Enterprise PAM ecosystem + Password Vault + Session Management + Privilege Elevation + Vendor Access + broad privileged identity management**

stands out in projects requiring these capabilities.

#### Keycyte

**Turkish-made PAM + RDP/SSH/Database access + HTML5 Proxy + Session Recording + Keystroke Logging + central privilege management**

forms a strong domestic alternative in projects requiring these capabilities.

### The SecureSys PAM Project Process

A PAM project is not merely a password vault deployment.

In the SecureSys approach the process;

**Privileged Account Discovery → Critical System Inventory → Privilege Analysis → PAM Product Selection → POC → AD/LDAP Integration → MFA → Password Vault → RDP/SSH/Database Integration → Session Recording → Approval Workflow → Vendor Access → SIEM/SOC Integration → Operations & Reporting**

can be addressed in this way.

### Do Not Share the Administrator Password — Manage the Access

Managing privileged credentials in Excel files, documents or as passwords shared between teams is not compatible with a modern security approach.

The aim is not merely to store the password;

**Who can access it? When can they access it? What can they reach? Who approved it? What did they do? Was the session recorded?**

it is to be able to answer these questions.

**With SecureSys PAM & MFA Solutions, protect your critical accounts centrally, bring privileged access under control and make administrator activity auditable end to end.**

**Request a demo, POC and quote for senhasegura and Keycyte PAM**