Gartner defines access management (AM) as tools that include authentication and single sign-on (SSO) capabilities, and that establish, manage and enforce runtime access controls for modern standards-based and classic web applications and APIs. AM’s purpose is to enable SSO access for people (employees, consumers and other users) and machines to protected applications in a streamlined and consistent way that enhances the user experience. AM is also responsible for providing security controls to protect the user session in runtime, enforcing authentication and authorization using adaptive access. Lastly, AM can provide identity context for other cybersecurity tools and reliant applications to enable identity-first security.
Gartner defines privileged access management (PAM) as tools that provide an elevated level of technical access through the management and protection of accounts, credentials and commands, which are used to administer or configure systems and applications. PAM tools — available as software, SaaS or hardware appliances — manage privileged access for both people (system administrators and others) and machines (systems or applications). Gartner defines five distinct tool categories for PAM tools: privileged account and session management (PASM), privilege elevation and delegation management (PEDM), secrets management, cloud infrastructure entitlement management (CIEM) and remote PAM (RPAM). Privileged access is access beyond the normal level granted to both human and machine accounts. It allows users to override existing access controls, change security configurations, or make changes affecting multiple users or systems. As privileged access can create, modify and delete IT infrastructure, along with company data contained in that infrastructure, it presents catastrophic risk. Managing privileged access is thus a critical security function for every organization and requires a specific set of procedures and tools. PAM tools focus on either privileged accounts or privileged commands.