Gartner defines access management (AM) as tools that include authentication, authorization, single sign-on (SSO) and adaptive access capabilities for modern standards-based web applications, classic web applications and APIs. AM’s purpose is to give people (employees, consumers and other users) and machines access to protected applications in a streamlined and consistent way that enhances the user experience. For people, SSO is part of the enhanced experience. AM is also responsible for providing security controls to protect the user session during runtime. It enforces authentication and runtime authorization using adaptive access. Lastly, AM can provide identity context for other cybersecurity tools and reliant applications to enable identity-first security.
Gartner defines privileged access management (PAM) as tools that provide an elevated level of technical access through the management and protection of accounts, credentials and commands, which are used to administer or configure systems and applications. PAM tools — available as software, SaaS or hardware appliances — manage privileged access for both people (system administrators and others) and machines (systems or applications). Gartner defines five distinct tool categories for PAM tools: privileged account and session management (PASM), privilege elevation and delegation management (PEDM), secrets management, cloud infrastructure entitlement management (CIEM) and remote PAM (RPAM). Privileged access is access beyond the normal level granted to both human and machine accounts. It allows users to override existing access controls, change security configurations, or make changes affecting multiple users or systems. As privileged access can create, modify and delete IT infrastructure, along with company data contained in that infrastructure, it presents catastrophic risk. Managing privileged access is thus a critical security function for every organization and requires a specific set of procedures and tools. PAM tools focus on either privileged accounts or privileged commands.