- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Every major breach has one thing in common: the attacker eventually gains privileged access. Whether through a phishing email that steals an admin credential, a misconfigured service account with excessive rights, or a lateral movement chain that ends at a domain controller — privileged identities are the ultimate target. For Indian enterprises navigating a maturing threat landscape and tightening regulatory environment under the DPDP Act and CERT-In directives, Privileged Access Management (PAM) is no longer optional infrastructure. It is the security control that determines whether a breach stays contained or becomes a crisis.
Privileged accounts — domain administrators, database root users, cloud IAM super-users, network device management accounts, application service accounts — represent a tiny fraction of total users but an enormous fraction of total risk. A successful compromise of a single privileged credential can give an attacker:
The 2023 MOVEit exploitation chain is a sobering example: attackers targeted transfer service accounts with elevated file-system permissions, exfiltrating data from hundreds of organisations worldwide before patches could be applied. Closer to home, Indian financial services firms have reported credential-based intrusions that began with compromised service accounts in IT infrastructure — accounts that had never been rotated, had no session recording, and whose usage triggered no alerts because baseline behaviour had never been defined.
Across PJ Networks’ managed security engagements, our teams see a consistent pattern. Indian enterprises — from mid-market manufacturing firms to large-cap financial institutions — typically have three PAM blind spots.
Most organisations undercount privileged accounts by a factor of three to five times. The accounts they know about — Active Directory admin groups, named network admins — are a fraction of the total. Forgotten service accounts created for a now-decommissioned application, shared credentials stored in spreadsheets for network device access, cloud API keys with owner-level permissions that were “temporary” two years ago — these are the accounts attackers find first, because they are the accounts that defenders forgot.
Knowing an admin logged in is not enough. PAM requires knowing what that admin did — which systems they touched, what commands they ran, which files they accessed. Without session recording and command logging for privileged sessions, a compromised admin credential produces activity that is indistinguishable from legitimate administrative work until significant damage has occurred. CERT-In’s 2022 direction requiring organisations to maintain logs for at least 180 days implicitly demands this level of granularity for high-privilege activity.
The “always-on” admin model — where administrators hold domain admin or root-level rights as their permanent, day-to-day identity — dramatically increases the attack surface. A developer with a persistent local admin account who clicks a phishing link represents a very different risk profile than the same developer operating under a standard account who must request and justify elevated access for specific tasks. The principle of least privilege is well understood; operationalising it through just-in-time (JIT) access provisioning is where most Indian enterprises have not yet made the investment.
A production-grade PAM programme for an Indian enterprise with a hybrid estate — on-premises data centre, Microsoft Azure or AWS cloud tenancy, branch offices, operational technology systems — typically spans six control domains.
Automated, continuous discovery of all privileged accounts across Active Directory, LDAP, local accounts on servers and endpoints, cloud IAM, network devices, databases, and SaaS platforms. This is not a one-time audit — new accounts are created constantly, and the inventory must be live. Discovery should surface service accounts, shared accounts, application accounts, and local administrator accounts that bypass centralised identity management.
All privileged credentials — passwords, SSH keys, API tokens, certificates — should be stored in an encrypted vault with access controlled by policy. Credentials for non-interactive service accounts should be rotated automatically on a schedule or after each use. Interactive admin passwords should be checked out for a session and rotated afterwards. No credential should be readable by a human in plaintext without generating an auditable access event.
Eliminate standing privilege for interactive human administrators. When an admin needs elevated access, they request it — specifying the system, the task, and the duration. The request goes through an approval workflow. Access is granted, the session is recorded, and the privilege is revoked when the session ends. This reduces the window in which a compromised credential can be used from “indefinitely” to the duration of one approved session.
All privileged sessions — RDP, SSH, web-based admin consoles, database tools — should be proxied through the PAM platform. Commands are logged. Screens are recorded. Anomalous activity — a session that runs database export commands at 2 AM when the user has never done so before — should generate an alert to the SOC in near-real-time, not be discovered in a post-breach log review.
Privileged account abuse by a compromised external attacker and by a malicious insider look different from normal administrative behaviour, but only if you have defined what normal looks like. PAM platforms with integrated user and entity behaviour analytics build per-account baselines — typical login hours, typical source IPs, typical target systems — and flag deviations. For Indian enterprises managing multiple sites and shift-based operations, accurate baselines that account for geography and schedule are essential to reduce false positives.
Every access request, approval, credential checkout, session event, and policy change must produce an immutable audit record. For DPDP Act compliance, organisations processing personal data need to evidence that access to systems containing that data was authorised, recorded, and reviewed. PAM audit trails, combined with SIEM log retention, close this requirement effectively.
PAM does not operate in isolation. The most effective deployments we manage integrate the PAM platform with network access control and FortiGate firewall policy enforcement. When a privileged session is opened for a specific task — say, a network engineer accessing a FortiGate firewall via SSH to apply a routing change — the PAM platform can dynamically update a FortiGate policy to permit that specific source IP to reach that specific management interface for the duration of the session. When the session closes, the access rule is revoked.
This dynamic network segmentation approach means that even if an attacker compromises the engineer’s workstation, the workstation does not have standing network access to management interfaces. The firewall policy only opens during an active, authenticated, recorded PAM session. This closes a class of attack that perimeter firewalls alone cannot address — the attacker operating from a legitimate, internally-connected workstation with persistent network reach to management planes.
Our FortiGate-managed environments at PJ Networks operationalise this pattern with automated policy push from the PAM workflow engine to FortiGate via API. Session open → firewall rule created. Session close → firewall rule removed. The SOC monitors both the PAM session stream and the FortiGate policy change log simultaneously, giving analysts a correlated view across network and identity planes.
Privileged access management generates a rich stream of security-relevant data — credential checkouts, session start and stop events, command logs, anomaly alerts, policy changes. That data is most powerful when correlated with the broader security picture: network events from FortiGate, endpoint telemetry, authentication logs, and cloud audit trails. This is where PrahiX Ora, a unified SecOps platform built by PrahiX Tech Pvt Ltd, becomes a force multiplier for PAM programmes. PJ Networks is PrahiX Ora’s primary field deployment and operations partner, and we deploy and operate the platform for clients across manufacturing, financial services, and multi-site enterprise estates.
The customer problem is correlation at scale. A PAM alert saying “unusual command sequence in privileged session” is actionable — but it becomes far more actionable when the SOC analyst can simultaneously see that the source workstation made DNS queries to a known command-and-control domain ten minutes earlier, that the same user account attempted three failed logins to a cloud console, and that a FortiGate NGFW blocked an outbound connection from that workstation to a threat-intelligence-flagged IP. Ora’s SIEM pillar ingests these multi-source log and event streams, applies MITRE ATT&CK-mapped correlation rules, and reconstructs the attack storyline as a graph — making the analyst’s job one of decision, not detective work. CERT-In’s direction on 180-day in-country log retention is satisfied by Ora’s tiered hot/cold/archive retention architecture, which keeps recent events instantly queryable and older events cost-effectively archived in-country, meeting the data localisation expectation.
The NMS pillar provides the network visibility layer that PAM correlation depends on. When a privileged session touches a FortiGate, a switch, or a WAN appliance, Ora’s unified observability — spanning firewalls, switches, wireless access points, and SD-WAN links with LLDP and CDP topology discovery — shows the NOC the exact network path that session traversed. ML-based anomaly detection flags when management traffic appears on interfaces or paths where it has never appeared before, and auto-healing policies can isolate a device pending SOC review. For multi-vendor environments where NOC visibility is fragmented across separate element management systems, this unified observability view is often the first time the operations team has seen their estate as a single coherent topology.
For clients with physical sites — retail chains, manufacturing plants, warehouses, multi-branch office networks — Ora’s video surveillance (VMS) pillar extends security operations into the physical domain. ONVIF, Hikvision, and Dahua camera feeds are managed alongside network and security telemetry, with video analytics detecting physical access anomalies. A privileged remote session to a server room system correlated with an unexpected physical access event at that server room — surfaced in a single unified operations view — gives the SOC a picture that siloed tools cannot provide. For manufacturing and retail clients managing both IT and OT environments, this convergence of physical and logical security under one operations umbrella is a significant operational uplift.
The SOAR pillar is what makes PAM-driven response realistic against tight regulatory timelines. CERT-In’s 6-hour incident reporting window means that when a privileged account compromise is detected, the response — isolating the account, revoking active sessions, pushing updated blocklists to FortiGate, notifying the CISO and legal team, and drafting the initial CERT-In notification — must happen in minutes, not hours. Ora’s pre-built playbook connectors automate the mechanical steps: a confirmed credential compromise triggers automatic session termination in the PAM platform, an API call to FortiGate to block the source IP, a ticket in the ITSM system, and a templated CERT-In report pre-populated with incident timestamps and affected system details. What remains for the human analyst is judgement, not process execution — and that is the difference between meeting the 6-hour reporting window and missing it.
To understand how PrahiX Ora fits into a broader SecOps architecture, platform capabilities are documented at ora.prahix.com.
For an Indian enterprise beginning or maturing its PAM programme, the pragmatic sequencing is as follows.
India’s Digital Personal Data Protection Act places explicit obligations on data fiduciaries around access control to systems processing personal data. Demonstrating that access to production databases, CRM systems, and customer data repositories is governed by a PAM programme — with documented access requests, approvals, session records, and regular recertification — is core evidence for demonstrating compliance readiness. A robust PAM programme supports compliance with the DPDP Act’s security safeguard obligations without overstating what any single control can achieve.
CERT-In’s 2022 directions are equally relevant. The requirement to log and retain records of privileged access to production systems, to report incidents within six hours, and to maintain logs in-country for 180 days maps directly to PAM capabilities: session logs, credential checkout audit trails, and anomaly alerts all feed the incident reporting requirement. Organisations that invest in PAM are investing in the operational infrastructure that makes regulatory compliance realistic rather than aspirational.
PJ Networks designs, deploys, and manages PAM programmes for Indian enterprises as part of our broader managed security practice. Our engagements typically combine:
Privileged access is where breaches either stop or become catastrophes. If your organisation has not conducted a formal PAM assessment in the last 12 months, or if your privileged account inventory has not been reviewed since your last major infrastructure change, now is the right time to start that conversation — before an attacker starts it for you.
To discuss your PAM requirements or request a privileged account discovery assessment, reach the PJ Networks security team through pjnetworks.com.