KEYS TO THE KINGDOM: A DEFENDER'S GUIDE TO PRIVILEGED ACCOUNT MONITORING

Summary from the TLDR InfoSec newsletter

Mandiant uses a three-pillar approach to privileged account monitoring (PAM). The prevention pillar focuses on identifying all identities that can change system state, alter security policy, or reach sensitive data and tiering them into a hierarchy of privileged access. The detection pillar focuses on distinguishing PAM-related detections from regular abuse. The response pillar focuses on ensuring that break-glass accounts work and customizing an incident response plan for privileged accounts.