Thycotic Privilege Manager

Short Summary

Digital transformation is expanding organizations’ attack surfaces through initiatives like digital workplaces, DevOps, security automation, and IoT, creating new risks that must be managed without disrupting business operations. Privileged Access Management (PAM) is positioned as a critical set of cybersecurity controls to reduce risks tied to privileged access, which spans two main groups: privileged business users with access to sensitive information assets, and privileged IT users who administer infrastructure through powerful system and operational accounts. Because privileged accounts often have unrestricted, insufficiently monitored access, they can violate least-privilege principles and weaken accountability, making their identification and control essential.

Traditional IAM tools primarily address standard user access and typically lack capabilities needed for privileged scenarios such as shared account control, privileged activity monitoring, and controlled elevation. Modern PAM suites therefore include credential vaulting, password rotation, privilege elevation and delegation, session monitoring, and increasingly analytics and risk-based monitoring. Key drivers for privilege management include shared credential abuse, insider misuse of elevated rights, credential hijacking, third-party privilege abuse, and accidental misuse.

Endpoint Privilege Management (EPM) is presented as a strong “second-line” defense for endpoints—common entry points for malware and advanced threats—by limiting local admin rights and constraining application execution. EPM is defined through application control (whitelisting), sandboxing/application isolation, and privilege management for users and applications. The analysis focuses on Thycotic Privilege Manager, an EPM product added via the Arellia acquisition, supporting Windows and Mac, using an agent/server model to enforce centrally managed least privilege across domain and non-domain endpoints. It provides account and application discovery, policy definition and enforcement, controlled elevation, contextual controls, reporting, integrations (including Secret Server, ServiceNow, SIEM, threat intel, Cylance), and mobile approvals; challenges include missing post-elevation integrity checks and no sandboxing.

Interesting Facts

• Privileged users are categorized into privileged business users and privileged IT users.
• Privileged access is often unrestricted and unmonitored, which undermines least privilege and limits accountability for privileged activities.
• Traditional IAM tools are designed for standard user access and typically do not manage shared accounts, privileged activity monitoring, or controlled elevation effectively.
• Key PAM capabilities include credential vaulting, password rotation, privilege elevation/delegation, session establishment, and activity monitoring.
• Advanced PAM capabilities increasingly include privileged user analytics, risk-based session monitoring, and advanced threat protection within integrated suites.
• Endpoint Privilege Management comprises application control, sandboxing/application isolation, and privilege management.
• Endpoints such as desktops and laptops are described as the most vulnerable part of an organization’s attack surface and common entry points for malware and spyware.
• Endpoint protection platforms rely heavily on signature databases and can be ineffective against altered or obfuscated signatures.
• Thycotic Privilege Manager supports Windows and Mac endpoints and uses an agent/server architecture that is independent of local GPO dependency.
• Thycotic Privilege Manager lacks post privilege elevation integrity checks and does not provide application sandboxing, while supporting grey-listed execution with restricted privileges.

Notable Quotes

• “To remain relevant, organizations must reinvent themselves by being agile and more innovative.”
• “Emerging technology initiatives such as digital workplace, DevOps, security automation and the Internet of Things continue to expand the attack surface of organizations as well as introduce new digital risks.”
• “Privileged accounts pose significant threat to the overall security posture of an organization because of their heightened level of access to sensitive data and critical operations.”
• “Privileged Access Management tools are designed to address these scenarios by offering specialized techniques and unique process controls, thereby significantly enhancing the protection of an organization’s digital assets by preventing misuse of privileged access.”
• “Endpoint privilege management’ or EPM are fast becoming strong and effective second-in-line defense mechanisms for endpoint threat protection and advanced threat mitigation.”
• “Endpoint systems such as desktops and laptops are the most vulnerable part of an organization’s attack surface.”
• “Most advanced attacks target endpoint systems with elevated privileges or administrative rights for successful execution and propagation.”
• “Thycotic Privilege Manager eliminates dependency on local group policy objects (GPO) and supports both domain and non-domain managed endpoints.”
• “Request workflow management allows security teams and application owners to define policies for appropriate approval and delegation of ‘time and task-based’ privilege elevation requests.”
• “The cloud deployment model offers customers a highly scalable solution, able to support hundreds of thousands of endpoints in a single console.”