Privilege Access Management and its effect on enterprise GIS

Question

We are about to embark on a project to implement Privileged Access Management (PAM) in order to improve the control, reporting and audit capabilities related to administrator/privileged accounts. This will include service level accounts that are used to run background tasks on our servers. Has anyone had any experience with the use of a PAM in relation to their enterprise GIS System? What impact has the PAM had on python scripts or other scripts that you might run using a service level account? Would appreciate any feedback you might have.

Thanks,

Alison

RandallWilliams · Answer

In a future release, we'll be offering a headless token approach that should ease some of this challenge. That will allow for mandatory MFA for user accounts along with the ability to use "service accounts".   ArcGIS Enterprise now supports gMSA out of the box.

BryanGillis1 · Answer

I've recently been made aware that our new cyber security chief is going to be pushing PAM (via BeyondTrust) on all developer machines. I am a one stop GIS shop for an organization of about 15k. I utilize AGOL and enterprise depending on target audience/data sensitivity. I have only been able to keep pace with demands via near-constant automation of processes. I am concerned about the new cyber security methods impacting that automation. I was wondering if anyone in the community has had success navigating a PAM implementation while still pushing and pulling through a plethora of external and internal sources in an automated manner. Or am I just the next in line to hear the chorus of crickets? 😅

Thanks,

Gillis

KevHofmann · Answer

Our IT is considering a PAM solution as well.  Anyone have advice and/or using it successfully.

Thank you,

Kevin