What is the Secure Access Maturity Model?
The Secure Access Maturity Model (SAMM) is a step-by-step progression for becoming more mature with your infrastructure access. Each stage contains critical pieces of access security that build on each other to ultimately enable Dynamic Access Management (DAM) with the ability to easily manage access to your entire stack in a safe, auditable, and secure way.
Level 1
Identity-Based Access
Level 2
Privileged Access
Level 3
Just-in-Time Access
Level 4
Dynamic Access
Where are you in your access journey?
Identity-Based Access
Welcome to Basecamp!
Identity-Based Access is the first step in the journey toward Zero Trust and Dynamic Access Management. How do you know if you’ve achieved Identity-Based Access?
Access is defined at the user level, and provisioned based on the needs of the individual.
You Are Here
- You base access on identities, not networks.
- You provision access to systems based on the needs of the individual or employee level.
- You have an identity provider (IdP), SSO provider, and perhaps even MFA in place.
You Need to Be Here
- You need access that is ephemeral and only exists in the moments when needed.
- You need to extend secure access to all technical users.
- You need to extend secure access across your entire stack.
Shifting to a more dynamic access approach means your sensitive resources are better protected at scale.
Resources
- Evolving from Identity-Based Access to Dynamic Access Management (DAM)
- Complete Guide: Secure Access Maturity Model
- Annual Access Audit: What Is It and How to Conduct It?
- The Annual Access Audit Survival Guide
- Role & Access Discovery | Who Has Access to What Now?
- Roles and Access Discovery Workbook | StrongDM
- Access Management 101: Understanding Roles & Access
- Getting Started with Access Management Series | StrongDM
Choose Your Own Adventure: Skip-a-PAM
If your organization has achieved Level 1, but has not yet implemented a PAM solution, it’s possible to jump directly to Level 3 or 4.
Here's how
Skipping Level 2: It’s possible to avoid a privileged access approach entirely by making the upfront decision that all technical access is potentially privileged.
That means accounting for ALL employees and their access by default. Save time and spare your team from headaches! Skip to Just-in-Time Access!
Download ebook
Privileged Access
Privileged Access controls and monitors the activity of only privileged users.
You have implemented Privileged Access Management (PAM) which provides additional security for elevated credentials. It’s a start.
You Are Here
- You have additional security controls for privileged users.
- You may use functions like session recording, password rotation, and MFA.
- You may be able to audit user actions using recordings.
- You still have resources where shared credentials are still used.
You Need To Be Here
- You need access that is ephemeral and only exists in the moments when needed.
- You need to extend privilege-like security to ALL technical users.
- You need to extend secure access across your entire stack.
Why Privileged Access is not enough
Traditional PAM lacks critical functionalities for the modern environment. Many PAMs do not support all cloud resources, Kubernetes clusters, containers, and even certain databases. PAM's myopic focus on privileged users, and the gaps in the technologies they support, creates unnecessary risk in today’s environment.
Just-in-Time (JIT) Access
JIT Access reduces the risk of unauthorized access by ensuring that users only have access to the resources they need to do their jobs–and for the minimum necessary time.
You Are Here
- You provide Just-in-Time Access to technical users.
- You may have session tracking for privileged accounts.
- You eliminated most, but not all standing access.
- You adopted an IdP, MFA practices, and (possibly) legacy PAM.
You Need To Be Here
- Your inventory is limited to critical systems within the infrastructure.
- Your audit and compliance requirements are fully supported.
- You fully eliminated always-on accounts.
Don’t stop now. You’re so close to the top!
The ascent from JIT Access to Dynamic Access Management is critical.
- All users are considered privileged
- End users receive credential-less and JIT Access
- All users have auditable session tracking
Dynamic Access
Congratulations! You have arrived.
Dynamic Access Management extends secure authentication, authorization, and auditing capabilities to all technical users. DAM provides JIT access to all users who need access to databases, clouds, servers, clusters, and other resources.
Living the DAM Dream
- You consider all users privileged.
- Your credentials are never shared or even seen by end users.
- You have session tracking and review available for all sessions.
- You provision and deprovision access through Just-in-Time (JIT) and Zero Standing Privileges (ZSP) principles.
- You have processes to track, monitor, and update roles and resources consistently.
- Your new users and systems are easy to manage.
- You deprovision access to resources in an automated way.
- Your access is tied to corporate identity through IdP integration.
- You adopted MFA as standard practice.
