The Secure Access Maturity Model (SAMM): Complete Guide

The Secure Access Maturity Model provides a logical progression for adopting and becoming more mature with your infrastructure access. Each stage contains critical pieces of access security that build on each other, to ultimately enable Dynamic Access Management (DAM) with the ability to easily manage access to your entire stack in a safe, auditable, and secure way.

Each of the four levels represents a significant benchmark in your access management journey (see image below).

The Secure Access Maturity Model is an additive approach to achieving Dynamic Access Management. That’s a fancy way of saying that each level builds on the prior level. There is, however, one exception—and that’s the possibility to skip Level 2.

The ultimate goal is to have your access management become as dynamic as your organization. As people, roles, and technology change, you should have the ability to adjust access dynamically in order to support those changes. The Secure Access Maturity Model provides a path from identity-based access through to Dynamic Access and includes a breakdown of key components across the journey.

Understanding the Secure Access Maturity Model

The following sections break down each level of the Secure Access Maturity Model into:

• Access Lifecycle: The lifecycle of credentials typically seen at that level
• Attributes: The characteristics of access associated with that level
• Technologies: The common technology categories needed to support each level.

By understanding these three dimensions, and where your organization fits within them, it’s possible to find where you exist on the Secure Access Maturity Model, as well as identify the steps needed to level up.

Breaking down the Secure Access Maturity Model

First and foremost, embracing Dynamic Access requires an identity-based approach to access management. This means that access to systems is defined at the individual or employee level, and access is provisioned based on the needs of that specific individual.

The criticality of this approach cannot be overstated. Without foundationally basing access on what each individual person in your organization needs, it becomes impossible to dynamically adjust access when turnover, role changes, or new technology adoption occurs.

Level 1 is accompanied by a specific set of technologies that are typically required to enable each attribute. In this case, that includes an identity provider (IdP), single-sign on provider (SSO), and a tool to enable multi-factor authentication.

The combination of these technologies results in an access experience that is aligned to an identity and makes it simple to access web-based or custom applications, but is lacking when it comes to protecting accounts with elevated permissions, and that simplicity continues to be non-existent for accessing backend infrastructure or cloud service providers (CSPs).

Access Lifecycle: Always On

Organizations at Level 1 of the maturity model typically have an “always on” lifecycle for credentials. This is defined as credentials being created when someone joins an organization, or a new technology is adopted, and that credential exists in perpetuity until that individual leaves or the technology is retired.

Why go from Identity-Based Access to Just-in-Time Access

The case for Just-in-Time Access is a question of risk. Credentials that exist in perpetuity can represent a substantial attack surface for organizations. The more that credentials are available, the higher the risk that they may be used as an entry point into your organization (see image below).

Moving from Standing to JIT Access Greatly Reduces Risk

Maturing from standing to just-in-time access represents a significant reduction in your potential attack surface. Why? Credentials that don’t exist when not in use can’t be used against you.

First and foremost, embracing Dynamic Access requires an identity-based approach to access management. This means that access to systems is defined at the individual or employee level, and access is provisioned based on the needs of that specific individual. 

The criticality of this approach cannot be overstated. Without foundationally basing access on what each individual person in your organization needs, it becomes impossible to dynamically adjust access when turnover, role changes, or new technology adoption occurs.

SAMM: Privileged Access Management

Level 2 of the Secure Access Maturity Model is primarily focused on adding additional security measures for the most sensitive accounts. These typically include accounts with admin-level privileges and those with elevated privileges— basically any account that has direct access to sensitive data or settings.

Privileged Access Management

The main characteristic of Level 2 is the adoption of security measures that ensure accounts with elevated privileges have extra protections. This practice encompasses an entire technology category: Privileged Access Management (PAM).

PAM solutions establish policies and practices that ensure the security of sensitive data through the close management of administrative accounts. The idea is to add additional security layers for those accounts that represent the most risk in the case of a breach. The biggest challenge, however, is that the scope is very narrow—it only helps to protect privileged accounts, and in many cases, a limited set of resources.

In most organizations, elevated privileges exist beyond admin accounts. This could be a developer or engineer with access to production data, or even marketing teams with access to sensitive customer data. Levels 3 and 4 of the maturity model will help to close this gap.

In fact, it’s possible to skip Level 2 of the maturity model altogether.

Access Lifecycle: Always On

Similar to Level 1 of the maturity model, Level 2 has an “always on” lifecycle for credentials. This is defined as credentials being created when someone joins an organization, or a new technology is adopted, and that credential exists in perpetuity until that individual leaves or the technology is retired.

From Privileged Access to Dynamic Access

PAM has been the gold standard for protecting access for a long time and it makes sense, because if you can’t protect everyone or every tool, protect the people and tools that carry the highest risk. But that just isn’t the case any more.

Modern organizations must extend protection of access to all employees and all tools. Any less and you’re leaving yourself open to risk.

Traditional PAM environments leave critical gaps in your access management program, including cloud environments and new and modern tools. Dynamic Access Management (DAM) addresses this by providing just-in-time access to every technical employee, every tool in your stack, and ensuring that every action taken is logged and kept available for audits and investigations.

Level 3 of the Secure Access Maturity Model is where the temporal aspect of the access lifecycle begins to come into play. This is where organizations begin to adopt Just-in-Time Access, ultimately paving the way for Zero Standing Privileges.

SAMM: Just-in-Time Access

Defining Just-in-Time Access & Zero Standing Privileges

Often, there is confusion between Just-in-Time Access and Zero Standing Privileges. The easiest way to delineate between them is keep in mind that Just-in-Time Access is a component of Zero Standing Privileges.

• Just-in-Time Access: The ability to provision credentials the moment they’re needed, and deprovision those credentials once they are not needed!
• Zero Standing Privileges: Access management methodology that requires that no credentials exist in perpetuity, and all access is provided in a Just-in-Time manner.

In other words, you must have implemented Just-in-Time Access in order to fully embrace Zero Standing Privileges. This evolution is one of the key pillars of Level 4, Dynamic Access.

When it comes to Level 3, it is key to remember that Just-in-Time access also represents an expanded scope in the types of accounts supported. Where privileged access only supported critical accounts, Just-in-Time access begins to lay the foundation for dynamic access across your technical teams.

Access Lifecycle: Mixed

Level 3 has a combination of always-on access and just-in-time access. Fundamentally, it is a middle step on the path towards dynamic access, where you’re ensuring that the credentials that pose the biggest risk in the case of a breach are provisioned dynamically, and credentials with less risk continue to exist in perpetuity.

From JIT to DAM: Achieving Zero Standing Privileges and Making Access Work for You

The ultimate goal for access management is zero standing privileges. It’s the idea that no access exists, except for the moments that it’s needed. This is what Dynamic Access Management is all about.

But it doesn’t stop there. DAM also focuses on providing the resources and tools you need to simplify how your end-users interact with and request access; keeps all access and activities easily on hand for audit and compliance purposes; and represents applying JIT access to everyone in your technical stack. Here’s how you get there.

Level 4 is the pinnacle of access management. It embraces Zero Standing Privileges, the concept that credentials and access should only exist in the moments that it’s needed. In other words, your access becomes dynamic. As people join and leave your organization, or technology is implemented or retired, you have full visibility, control, and auditability of the access to your systems.

The benefits of this approach are momentous, as it essentially eliminates the risk posed by always-on credentials, including specific attacks like credential stuffing (if no credentials exist, what do you stuff?).

SAMM: Dynamic Access

Level 4 requires the capability to provision and deprovision access to infrastructure in real time, the ability to understand if a particular individual actually needs that access, and the ability to monitor everything that individual did while that access existed.

Access Lifecycle: Just-in-Time & Zero Standing Privileges

Level 4 requires that access is only provided using Just-in-Time policies, and always-on credentials are fully eliminated. That means credentials only exist on a temporary basis, are hidden from users, and activity on systems is tracked closely.

There’s no trick or secret to achieving Level 4 and Dynamic Access. It just requires re-evaluating your current approach to infrastructure access, and then updating it to account for modern challenges, such as hybrid, multi-cloud, and remote work.

One of the biggest challenges you’ll face on this journey is the inability to streamline access across backend infrastructure and cloud service providers. That’s because every tool in your stack is focused on doing what it does best—for example, databases are focused on managing data, not necessarily ensuring that they have access workflows that provide simplicity to end users and organizations.

That’s where tools like StrongDM come in. They take the hard work you’ve done at Level 1—moving to an identity-based approach to access—and extend it to your infrastructure and cloud environments. They make accessing infrastructure as simple as using an SSO provider for any technical employee that needs access to your stack.

StrongDM provides a number of benefits for your organization, across teams:

• DevOps: Teams can provision and deprovision access to specific instances, servers, or databases, in a matter of clicks.
• Security & Compliance: Teams can gain full visibility into “who did what when” on each system, including video playback of what individual users have executed on specific systems. For compliance, full records are kept of “who was in each system and what were they doing” at any given point in time.
• Admins: Access to critical infrastructure can be granted and revoked quickly and easily, greatly simplifying user onboarding and offboarding, provisioning for third parties, and the ability to provide access for a specified period of time. Users, roles, and access are easily managed via the Admin UI (CLI available as well).

These benefits are the result of addressing the access issues created from all of the different technologies, different roles, different levels of permissions, and evolving technologies in your stack. StrongDM removes the need to manually address each of these challenges, giving you a clear path to achieving Level 4 and Dynamic Access. To learn more, get your demo of StrongDM today.

Conclusion

61% of all breaches involve using credentials in order to gain access to sensitive systems.

The days of badging into an office in order to get onto the corporate network are long gone. And as the technologies we embrace continue to evolve, the ways we access these technologies will need to follow suit. That’s the only way that it becomes possible to reduce that 61%, and ensure that access to systems is as dynamic as your organization.

More Secure Access Maturity Model (SAMM) Resources

• Dynamic Access Management (DAM): Innovating PAM
• What is PAM Security? Privileged Access Management Explained
• The Definitive Guide to Identity and Access Management (IAM)
• What Are Zero Standing Privileges (ZSP)? (And How They Work)
• Just-In-Time Access (JIT): Meaning, Benefits, Types & More
• A Practical Approach to Just-in-Time (JIT) Access for Developers