PEDM
Temporary elevation for a whole session or a single file, with approval and audit records.
Where the module helps during an attack
Privilege management primarily limits escalation and lateral movement. This is an indicative view, not a measurement.
| Area | Level |
|---|---|
| Reconnaissance | no direct role |
| Initial access | context |
| Execution and persistence | additional protection |
| Escalation and lateral movement | primary role |
| Impact | context |
| Investigation and recovery | additional protection |
Two areas: endpoint privileges and server access
Heimdal groups three products under privileged access. Privilege Elevation and Delegation Management (PEDM) controls endpoint admin rights. Privileged Account and Session Management (PASM) protects administrative accounts and server sessions. Application Control has its own page.
PASM
Credential vault, MFA, RDP and SSH access, and session recording.
PEDM: users request, rules or administrators decide
A user without standing admin rights needs to install software. They request elevation in the Heimdal agent. Rules approve automatically or route the request to an administrator's console or mobile app.
Privileges expire after the configured period. The module can then terminate processes started during the session. Requests and sessions remain in the audit trail.
- Rules based on roles, users and groups.
- Immediate privilege revocation and prevention of elevation for system files.
- Approval through the console or iOS and Android mobile apps.
PASM: vault passwords and record sessions
PASM stores privileged account passwords in a vault. Administrators connect through its RDP or SSH interface without knowing or sharing passwords. The vendor says no agent or plug-in is needed on the target server.
Sessions are monitored live and recorded for audit or incident investigation. Roles and temporary on-demand permissions control access.
Fewer tickets and fewer standing privileges
Smaller businesses often grant admin rights to avoid IT handling every installation. PEDM offers on-demand rights while preserving IT control and records.
PASM helps where internal teams and external suppliers share server administration. Every access is traceable and passwords need not be shared by email or spreadsheet.
IT team
Fewer manual installation interventions and clear visibility into granted privileges.
Management and audit
Evidence of who held elevated rights, when and how they used them.
Deployment with APPSEC
Heimdal supplies the modules and mobile app. APPSEC designs and deploys rules as agreed. You appoint approvers and remain responsible for daily decisions.
Privilege map
We identify current admin rights, why they are needed and which servers external suppliers manage.
Rules
We define automatic and manual approvals and assign approvers.
Gradual removal
We remove admin rights by group so people can continue working.
Handover
We demonstrate approvals, reports and session recordings. Support is specified in the proposal.
