PAM Scope at Cirius Group

Story: PAM-002 — Define PAM scope Owner: Rory (security) / Kobe (documentation) Status: Completed 2026-04-16 Related: Keeper License Audit, PAM Evaluation, Three-Layer Access Architecture

Purpose

Define exactly which privileged access paths at Cirius Group fall under Privileged Access Management (PAM) controls — session recording, credential brokering, time-bound elevation — and which are explicitly exempt. Without a clear scope, the PAM evaluation in PAM-003 turns into an unbounded tooling shootout. This document bounds it.

This scope aligns with our HIPAA administrative safeguards (hipaa-controls.md, §164.308(a)(3) workforce security and §164.308(a)(4) information access management) and the three-layer access architecture we've already deployed at the network tier.

Definitions

• Privileged access: any session where the operator can modify security configuration, read or modify PHI-adjacent infrastructure, or bypass normal per-user audit controls.
• Session recording: full video/keystroke capture of the privileged session, retained for at least 90 days, tamper-evident, reviewable by a second party.
• Credential brokering: the operator never sees the target credential; the PAM tool injects it into the session and rotates it after use.
• Time-bound elevation: the privileged role is granted for a fixed window (typically 1–8 hours) and auto-revoked, with justification captured at activation.

In Scope — Requires Full PAM Controls

These paths must have session recording and credential brokering and time-bound elevation. They are the highest-risk surfaces at Cirius.

1. Panorama (Palo Alto management plane)

• Any web UI session to panorama.ciriusgroup.com
• Any CLI session (SSH) to Panorama
• Rationale: Panorama pushes policy to both the public-edge firewall and the PrivateFW that sits in front of PHI-bearing workloads. A malicious or negligent change here bypasses every downstream control.

2. Direct Domain Controller access

• RDP to any DC (dc01, dc02)
• PowerShell remoting to any DC
• Any session that runs ntdsutil, dcdiag, Set-ADUser, Set-ADGroup, or modifies GPOs
• Rationale: DC compromise is identity compromise. Every privileged session here must be reviewable.

3. Privileged Entra admin sessions

• Activation of Global Administrator, Privileged Role Administrator, Security Administrator, Exchange Administrator, SharePoint Administrator, Intune Administrator, or Conditional Access Administrator roles
• Sessions that modify Conditional Access policies, named locations, or break-glass accounts
• Rationale: HIPAA §164.308(a)(4) requires access reviews; these roles touch the controls that enforce access. Note: Azure PIM already provides time-bound elevation and activation audit for this category — PAM scope here is layered on top of PIM, not a replacement. See PAM-003.

4. Firewall CLI (PrivateFW and PublicFW direct)

• Any SSH session to PrivateFW or PublicFW that bypasses Panorama
• Any session that runs configure mode commands directly on a firewall
• Rationale: direct firewall CLI skips Panorama commit audit. If someone is on a firewall CLI in configure mode, we need a recording.

In Scope — Session Recording Only

These paths require session recording but do not require credential brokering (because the credential is already a per-user identity with its own audit trail) or time-bound elevation.

5. Production Azure subscription elevated access

• Any session under Azure roles Owner, Contributor, User Access Administrator on the cirius-prod subscription or any resource group tagged env=prod
• Covered today by Azure PIM activation logging; session-level recording is handled through the Azure activity log + the PIM audit log, which we consider equivalent to "session recording" for this category because Azure native telemetry is comprehensive and tamper-evident.

6. SecOps platform administrative access

• Any session under the admin role of the SecOps platform (secops.bedrockcybersecurity.org)
• Covered today by application audit log. A dedicated recording tool is overkill for a browser admin panel that already logs every mutation.

Out of Scope — Explicitly Exempt

These paths are not under PAM controls. They are documented here so future reviewers know the exclusions are intentional, not oversight.

A. Standard workstation admin (local admin on own device)

• Local administrator on a user's own Intune-managed workstation
• Rationale: local admin on a managed endpoint is audited through Defender for Endpoint and Intune compliance policy; PAM on every workstation would be disproportionate cost for the risk.

B. Developer SSH to dev/test environments

• SSH to any host in subscriptions tagged env=dev or env=test
• Rationale: no PHI, blast radius limited to dev data, velocity cost of recording every dev SSH session is too high.

C. Read-only access to production

• Azure Reader role, Log Analytics Reader, SecOps viewer role
• Rationale: read-only cannot change state; the mutation audit trail is maintained at the resource level.

D. M365 admin actions performed from within the Entra admin portal

• Covered by M365 Unified Audit Log. Adding session recording on top duplicates evidence.

E. Kobe automation account itself

• Kobe's kobe-cloud-pc federated identity runs under its own documented scope (kill-chain-audit-policy.md).
• Rationale: non-human identity, every action is already logged to SecOps platform and git. Recording an automation session yields noise.

Target Control Mapping by Tier

Scope tier	Session recording	Credential brokering	Time-bound elevation	Tool
Panorama	Required	Required	Required	KeeperPAM (proposed)
DC direct	Required	Required	Required	KeeperPAM (proposed)
Privileged Entra roles	Required	N/A (PIM uses user identity)	Required	Azure PIM (in place) + recording TBD
Firewall CLI direct	Required	Required	Required	KeeperPAM (proposed)
Azure prod elevated	Azure activity log	N/A	Azure PIM	Azure native
SecOps admin	App audit log	N/A	N/A	Application native

Exit Criteria for Scope Freeze

This scope is considered frozen for the current PAM procurement cycle when:

• [x] In-scope tiers enumerated
• [x] Out-of-scope paths documented with rationale
• [x] Control requirement per tier mapped
• [ ] Greg signs off on this scope before PAM-003 tool evaluation is presented
• [ ] Scope reviewed annually in the annual review checklist

References

• Keeper License Audit
• PAM Evaluation
• Three-Layer Access Architecture
• HIPAA Controls
• NIST SP 800-53 AC-6 (Least Privilege), AU-10 (Non-Repudiation), AU-11 (Audit Record Retention)