Privileged Access Management (PAM) Architecture

PAM Architecture Overview

Securden Unified PAM (Privileged Access Manager) is a web-based, on-premise, self-hosted software-only solution and is available as a binary package for installation on Windows.

The package contains everything needed, and you don’t require any other hardware or software. It comes with an inbuilt web server and PostgreSQL server as the RDBMS. Optionally, you can use MS SQL Server as the backend database. You do not require multiple servers for product installation.

The solution runs on a central server connected to a backend database. The server handles all business logic. End-users connect to the server using any standard web browser or make use of the desktop or mobile application.

Architectural Layers

The architecture is primarily built upon two layers. One is the Application Layer, which manages the core business logic and processes user requests. It hosts the primary application servers that handle incoming traffic and direct operational commands.

The second is the Database Layer that safely stores all encrypted system data and credentials. It functions as the active server that processes all write operations.

Setting up Unified PAM is very easy and quick; If you wish to test it out, we’ll send you the download links to your email address here.

Unified PAM can be deployed as a single solution that consolidates:

• Password Management (Vaulting)
• Privileged Access and Session Management (PASM)
• Privilege Elevation & Delegation Management (PEDM)
• Vendor Access Management (VPAM)
• Cloud Infrastructure Entitlements Management (CIEM)
• Secure Remote Access & Assistance (SRA)
• Non-human & AI Identity Management [NHIM]

Securden has proven on-premises deployments across various government, banking, manufacturing, and healthcare organizations across the globe.

Core Architectural Components

Privileged Access Management (PAM) architecture is the structure that consolidates the various components that PAM uses for privileged operations, elevated admin rights, and protected access to your IT infrastructure. The core components of Unified PAM are explained below.

Application Interface

The Unified PAM interface is accessible by users through any standard web browser. Users are imported from any organizational directory such as AD, Entra ID, LDAP, or through files. They can login using their organization's designated Securden Server URL.

Multifactor Authentication & SSO

In addition to the username & password or SSO for login – Securden integrates with a variety of MFA providers for added security before accessing PAM.

It supports TOTP authenticators like Google & Microsoft authenticators, any RADIUS-based authentication mechanism (RSA SecurID, Digipass, etc.), Duo Security, Yubikey, Email to SMS gateway and OTP through email. Securden also supports FIDO2 & Web Auth-based Passkeys for secure, passwordless login.

Primary Application Server

The Unified PAM Application is Deployed via ZIP package on a Windows machine (Virtual or Physical). It connects to the bundled PostgreSQL database to store all sensitive data in a highly-secure encrypted format.

The Password Vault forms the core of all PAM operations – leveraging the passwords, keys, service accounts and other credentials for authentication. While Unified PAM is vault-centric, access to various systems can be launched by using ephemeral (short-lived) credentials that do not rely on fetching login details from the vault.

Secondary Application Server(s)

Having one or more secondary application servers facilitates continuous uptime and provides a highly available setup to accommodate emergencies such as heavy traffic spikes, server outage, network issues, network latency, etc.

You can either map the secondary server to the database of the primary server, or have a secondary (standby) database that will constantly replicate data from the primary.

Read-Only Server(s): The read-only server helps users access Securden when the primary server is down. The replica server, however, only allows users to perform ‘READ’ operations. This prevents them from modifying data. Based on your requirements, any number of Read-Only servers can be set up in various locations.

The Remote Gateway: Jump Server for Distributed Networks

For remote operations like launching SSH, SQL, RDP connections, session monitoring & recording, password change & verification - Securden provides the option for a gateway approach. All remote connections from endpoints to target IT resources are routed through the remote gateway.

This approach eliminates the need for direct connectivity between the endpoints and the sensitive IT infrastructure and ensures a higher level of security.

Typically, you would install one remote gateway in each distributed network. The remote gateway consists of two components. You can deploy one or both depending on your requirements.

Gateway Component 1: Securden Session Manager - SSM Server(s)

The SSM facilitates secure privileged session launch (RDP/SSH/SQL/HTTPS), monitoring, recording, and policy enforcement for administrative access to internal infrastructure in the network where it is deployed.

Each session manager can handle multiple simultaneous sessions and needs to be sized accordingly.

Gateway Component 2: Application Servers

The application server performs privileged account discovery, password verification, password rotation, directory synchronization, and policy enforcement across Vault, PAM, and EPM workflows in the network where it is deployed.

Encryption Key & Security

Unified PAM stores all sensitive information in a fully encrypted manner in a secure, digital vault. Securden uses AES-256 for encryption. The encryption key is unique to every installation and is automatically generated.

The best way to safeguard the key is to store it in a network location that is not on primary or secondary (in a separate machine) and use a dedicated service account to access the location for read or write operations. You can also use the same service account to run the Securden service so that only Securden has access to that location, and even if the servers where Securden is installed are compromised, the key isn't available on that server.

You can alternatively store the key in a secure location, such as a mounted physical Hardware Security Module (HSM).

Module Deployment Scenarios for Unified PAM

The Password Management Module

The Password Vault module is activated to establish centralized privileged credential management. Users securely access the vault over HTTPS, while the Application Server integrates with AD/Entra ID for authentication and privileged account onboarding.

The Core PAM Module (Privileged Accounts, Sessions, & Access)

Once Vault foundations are established, Core PAM capabilities are enabled, including session routing through the SSM layer. Privileged access to VM, servers, databases, and network devices is governed through controlled workflows, with full monitoring, recording, and audit trails.

The Vendor PAM Module (Third-Party, Contractor Access)

Extending Core PAM for third parties, the Vendor PAM module governs vendor access without requiring persistent VPNs or internal network exposure.

External users authenticate via an isolated cloud portal with strict multi-factor authentication (MFA), Just-In-Time (JIT) provisioning, and granular scope limits, while all external sessions remain fully isolated and recorded.

The Endpoint Privilege Management (EPM) Module

The Endpoint Privilege Management module is activated to extend least-privilege enforcement across Windows, Mac, and Linux endpoints. EPM agents deployed across endpoints will periodically pull privilege elevation and application control policies from the Unified PAM server. This enables eliminating local administrator rights, granular application control, and establishing policy-based privilege elevation.

The Cloud Infrastructure Entitlements (CIEM) Module

Building upon on-premises and hybrid access control, the CIEM module discovers, visualizes, and manages permissions across multi-cloud environments (AWS, Azure). It enforces least privilege by identifying over-permissioned identities (human and non-human), mitigating toxic combinations, and providing continuous risk modeling for cloud resources.

The Remote Assistance Module

The Remote Assistance module extends PAM control to end-user workstations and helpdesk workflows. Support teams can launch secure, attended or unattended remote support sessions to endpoints while still applying session recording, elevation-on-demand, and command control. This is done without granting permanent administrative rights to support staff or end users.