JIT and ZSP often come up in the same conversation, and many people use the terms interchangeably. They're closely related, but each one handles a different part of the problem, and you get the most protection when you use them together. Here are three ways they work together to shrink your attack surface.
Just-in-Time (JIT) access gives an existing account elevated rights for a set window of time. For example, your admin account gets added to the local Administrators group on a server for two hours, then removed when the window expires. The account still exists afterward, but it has no privileges.
Zero Standing Privileges (ZSP) goes one step further; instead of removing permissions from an account, it deletes the account. So, when someone needs access, the strong account creates a temporary account, assigns it the necessary entitlements, then deletes it when the work is done. Most environments use both: ZSP for cloud platforms and anything else that supports it, and JIT for systems that can't support ZSP yet, like older applications and some on-prem servers.
The account remains, but its elevated rights are stripped when the window ends.
The strong account creates a temporary account, then deletes it when work is done.
The stolen hash works whenever they decide to use it - tonight or a month from now.
Rights exist only during an approved window. Outside it, the credential gets them nowhere.
The account they stole might not even exist by the time they try it.
Let's assume an attacker already has network access to your environment. Now, picture that attacker grabbing a password hash off a workstation where a domain admin logged in last week. With standing privilege, that hash works whenever they decide to use it, whether that's tonight or a month from now. With JIT, the account only has rights during an approved window, so using the credential outside that window gets them nowhere, and they have no idea when that window is open, or when it will be open again.
With ZSP, the account they stole might not even exist by the time they try it. An attacker is left hoping their timing works out or trying to get through your approval process. Both options make more noise and are easier to detect than logging in with an account that's always privileged.
Nobody wants to submit a request and wait an hour to restart a service. If the process is slow, people start working around it, and those workarounds usually create new standing access. There are a few ways to keep things moving:
We aren't deciding who should do what, when; we're eliminating standing privileges.
The existing ticket can serve as the approval.
Build the permission framework so a request only takes a click.
30 minutes for a password reset, 4 hours for a patching window.
Domain controllers and the PAM platform itself.
Admins stay productive, and attackers don't find privileged accounts waiting for them. If you want help figuring out where JIT and ZSP fit in your environment, please reach out; we're helping a lot of our clients make this move right now.