ZSP is where a lot of modern PAM conversations are heading, but the term can scare some people off. Here are five things to understand about Zero Standing Privileges.
Standing access is any privileged account that exists with its rights in place whether or not it's being used. Most environments are full of it: admin accounts, service accounts, and break-glass accounts, all sitting there with full permissions around the clock. Every one of them is something an attacker can steal and use.
Zero Standing Privileges (ZSP) is different from JIT (Just-in-Time) in that typically (but not always) JIT is used with existing accounts. ZSP mechanisms create ephemeral (temporary) accounts with the permissions needed to do the task the user needs to do. When the time window expires, the ephemeral account and its permissions are destroyed. So, no account carries permanent elevated rights, and between tasks there is literally nothing to compromise, not even an account.
With Zero Standing Privileges (ZSP), nobody holds admin rights when they aren't using them. Your admins still have admin work to do, though, and that's where Just-in-Time (JIT) access comes in. When someone needs to patch a server or reset a service account, they request access, and it gets approved (automatically or by a person). They get the rights they need for a set time, and those rights are removed when that time runs out. Every request is logged with who asked, what they accessed, when, and why, so you have a full audit trail without any extra work. Your admins can still do their jobs, and nobody has privileged access sitting around between tasks.
That is the only purpose for these accounts. Vault them, and rotate them often.
ZSP sounds like magic, but the way it works is simple. In every environment where ZSP is used, there is something called a "strong account". This account has all of the necessary permissions to create accounts, provision access, and delete the accounts that it creates. That is the only purpose for these types of accounts. They should be carefully set up, vaulted, and rotated often.
If your PAM platform or identity provider goes down, ZSP can't give anyone access, including the admins fixing the outage. Set up a break glass account (an emergency-only account) for your Tier 0 assets like domain controllers and the PAM platform itself. Keep the credentials outside the systems it's meant to recover, alert on every use, and rotate the password after each emergency.
ZSP may sound advanced or intimidating, but it comes down to a simple idea: remove standing access where you can, and use JIT for everything else. If you're trying to figure out where to start, please reach out; we help teams map a realistic path to ZSP.