Privileged Access Management (PAM) Architecture

PAM Architecture Overview

Securden Unified PAM is a web-based, on-premises, self-hosted solution delivered as a single, self-contained software package for installation on Windows servers. The package includes all essential components, including an embedded web server and a bundled PostgreSQL database, eliminating the need for additional software dependencies. Microsoft SQL Server is also supported as an alternative database backend.

The solution follows a centralized architecture, with the application server managing business logic, authentication, access controls, and administrative operations. End users access the platform through standard web browsers, without requiring agents or additional software installations on their endpoints.

Secure Remote Access and Session Management

Securden employs a gateway-based architecture using Securden Session Manager (SSM), deployed on a designated host within the enterprise network. SSM securely brokers RDP, SSH, and SQL connections to target systems while supporting privileged session management, monitoring, and recording.

By routing remote sessions through the SSM gateway, the architecture eliminates the need for direct connectivity between user endpoints and sensitive IT assets by default. This provides centralized control over privileged access and reduces the exposure of critical infrastructure.

High Availability and Distributed Deployment

Securden supports a high-availability architecture (active-active model) comprising a primary application server and a standby secondary server, each maintaining its own database. Both servers operate concurrently, with encrypted streaming replication from the primary database to the secondary database, enabling the standby server to assume operations in the event of a primary server failure.

For larger or geographically distributed environments, additional application servers can be deployed to distribute workloads and improve scalability without requiring separate database replication.

Read-only replica servers can also be deployed across distributed networks to facilitate password retrieval and remote connections, improving access efficiency and reducing dependence on a centralized deployment.

Vault Design, Encryption Standards, Key Management

Securden protects sensitive information through a fully encrypted vault using AES-256 encryption. Encryption is performed at the application layer before information is written to the database, ensuring that sensitive data remains protected at rest.

Each installation uses a uniquely generated encryption key. For enhanced security, the key can be stored separately from the application server, either in a protected network location accessed through a dedicated service account or within a connected Hardware Security Module (HSM).

All sensitive data at rest is protected using AES-256 encryption, while data transmitted during remote sessions and other remote operations is secured through TLS/SSL-encrypted communication channels.

Together, these architectural capabilities provide centralized privileged access control, secure remote connectivity, high availability, distributed scalability, and strong data protection, supporting deployment in complex enterprise environments.

Core Architectural Components

Unified PAM consolidates the various components for privileged operations, elevated admin rights, and protected access to your IT infrastructure. The core components of Unified PAM are explained below and illustrated in the architecture diagram.

×

1) Application Interface

The Unified PAM interface is accessible by users through any standard web browser. Users are imported from any organizational directory such as AD, Entra ID, LDAP, or through files. They can login using their organization's designated Securden Server URL.

• Multifactor Authentication & SSO: In addition to the username & password or SSO for login – Securden integrates with a variety of MFA providers for added security before accessing PAM.

2) Primary Application Server

The Unified PAM Application is Deployed via ZIP package on a Windows machine (Virtual or Physical). It connects to the bundled PostgreSQL database to store all sensitive data in a highly-secure encrypted format.

The Password Vault forms the core of all PAM operations – leveraging the passwords, keys, service accounts and other credentials for authentication. While Unified PAM is vault-centric, access to various systems can be launched by using ephemeral (short-lived) credentials that do not rely on fetching login details from the vault.

3) Database

The bundled PostgreSQL database, or, optionally, a Microsoft SQL Server instance, holding all sensitive data in AES-256-encrypted form.

4) Secondary (Standby) Server(s)

Having one or more secondary application servers facilitates continuous uptime and provides a highly available setup to accommodate emergencies such as heavy traffic spikes, server outage, network issues, network latency, etc.

You can either map the secondary server to the database of the primary server or have a secondary (standby) database that will constantly replicate data from the primary server.

• Read-Only Server(s): The read-only server helps users access Securden when the primary server is down. The replica server, however, only allows users to perform ‘READ’ operations. This prevents them from modifying data. Based on your requirements, any number of Read-Only servers can be set up in various locations.

5) Application Servers/Remote Connectors (Optional, without database)

Remote connectors are additional servers that can be deployed for load distribution and to support distributed or multi-site networks from the central installation. The remote connector performs privileged account discovery, password verification, password rotation, directory synchronization, and policy enforcement across Vault, PAM, and EPM workflows in the remote network where it is deployed.

6) Remote Gateway: SSM Jump Server(s)

The SSM facilitates secure privileged session launch (RDP/SSH/SQL/HTTPS), monitoring, recording, and policy enforcement for administrative access to internal infrastructure in the network where it is deployed. This approach eliminates the need for direct connectivity between the endpoints and the sensitive IT infrastructure and ensures a higher level of security.

Each session manager can handle multiple simultaneous sessions and needs to be sized accordingly.

7) Encryption Key & Security

Unified PAM stores all sensitive information in a fully encrypted manner in a secure, digital vault. Securden uses AES-256 for encryption. The encryption key is unique to every installation and is automatically generated.

The best way to safeguard the key is to store it in a network location that is not on primary or secondary (in a separate machine) and use a dedicated service account to access the location for read or write operations. You can also use the same service account to run the Securden service so that only Securden has access to that location, and even if the servers where Securden is installed are compromised, the key isn't available on that server. You can alternatively store the key in a secure location, such as a mounted physical Hardware Security Module (HSM).

• Data in Transit: All remote sessions, administration traffic, and operational management tasks are encrypted using TLS/SSL over secure network channels.

High Availability & Scalability

• Active-Standby HA: High availability uses two application servers (primary and secondary) connected to a common database keep privileged credentials highly available. If one server fails or becomes unresponsive: incoming traffic is redirected to the other active server. The HA servers can be two separate physical machines or two virtual machines.
  • Optionally, the Secondary (Standby) server can maintain its own database instance with encrypted streaming database replication from the primary for continuous failover readiness.
• Application Servers: Additional application servers (without local databases) can be deployed for load distribution across distributed or multi-site networks.
• Read-Only Replicas: Read-only replica servers can be deployed in remote segments to process local password retrieval and session launching while restricting data modification.

×

Data Flow

User access to the vault

• Users open the Securden web interface in a standard browser over HTTPS. No client software is required. Users can also access through desktop applications and mobile apps.
• The primary server (or an application server) processes the request and applies role-based access, approval workflows and MFA.
• Credentials are read from the backend database. They are stored AES-256 encrypted, and decryption happens at the application level on the server.

Remote privileged sessions

• A user launches a one-click RDP, SSH or SQL connection from the web interface.
• The request is routed to the Securden Session Manager on the jump host. All remote connections go through this gateway.
• The SSM brokers the connection to the target resource, so there is no direct connectivity between the user's machine and the sensitive asset by default.
• The session is monitored live and recorded. Audit trails and analytics are generated from it.
• Data in transit during remote sessions and remote operations is encrypted with TLS/SSL and sent only over secure channels.

Remote operations and discovery

• The Remote Operations Layer performs password resets, verification and account synchronization on target systems.
• Discovery connects to Windows hosts over WMI, and to Linux, Cisco and Mac devices over SSH. For databases, the relevant database ports are specified at scan time.
• Discovered accounts are imported into the vault and assigned ownership.

Replication and distribution

• The primary streams encrypted database replication to the secondary standby, which takes over if the primary fails.
• Application servers (no database of their own) connect to the central database to share load across sites.
• Read-only replicas serve password retrieval and remote connections locally in distributed networks.

Module Deployment Scenarios for Unified PAM

1. The Password Management Module: The Password Vault module is activated to establish centralized privileged credential management. Users securely access the vault over HTTPS, while the Application Server integrates with AD/Entra ID for authentication and privileged account onboarding.
2. The Core PAM Module (Privileged Accounts, Sessions, & Access): Once Vault foundations are established, Core PAM capabilities are enabled, including session routing through the SSM layer. Privileged access to VM, servers, databases, and network devices is governed through controlled workflows, with full monitoring, recording, and audit trails.
3. The Vendor PAM Module (Third-Party, Contractor Access): Extending Core PAM for third parties, the Vendor PAM module governs vendor access without requiring persistent VPNs or internal network exposure. External users authenticate via an isolated cloud portal with strict multi-factor authentication (MFA), Just-In-Time (JIT) provisioning, and granular scope limits, while all external sessions remain fully isolated and recorded.
4. The Endpoint Privilege Management (EPM) Module: The Endpoint Privilege Management module is activated to extend least-privilege enforcement across Windows, Mac, and Linux endpoints. EPM agents deployed across endpoints will periodically pull privilege elevation and application control policies from the Unified PAM server. This enables eliminating local administrator rights, granular application control, and establishing policy-based privilege elevation.
5. The Cloud Infrastructure Entitlements (CIEM) Module: Building upon on-premises and hybrid access control, the CIEM module discovers, visualizes, and manages permissions across multi-cloud environments (AWS, Azure). It enforces least privilege by identifying over-permissioned identities (human and non-human), mitigating toxic combinations, and providing continuous risk modeling for cloud resources.
6. The Remote Assistance Module: The Remote Assistance module extends PAM controls to end-user workstations and helpdesk workflows. Support teams can launch secure, attended or unattended remote support sessions to endpoints while still applying session recording, elevation-on-demand, and command control. This is done without granting permanent administrative rights to support staff or end users.

Module Configuration and Enablement

Network and Port Requirements

All ports below are TCP unless otherwise noted. Submit and approve firewall changes across all target subnets before deployment, including client-to-gateway and gateway-to-target ports for remote protocols.

Primary Product Ports

Directory, Authentication and Integration Ports

Note:

• The Securden web port (default 5959) may be changed to 443 or any other available port.
• The AD port defaults to 636; 389 applies only when SSL/TLS is not enabled for the directory connection.

Data Protection Summary