What It Delivers
Network Access Layer — Tailscale or Headscale
Tailscale (or Headscale for sovereign deployments) replaces legacy VPN for T1 workloads — cloud resources, Kubernetes clusters, multi-cloud management planes. Per-node ACLs, Entra OIDC integration, and per-session MFA via key expiry. An attacker with a stolen credential reaches only the specific resources that credential is scoped to, not the entire network.
Privileged Access Layer — Teleport
Teleport deployed as the protocol-aware access layer for SSH, RDP, Kubernetes, and database access. Every privileged session is proxied, recorded, and auditable. Ephemeral certificates replace long-lived credentials — there are no SSH keys to steal, no saved RDP passwords, no standing database credentials. Access is approved, time-bounded, and logged by default.
JIT Access and Zero Standing Privilege
Just-in-time access workflows so privileged access to critical systems requires an approval request, grants time-bounded access, and expires automatically. No standing admin sessions, no persistent elevated accounts with broad reach. The attacker who compromises an admin account at 3am finds it has no current access to anything significant.
Vendor Remote Access Governance
Third-party vendors — managed service providers, hardware suppliers, software vendors with remote support access — brought under the same PAM architecture. Every vendor session scoped to the specific resources they need, recorded, and revokable instantly. Vendor access is a significant and frequently overlooked attack surface.
T0 Overlay — Nebula (Optional)
For T0 systems (domain controllers, ADCS, Entra Connect sync server), an optional Nebula overlay provides a management network with no external coordinator dependency — once certificates are distributed, the overlay functions with zero cloud service availability dependency. The Nebula CA is the only T0 component and can be kept offline.
Scope and Prerequisites
| Duration | 45–60 days |
| Environment | Any (cloud, on-premises, hybrid, multi-cloud) |
| Prerequisites | Module 12 (T0 Asset Protection) to establish the tier boundaries the PAM architecture enforces; inventory of privileged access requirements |
| Natural follow-on | Module 11 (Blue/Purple Team) to build detection for privileged access anomalies |
No standing access. No standing risk.
Every privileged session scoped, recorded, and time-bounded. An attacker who steals a credential finds it grants nothing by default.