Introduction to PAW
Privileged Access Workstations (PAWs) are dedicated, hardened devices used exclusively for administrative tasks. They protect high-value credentials from commodity threats on standard workstations.
Why PAW Matters
The Problem:
Admins use same device for email and admin tasks
Malware on workstation compromises admin credentials
Lateral movement to critical systems
Total domain compromise possible
The Solution:
Separate admin activities to dedicated devices
Eliminate credential exposure
Break attack chains
Protect tier-0 assets
Tier Model Architecture
Tier 0 - Domain Controllers
Assets:
Domain Controllers
AD management systems
PKI infrastructure
Identity providers
Protection Level:
Highest security
PAW required
No internet access
Physical security
Tier 1 - Enterprise Servers
Assets:
Member servers
Applications
Databases
Virtualization hosts
Protection Level:
High security
Dedicated admin accounts
Network segmentation
Privileged access
Tier 2 - User Workstations
Assets:
End-user devices
Laptops
Desktops
Mobile devices
Protection Level:
Standard security
User credentials
Internet access
Standard controls
Clean Source Principle
Core Concept
Definition:
A security principal should only be controlled by sources at the same or higher trust level.
Application:
Tier-0 admins only from PAW
No Tier-2 device touches Tier-0
Trust flows downward only
No exceptions
Trust Dependencies
Common Violations:
Using email on admin devices
Browsing from admin workstations
Managing servers from user PCs
Shared admin accounts
PAW Implementation
Hardware Requirements
Specifications:
TPM 2.0 required
Secure Boot enabled
Modern CPU with security features
Dedicated hardware (not VM)
Software Configuration
Security Settings:
Windows 11 Enterprise
Credential Guard enabled
Device Guard configured
AppLocker policies
No internet browsers
Minimal applications
Network Isolation
Requirements:
Separate VLAN
Firewall restrictions
No internet access
Jump server for access
Deployment Models
Dedicated PAW
Description:
Physical device for admin only
Highest security
Most expensive
Best for Tier-0
PAW with User VM
Description:
PAW host with user VM
Admin tasks on host
User tasks in VM
Good balance
Cloud PAW
Description:
Azure Virtual Desktop
Conditional access
Cloud-managed
Modern approach
Credential Protection
Credential Guard
Function:
Virtualization-based security
Isolates credentials
Protects against Pass-the-Hash
Requires hardware support
Remote Credential Guard
Function:
Protects credentials during RDP
No credential delegation
Single sign-on maintained
Reduces exposure
LAPS (Local Admin Password Solution)
Function:
Unique local admin passwords
Automatic rotation
Stored in AD
Prevents lateral movement
Administration Practices
Just-In-Time Access
Implementation:
Time-limited admin access
Approval workflows
Automatic revocation
Audit logging
Just-Enough-Administration
Implementation:
Role-based administration
Limited permissions
Specific task access
No permanent admin
Separate Admin Accounts
Requirements:
Dedicated admin accounts
No email on admin accounts
Named accounts (not shared)
Strong authentication
Monitoring and Detection
Logging Requirements
Log Sources:
PAW event logs
Authentication events
Administrative actions
Network traffic
Alerting
Alert Conditions:
Non-PAW admin access attempts
Tier crossing violations
Failed authentications
Unusual admin behavior
Implementation Roadmap
Phase 1: Foundation
Tier model design
Account separation
Initial PAW deployment
Tier-0 protection
Phase 2: Expansion
Tier-1 coverage
Additional PAWs
Process refinement
Training
Phase 3: Maturity
Full coverage
JIT/JEA implementation
Automation
Continuous improvement
Challenges and Solutions
Challenge: User Resistance
Solution: Demonstrate risk, provide training, executive sponsorship
Challenge: Complexity
Solution: Start small, iterate, automate where possible
Challenge: Cost
Solution: Risk-based prioritization, cloud options, phased approach
Challenge: Exceptions
Solution: Formal exception process, compensating controls, time limits
Conclusion
PAW and the tier model are essential for protecting privileged access. By separating administrative activities and implementing clean source principles, organizations can dramatically reduce the risk of credential theft and lateral movement attacks.