BR +55 11 3069 3925 | USA +1 469 620 7643

Just-In-Time Access (Ephemeral Credentials)

by | Dec 20, 2019 | BLOG

Which company hasn’t ever found itself needing to grant access to a user for just a day or a few hours? 

Access of which is from a third party or partner who needs specific information or system maintenance that results in the creation of another user for access to the environment, which after a few hours will never be used again.

This increases the risk possibilities as there are more users with certain privileges to be exploited. 

One thing is undeniable: specific and temporary access is needed; the problem is understanding how to control them. 

This article aims to introduce “Just-In-Time-Access” from the very beginning of the concept, how it works and how it can be applied so that your organization’s privileged access becomes more secure.

But first, what is Just-In-Time?

Known as a management philosophy, Just-In-Time (JIT) emerged in Japan in the 1970s at Toyota Motors, which wanted to create a system that would increase vehicle production efficiency for a specific demand of colors and models. 

The main goal of this concept is to avoid waste through “pull” production, which in practice means that only the number required will be produced in the time required. 

This practice resulted in inventories with smaller quantities of materials, which would be used as best as possible, avoiding waste. 

In short, this philosophy dictates that products must be produced and delivered on time for immediate use, that is, production meets only what was required by demand. 

There is no storage of products in inventory for when there is demand, as this can never happen because the organization would have to invest more money to keep them. 

Another point is that products in inventory, pending demand, may become obsolete. The only option, therefore, would be to discard them by throwing away much of the time and money investment altogether.


This production management philosophy can also be applied to managing access to systems and organizational environments. In other words, to enable timely access for immediate use, after which access will be blocked. 

Thus, the idea of temporary credentials arose. They are called “Ephemeral Credentials” because they cannot be used again when they expire, which is equivalent to the period of time for the access requested.  

It would be like creating a key that opens only one door at a given time, after which the lock changes and another key would be required to enter the room. 

This practice makes access to systems more secure, as the access credential has a small lifespan. Therefore, if it is stolen or intercepted, an attacker will not have enough time to take any malicious action, not to mention the limited access they would have to some privileges. 

It also makes it easier for system administrators to enable and revoke privileges for many users who need to access specific information for just a few hours. 

If the administrator forgets to revoke one of these accesses, these privileges can be exploited by attackers or even the employee who knows the credential data. 

It is like saying, for example, that there are a limited number of keys to access the various parts of an organization, and these keys cannot be found anywhere, let alone manufactured by anyone. To enter the desired room, the user has to wait for the key to arrive, and be asked to leave when the time is up, and after leaving, the key simply self-destructs, making it impossible for anyone to reuse it.

In practice, how does it work?

First, the user who wants to perform some privileged action or even a simple action (if the model is implemented in addition to privileged access) needs to make an access request. 

This user will have to justify their access and specify the time that will be required to perform the action and wait for access approval to be granted. Of course, privileges and activity time can already be set by the administrator, providing only the time and privileges believed to be needed. 

Upon approval of the requested access, the user will receive the ephemeral credentials and their period of time for expiration and will be duly informed about the activities they can perform and the time that the credential will be enabled. 

By the end of the access time, the credentials will be blocked or even deleted, according to the administrator’s preference. If activity is not completed within the period of time granted for access, the user will have to make a new request. 

Even with the credential blocked or deleted, it is extremely important to keep the logs of this access for control and security of operations. 

This will allow the user to no longer have access even if they remember the credential data, as the system will not authenticate them as a valid user due to the expiration of their access. 

Like JIT in Just-In-Time Access, ephemeral credentials are created with on-demand privileges to be used immediately, in due time. There is no “inventory” of privileged credentials to be distributed when requested. 

It is worth to mention that the more stored credentials, the more access keys an attacker can obtain and, consequently, they will be able to access any “room” of the organization.

Make Just-In-Time Access into Reality

As said, enabling and revoking access is a daunting task for any system administrator, but with Just-In-Time Access, wouldn’t it be like complicating this work? The volume of privilege revocation and credential blocking would be much higher and errors would be almost inevitable. 

So how do you make Just In Time Access an applicable reality into your organization? A tool that automates this process is the solution. 

You probably already know about Privileged Access Management (PAM) technology, and if you don’t, it is a technology that controls and manages privileged access to critical information in an organization. 

This type of technology allows Just-In-Time Access to be adopted in access control, as it allows controlling access requests and auditing all activities performed. It is also able to define the level of privilege for each credential and deliver them exactly to the users who need this access.

Some benefits we can mention when automating Just-In-Time Access through PAM technology are: 

  • Delivery of ephemeral credentials securely, such as emailing directly to the user who will use them.
  • Revocation of all ephemeral credentials after the specified time
  • Automation of the access creation and privilege provisioning process.

By using senhasegura, which is a PAM solution, organizations can reduce their credential inventories, create provisions for specific time periods, obtain detailed access log records, and record sessions with credentials assigned.

With ephemeral credentials or not, your organization needs to protect the keys of the kingdom, which are privileged credentials. 

Contact us and learn how senhasegura can do it for you. 

An Overview of Saudi Arabia’s Personal Data Protection Act (PDPL)

Saudi Arabia’s Personal Data Protection Law (PDPL) was implemented by Royal Decree M/19 of 9/2/1443H (September 16, 2021), which approved Resolution No. 98 of 7/2/1443 H (September 14, 2021). It was published in the Republic Journal on September 24, 2021. The Saudi...

The 5 Biggest Data Leaks of 2021

During the pandemic, cyberattacks grew more than ever. Theft, hijacks, and data leaks are increasingly popular practices in cybercrime. The lock and hijack for ransom (ransomware) category has stood out a lot, as data is a highly valuable resource and most companies...

HIPAA: Five Tips for Complying with The Certificate

What is HIPAA? Currently, this is one of the most frequently asked questions by many professionals working in the healthcare industry, especially in times of the Covid-19 pandemic. But why is it so important and what are its benefits for healthcare companies? First,...

How Does The LGPD Impact Companies?

Due to the growing technological development in the market, we can clearly see how much how consumers tend to buy products and services has changed. Through more practical technologies, such as cellphones, laptops, and tablets, for example, they are just a click away...

What Is the Difference Between IAM and PAM?

It is important to know the differences between IAM (Identity & Access Management) and PAM (Privileged Access Management). However, this theme still raises doubts for some people. First, it is necessary to understand that the need to obtain an identity is...
Copy link
Powered by Social Snap