What are the relative merits / deficiencies of a Privileged Access Management (PAM) service compared with a strict policy of named users (no account sharing)?
By PAM, I'm specifically referring to devices which act as proxies, identifying the end-user and substituting shared credentials to access a target account, e.g. CyberArk, and NOT applications which merely provide managed access to a set of usernames and passwords.
More specifically, how do the approaches compare for
- resistance to external threat
- long term costs (PAM is an obvious quick fix if you're migrating away from using shared accounts)