The systems that can hurt you most aren’t reached over RDP
Line up what somebody holding administrative credentials could do in ten minutes, ranked by damage.
| The system | What ten minutes buys | How it’s reached |
|---|---|---|
| The firewall or VPN concentrator | A rule that opens a path, or closes all of them | Browser |
| The hypervisor | Every virtual machine, at once | Browser |
| The backup console | Deleting the recovery, which is what turns an incident into a catastrophe | Browser |
| Storage and SAN management | LUN presentation, snapshots, replication | Browser |
| Out-of-band management — iLO, iDRAC, IPMI, KVM | Power, media mounting, a console below the operating system | Browser |
| The ERP or core banking client | Money, and the records of money | Desktop client |
Almost none of that is RDP or SSH. So a privileged access programme scoped to servers leaves the highest-impact systems in the estate outside it — not through oversight, but because the tooling that was bought is a server-access tool, and the scope document ends up describing the product rather than the risk.
Can any of your administrators read the firewall’s admin password right now?
If they can, it is on at least one laptop, in at least one browser profile, and in whatever they used before that. It doesn’t change when somebody leaves, because changing it means finding every place it has been saved.
An application is an asset, the same as a server
This is the part that decides everything else. In Mirket PAM a web application and a desktop application are asset types in their own right, sitting alongside servers on the same platform — the same account mapping, the same session policy, the same recording, the same audit trail.
Nothing about the target changes to make that work. Agents on a firewall, a SAN or a hypervisor are not an option in any estate, so the control lives entirely in the access path instead.
- Web consoles Firewall and VPN interfaces, hypervisors, backup platforms, storage management, out-of-band controllers, certificate authorities, cloud provider consoles. Predefined selector hints cover common login forms, so a new appliance is configuration rather than a project.
- Desktop applications The ERP client, the database tool, the bespoke terminal application nobody will rewrite. Published through a terminal server or RemoteApp and treated like any other target.
The password is never rendered to the person using it
A credential the administrator can read is a credential that ends up saved — in a browser profile, in a personal password manager, in a note that outlives the job.
Mirket completes the login on its own side. The password is not shown in a field, not placed on a clipboard, not offered to anything that might remember it. The administrator arrives at the console already signed in.
That is what makes rotation possible at all. A password nobody has seen can change on a schedule, because there is no saved copy anywhere to go and find. Privileged Password Vaulting covers the vault side of that.
The session runs in Mirket’s browser, not in theirs
A personal browser profile carries extensions, saved sessions, sync to a phone and whatever else has accumulated. It is the least controlled software on the estate, and it is where administrative interfaces are normally opened.
The session instead runs in Mirket’s own isolated browser, remotely. The administrator sees the console; what surrounds it belongs to the platform rather than to them.
What leaves the session is a decision, not a default
Clipboard and file transfer are how data actually leaves an administrative session, and the two directions are different risks: pasting a command in is not the same as copying a configuration out.
Each is a separate setting per asset — clipboard to the user, clipboard to the asset, file upload, file download. A console where an engineer needs to paste a change can allow that without also allowing the customer database to be dragged out of it.
And every web session is recorded the way a shell session is, so a rule changed in a firewall interface has an author and a timestamp rather than an argument.
One list instead of two
The practical result is administrative rather than technical, which is why it tends to be undersold.
Because servers, web consoles and published applications live on one platform, there is one inventory, one policy model and one access review. Not a privileged access programme plus a spreadsheet of the things it couldn’t reach — which is the shape most estates are actually in, and the shape nobody puts in a slide.
What changes with Mirket
| Before | With Mirket |
|---|---|
| The firewall password sits in a browser password manager | It sits in the vault, and the administrator never sees it |
| A web console session leaves no evidence | It is recorded like an RDP session, with a transcript |
| The ERP client is permanently out of scope | It is published and treated like any other target |
| Administrative work happens in a personal browser profile | It happens in Mirket’s isolated browser |
| Rotation means hunting down every saved copy | There is no saved copy to hunt down |
| Out-of-band management was never in the scope document | It is an asset like any other |
| Two scopes: servers, and everything else | One list, one policy model, one access review |
Frequently asked questions
Can a PAM platform cover web consoles, not just servers?
It can if a web application is a first-class asset type rather than an afterthought. In Mirket a firewall interface, a hypervisor console or a backup platform is configured the same way a server is, with the same account mapping, session policy, recording and transcript.
Does the administrator ever see the console password?
No. The login form is completed on Mirket's side, so the credential is never rendered in the browser the person is looking at — not masked in a field, not available to copy, not offered to a password manager to remember.
Whose browser does the session run in?
Mirket's. It is the platform's own isolated browser, running remotely, rather than the administrator's personal profile with its extensions, saved logins and sync to a phone. The administrator sees the console; the environment around it belongs to the platform.
Are web sessions recorded the same way RDP sessions are?
Yes. A change made in a firewall interface produces the same evidence as a command typed at a shell — video plus a searchable transcript. RDP & SSH Session Recording covers how that recording works.
What about thick clients like an ERP or a database tool?
They are published through a terminal server or RemoteApp and behave like any other target: account mapping, session policy, clipboard and file-transfer rules, recording and transcript, all identical. It is a solved problem that most programmes simply never attempt.
Does anything have to be installed on the firewall or the hypervisor?
No, and it could not be. Agents on a firewall, a SAN or a hypervisor are not an option, so the control works entirely from the access path instead. Nothing is deployed to the target.
Every appliance has a different login page. Is each one a custom integration?
No. Predefined selector hints cover the login forms of common management interfaces, so a new appliance is configuration rather than development work.
Can I control what gets copied out of a console session?
Yes, and each direction is decided separately. Clipboard to the user, clipboard to the asset, file upload and file download are individual settings per asset, because copying a config out and pasting a command in are different risks.
Why does out-of-band management keep getting missed?
Because you don't log into a server to use it. iLO, iDRAC, IPMI and KVM sit below the operating system and offer power control and virtual media — which makes them among the most powerful interfaces you own, and among the least likely to appear in a scope document written around RDP.
Does this mean two access reviews, one for servers and one for applications?
No — that is most of the point. Servers, web applications and published desktop applications are asset types on one platform, so there is one list, one policy model and one review rather than a programme plus a spreadsheet of exceptions.
Is this available as a service?
No — PAM is on-premise. It also happens to suit this use case: the firewall, the hypervisor and the backup console all sit inside your network, so the platform fronting them sits there too. Deployment explains the split across modules.
Related
Solutions — Privileged Password Vaulting · RDP & SSH Session Recording · Session Control & Command Policy · Third-Party & Vendor Access · Just-in-Time Access
Product — Privileged Access Management
Industries — Manufacturing · Finance