PDAccess, Next Generation Privileged Access Management

Shared Network Credentials Are a Breach Waiting to Happen

Network devices are where "shared admin account" is not the exception — it's the default. Routers, switches, and firewalls typically run a small set of local accounts, and every engineer on the team knows them. The result is a standing breach surface:

One leaked credential = every device. The same admin password often spans the whole network.
No per-user accountability. The syslog says "admin" — not which admin.
No command-level visibility. Authentication may be logged; what was actually typed usually isn't.
Offboarding is a hope. When an engineer leaves, the shared credentials don't leave.

For auditors under PCI-DSS, SOX, HIPAA, and ISO 27001, this is the worst combination: the most critical infrastructure, the weakest identity model, and no evidence to show for it.

TACACS+ and RADIUS as Identity Proxies

PDAccess treats TACACS+ and RADIUS as identity proxies — part of the same proxy model that brokers SSH, RDP/VNC, and database sessions. Instead of devices authenticating users against a local account file, they authenticate them against PDAccess:

Authentication — the device asks PDAccess "who is this user, and can they in?" PDAccess answers with the user's identity, their MFA status, and their policy.
Authorization — PDAccess enforces what that user may do on that device, from that source, at that time.
Accounting — the session and its commands flow back to PDAccess for the audit record.

TACACS+ is the natural fit because it separates AAA and carries per-command authorization natively. RADIUS covers the environments where it's the standard — wireless, VPN, and a large share of the installed base. Either way, the device's local shared accounts stop being the identity source.

Per-User Identity on Every Device

The payoff is the end of the shared network account:

Every engineer, contractor, and service account is a named identity — authenticated with forced MFA before the session is admitted.
Least privilege, enforced at the protocol level — a junior engineer sees read-only show commands; a senior engineer can configure interfaces; a contractor gets a time-bound, command-restricted session.
One identity across the fabric — the same named user on the network is the same user in the terminal, the database, and the application, because identity proxies (TACACS, RADIUS, LDAP, OAuth2) all feed one platform.
Offboarding is one action — revoke the identity and it stops working on every device at once.

No more "just in case" credentials sitting on devices for years after the person who knew them has left.

Recorded Network Sessions

Accounting is where network access goes from "we hope it was logged" to "here's the recording." Because the session is brokered through PDAccess:

Every command is captured — not just "user logged in," but what was typed, in order, with timestamps.
Sessions are tied to a named identity — the who is unambiguous.
Evidence is generated automatically — audit-ready trails for PCI-DSS, SOX, HIPAA, and ISO 27001 without manual evidence assembly.
One unified audit trail — network sessions sit in the same platform as SSH, RDP/VNC, and database sessions, so an incident that crosses domains is one timeline, not five log files.

One Platform, One Policy, One Audit Trail

The point of treating TACACS+ and RADIUS as identity proxies is consistency. The same policy engine that governs a brokered SSH session governs a network device session. The same identity that authenticates with MFA in the portal authenticates on the switch. The same audit trail covers both.

That means:

Compliance becomes routine — the evidence for "who accessed the network, what did they do, and when" is a query, not a project.
Insider risk is detectable — per-user identity plus command-level recording deters and exposes both malicious and careless actions.
Ops gets faster — access changes are policy edits, not credential rotations across a fleet of devices.

The Bottom Line

Shared network credentials are a breach surface and an audit failure in one. PDAccess eliminates both by using TACACS+ and RADIUS as identity proxies: per-user identity with forced MFA, least privilege enforced at the protocol, and recorded network sessions that feed the same unified audit trail as the rest of the platform. Compliance that actually works — because the evidence is built into every session.