Home
[!NOTE] Unofficial & no fabrication. A community study compilation, not a vendor publication. Every factual claim is tied to an official document or reputable source (cited per page); unknowns are marked “not specified in sources.” Structural quality (valid links, Mermaid, sources) is enforced in CI.
💡 Why PAM — and why a sysadmin is already halfway there¶
Most breaches don't start with a zero-day; they start with a stolen or abused privileged credential — a domain admin, a root login, a service account, an SSH key. PAM is the discipline that vaults those secrets, brokers and records every privileged session, and enforces least privilege. It sits at the centre of identity security, and demand is driven by regulation (NIS2, DORA, ISO 27001).
For a systems administrator, that's the good news: the hard prerequisites — Active Directory, Linux, SSH/RDP, networking, certificates — are your day job. You're not starting over; you're re-pointing skills you already have at access security. This repo turns that head start into a certification and a specialization.
| Your sysadmin skill | Becomes, in PAM… |
|---|---|
| AD / LDAP / group management | Identity sources, authorization models, least privilege |
| SSH / RDP / jump hosts | Session brokering, proxying, recording, credential injection |
| Service accounts & scripts | Secret vaulting, rotation, app-to-app password management |
| Logging & monitoring | Session audit, SIEM correlation, non-repudiation |
➡️ Start with the why: What is PAM? · The threat landscape · Is PAM a good move for a sysadmin?
The PAM learning path (your main track)¶
A deliberate, end-to-end route. Walk it in order — each phase builds on the last. Durations are suggested estimates, not requirements; go at your own pace.
flowchart TB
P0["Phase 0 · Understand PAM<br/>foundations/ — the why & what"]
P1["Phase 1 · Bridge your skills<br/>prerequisites/ + protocols/<br/>Linux · AD · networking · crypto<br/>Kerberos · TLS · SAML"]
P2["Phase 2 · Specialize & certify<br/>certs/wallix/ — product portfolio<br/>WCA-P → WCP-P + deep dives + labs"]
P3["Phase 3 · Master PAM<br/>WCE-P (Expert)<br/>+ OT / IDaaS / IAG tracks"]
P4["Phase 4 · Broaden your value<br/>Security+ · CySA+<br/>attacker context<br/>cloud · CISSP"]
P0 --> P1 --> P2 --> P3 --> P4
ATT["⚔️ Attacker context (CEH / PenTest+)<br/>makes you a better PAM defender"] -.-> P3| Phase | Goal | Work through | Suggested time |
|---|---|---|---|
| 0 · Understand PAM | Know why privileged access is the crown jewel and how PAM defends it | foundations/ — what PAM is, privileged accounts, threat landscape, least-privilege/JIT/Zero-Trust, the IAM/IGA/IDaaS/EPM map | ~2–4 weeks |
| 1 · Bridge your skills | Convert sysadmin knowledge into the security fundamentals PAM rests on | prerequisites/ (Linux, Windows/AD, networking, crypto/PKI) + protocols/ (how Kerberos, TLS, SAML, LDAP, RADIUS, SSH actually work) | ~3–6 weeks |
| 2 · Specialize & certify | Learn the leading European PAM product and earn your first certs | WALLIX hub: product portfolio → WCA-P → WCP-P, backed by the deep dives and labs | ~2–4 months |
| 3 · Master PAM | Go to Expert and cover the wider suite | WCE-P + the advanced deep dives (HA/DR, REST API, troubleshooting) + the OT / IDaaS / IAG tracks | ongoing |
| 4 · Broaden your value | Round out a hireable cybersecurity profile around the PAM core | Complementary certs below | ongoing |
🧰 Practise as you go — the learning platforms page maps the best free & paid hands-on platforms to each phase, and the WALLIX labs walk through real exercises. See the full career roadmap for the bigger picture.
🎓 The WALLIX certification ladder (the heart of Phase 2–3)¶
Three progressive levels per product track. Code format WC{level}-{track}; an e prefix means
e-learning. Exam model: a final multiple-choice exam requiring 70% to pass. Full detail in the
certification framework.
flowchart LR
WCA["WCA-P · Administrator<br/>understand & operate"] --> WCP["WCP-P · Professional<br/>deploy & administer"] --> WCE["WCE-P · Expert<br/>advanced & complex"]| Track | Product | Administrator | Professional | Expert |
|---|---|---|---|---|
| PAM / Bastion | WALLIX Bastion | WCA-P | WCP-P | WCE-P |
| IAG | WALLIX IAG | WCA-G (soon) | WCP-G | — |
| IDaaS | WALLIX One IDaaS (Trustelem) | — | WCP-I | — |
| OT | WALLIX PAM4OT | — | eWCP-P-OT | — |
Behind the certs sit 13 technical deep dives of the WALLIX suite — Bastion architecture, the ACL data model, sessions, secrets, authentication, HA/DR, the REST API, PAM4OT, IDaaS, IAG, EPM, and WALLIX One.
Broaden your value: the other certs worth your time¶
PAM is the spine; these make you a rounder, more hireable security professional. Each is a full study hub built to the same standards. The key idea: understanding the attacker makes you a far better PAM defender — so the offensive hubs aren't a detour, they're context. The attack → defense matrix maps common attacks (with MITRE ATT&CK IDs) straight to the PAM controls that stop them.
| When | Cert | Why it complements PAM |
|---|---|---|
| Before / alongside Phase 2 | Security+ (SY0-701) | The vendor-neutral baseline that clears HR filters and gives you the security vocabulary |
| After you're comfortable in PAM | CySA+ (CS0-003) | Blue-team / SOC detection & response — read the telemetry your PAM sessions generate |
| For attacker context | CEH (v13) · PenTest+ (PT0-003) | Understand credential theft, Pass-the-Hash, Kerberoasting, lateral movement — exactly what PAM defends |
| To prove hands-on offense | PNPT (TCM) → OSCP (OffSec) | Real engagements; AD-attack skill that maps one-to-one onto PAM defenses |
| To go senior / cloud | CISSP · Cloud security | Management breadth and securing privileged cloud identities |
⚠️ The offensive hubs (CEH, PenTest+, OSCP, PNPT) are educational and defense-oriented: techniques are explained conceptually and paired with countermeasures, for authorized use only.
See certs/ for the full index of every hub.
📚 What's inside¶
flowchart LR
subgraph SHARED["🧱 Shared knowledge (root)"]
FND["foundations/<br/>PAM concepts · threats"]
PRE["prerequisites/<br/>Linux · AD · net · crypto"]
PRO["protocols/<br/>Kerberos · TLS · SAML · …"]
REF["reference/ · learning/"]
end
subgraph CERTS["🎓 certs/ — every hub"]
WAL["wallix/ — WALLIX / PAM (primary)"]
OTH["ceh/ · security-plus/ · cysa-plus/<br/>pentest-plus/ · oscp/ · pnpt/<br/>adjacent-certs/"]
end
SHARED --> CERTS
XC["⚔️🛡️ attack-to-defense-matrix.md"]- Shared knowledge (root): foundations/ · prerequisites/ · protocols/ · reference/ (glossary, acronyms, compliance, sources) · learning/ (roadmap, platforms)
- Certification hubs: certs/ — wallix/ (primary) · ceh/ · security-plus/ · cysa-plus/ · pentest-plus/ · oscp/ · pnpt/ · adjacent-certs/
- The bridge: attack-to-defense-matrix.md
✅ How this repo is built¶
- No fabrication — every claim is cited or marked “not specified in sources”; uncertainties stay flagged.
- Diagrams are Mermaid, never ASCII art — they render as real graphics on GitHub and the site.
- Quality is CI-enforced — every push runs
scripts/check-docs.py: no ASCII, valid Mermaid (boxes sized to fit text), a Sources section per page, and zero broken internal links. See MAINTENANCE.md. - Every page ends with a Sources list; the whole repo renders as a searchable site.
🔗 Quick links¶
- 🌐 Live documentation site
- 🎓 WALLIX Academy · 📘 Training catalog 2025–2026 (PDF)
- 🧭 Career roadmap · 🧰 Learning platforms
- 🧠 Glossary · Acronyms · 📚 Sources
🤝 Contributing & license¶
Contributions welcome — see CONTRIBUTING.md (the no-fabrication rule, Mermaid-only diagrams, page conventions, and the verification checklist). Report errors via a content-correction issue. Licensed under MIT.
Not affiliated with or endorsed by WALLIX, EC-Council, CompTIA, OffSec, or TCM Security. “WALLIX”, “Bastion”, “Trustelem”, “CEH”, “Security+”, “OSCP”, “PNPT” and related names are trademarks of their respective owners, used here for identification and educational purposes only. Offensive content is for authorized, educational use only.