Securing Privileged Access and Non-Human Identities Across NHS Trusts: A Practical Guide

The NHS attack surface has changed dramatically. Accelerated digital transformation, increased reliance on third-party suppliers, cloud-hosted systems and automation have introduced a sprawling identity layer that most Trusts have not kept pace with from a security controls perspective.

Privileged access management (PAM) is not a new concept, but the scope of what needs to be managed has expanded well beyond the traditional definition of "admin accounts." Today, service accounts, API keys, machine credentials, bots and automated pipelines, collectively referred to as non-human identities (NHIs), represent one of the fastest-growing and least-controlled attack vectors in NHS environments.

This post sets out a practical framework for IT security professionals working in NHS Trusts who are looking to get a handle on both human privileged access and the expanding NHI estate.

Why the Identity Layer Is Now the Primary Target

Perimeter-based defences have matured to the point where attackers are increasingly pivoting to identity as the path of least resistance. Stolen or abused credentials, whether belonging to a human or a machine, allow attackers to move laterally within a network while appearing legitimate to monitoring tools.

In healthcare environments, this is particularly dangerous. Clinical systems, patient data repositories, imaging infrastructure and operational technology (OT) networks are often interconnected in ways that were designed for availability, not least-privilege access. An attacker who compromises a service account with excessive standing access can traverse environments that were never intended to be accessible from a single entry point.

NHS Trusts face additional complexity:

• Large estates of legacy systems that cannot be easily patched or reconfigured
• High staff turnover creating orphaned accounts
• Significant dependence on third-party suppliers with remote access requirements
• Operational pressure of maintaining 24/7 uptime for patient safety-critical systems

Understanding Your Non-Human Identity Exposure

Before you can control NHIs, you need to know what you have. Most Trusts that begin a PAM programme quickly discover that their NHI count significantly exceeds their human account count. Service accounts for monitoring tools, backup agents, middleware, integration engines and clinical applications accumulate over years. Many were created by third-party suppliers during implementation and never handed back or decommissioned.

Key Discovery Questions

• Which service accounts exist in Active Directory, and what privileges does each hold?
• Which accounts have passwords that have never rotated, or were set at creation and never changed?
• Which NHIs have standing access to sensitive systems outside of a scheduled maintenance window?
• Which third-party suppliers currently hold credentials with elevated access, and when was that access last reviewed?
• Are secrets (API keys, connection strings, certificates) stored in plain text within scripts, configuration files or deployment pipelines?

Tooling like Delinea's Secret Server can automate much of this discovery process, pulling from Active Directory, local systems and integrated platforms to build an inventory of privileged accounts and credentials. But even before tooling is in place, a manual audit scoped to your most critical systems, EPR, imaging, network infrastructure, is a valuable starting point.

The Core PAM Controls That Matter Most

Once you have visibility, the priority is to apply controls that reduce standing access and enforce accountability. The following are the controls that deliver the most risk reduction in NHS environments, in rough order of impact.

1. Credential Vaulting and Automated Rotation

The single highest-value control for most Trusts is removing static, long-lived credentials from unmanaged storage and placing them under a vault with automated rotation. This applies to both human privileged accounts and NHIs.

A service account password that has not changed in three years and is embedded in a configuration file shared across a team SharePoint site is an incident waiting to happen.

Vaulting centralises credential storage, enforces rotation policies and creates an audit trail of every access event. For NHIs, modern PAM platforms support dynamic secrets, credentials issued just-in-time for a specific task and automatically revoked on completion, meaning there is nothing persistent to steal.

When implementing rotation, start with accounts that have access to your most sensitive data and critical infrastructure. Avoid the common mistake of rotating everything at once without testing. In complex NHS environments, broken service dependencies are a real risk that needs to be managed through phased rollout and thorough pre-rotation dependency mapping.

2. Just-in-Time Access and Zero Standing Privilege

Zero standing privilege (ZSP) is the principle that no account, human or non-human, should hold elevated access permissions on a persistent basis. Access is granted on demand, scoped to the specific task and revoked automatically when that task is complete.

For NHS IT teams, the practical implementation of ZSP looks like this:

• An engineer who needs to perform a change on a clinical server requests access through the PAM platform
• The request triggers an approval workflow, or is auto-approved based on policy for lower-risk tasks
• The session is launched with time-limited credentials
• Full session recording captures everything that happens
• At the end of the session, the access is revoked

This approach dramatically reduces the impact of compromised credentials because there is no persistent privileged session to hijack. It also provides the audit trail required for Cyber Assessment Framework (CAF) alignment and DSPT evidence submissions. Every privileged action is attributable to a specific individual at a specific time.

3. Secrets Management in DevOps and Automation Pipelines

NHS Trusts are increasingly running automated processes, deployment pipelines, integration workflows, scheduled tasks, that require credentials to function. The insecure default is to hard-code secrets into scripts or store them in environment variables that are not adequately protected.

A secrets management platform integrated into your pipeline tooling (whether that is Azure DevOps, Ansible or custom scripting) allows secrets to be retrieved programmatically at runtime without ever being stored in the pipeline configuration itself. This eliminates the risk of secrets being exposed through code repositories, pipeline logs or configuration backups.

The practical starting point here is an audit of your existing automation estate. Identify every script and pipeline that contains a hard-coded credential and prioritise migration to a secrets manager based on the sensitivity of what that credential can access.

4. Third-Party and Remote Access Controls

Supplier access is one of the most significant and most difficult to manage privileged access risks in NHS environments. Clinical system suppliers, network support vendors and infrastructure partners typically require remote privileged access to fulfil their contracts, but that access is often granted via shared credentials, long-lived VPN accounts or direct RDP access without session recording.

A PAM platform with privileged remote access capabilities allows you to broker supplier sessions through a controlled gateway: suppliers authenticate through the PAM platform, their sessions are recorded and their access is scoped to the specific systems they need. Access can be time-limited and linked to a specific change request or maintenance window.

This approach also helps when a supplier relationship ends. Rather than hunting down every system they had access to and manually revoking credentials, you disable their PAM account and access is removed centrally.

5. Least Privilege Enforcement on Endpoints

Many NHS workstations still operate with local administrator rights, either because it was the default when the estate was built or because clinical applications require elevated permissions to function. This creates significant risk. Any malware or attacker who gains code execution on an endpoint immediately has local admin capability.

Privilege management tooling can enforce least-privilege on endpoints while allowing specific applications to run with elevated rights without granting persistent admin access to the user. Application control policies can be built around your specific clinical software estate, allowing IT to progressively remove local admin from workstations without impacting clinical workflows.

Aligning to DSPT and CAF Requirements

For most NHS Trusts, PAM improvements are not just a security priority. They are an assurance and compliance requirement. The NHS Data Security and Protection Toolkit (DSPT) and the Cyber Assessment Framework (CAF) both have explicit requirements around privileged access management.

CAF Objective B (Protecting Against Cyber Attack) and Objective C (Detecting Cyber Security Events) both reference the need for controlled privileged access and the ability to audit privileged user activity. Meeting these requirements with evidence requires the kind of session recording, access logging and credential management that a mature PAM implementation provides.

When building your business case for PAM investment, mapping the controls to specific DSPT mandatory evidence items and CAF indicators of good practice makes the case in terms that Boards and DSNs understand: reduced risk, improved assurance ratings and demonstrable compliance.

Our DSPT and CAF framework guide walks through how these requirements map across a typical Trust environment.

Practical Quick Wins for Stretched Security Teams

Not every Trust has the resource to run a large-scale PAM programme immediately. These are the quick wins that deliver meaningful risk reduction without requiring full platform deployment.

Where to Go Next

If your Trust is starting or maturing a PAM programme, the most important thing is to begin with visibility. You cannot protect what you cannot see, and the NHI discovery exercise alone typically surfaces enough findings to justify further investment.

If you want to discuss your Trust's specific situation before or after the webinar, feel free to get in touch directly. Our cyber programme leadership and technical consultancy teams support NHS organisations across the full PAM lifecycle, from discovery and business case through to platform deployment and operating model.

By Dan Connolly, Consultant, DLC Tech Solutions