[](https://www.paloaltonetworks.com/idira?ts=markdown) ![x close icon to close mobile navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/x-black.svg) [![Idira logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/idira-logo-dark.svg)](https://www.paloaltonetworks.com/idira?ts=markdown) ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg) * [](https://www.paloaltonetworks.com/idira?ts=markdown) * 解决方案 ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) 解决方案 [人类身份](https://www.paloaltonetworks.cn/idira/human?ts=markdown) * [特权访问管理](https://www.paloaltonetworks.cn/idira/human/privileged-access-management?ts=markdown) * [身份和访问管理](https://www.paloaltonetworks.cn/idira/human/identity-and-access-management?ts=markdown) * [端点特权管理器](https://www.paloaltonetworks.cn/idira/human/endpoint-privilege-manager?ts=markdown) * [身份监管](https://www.paloaltonetworks.cn/idira/human/identity-governance?ts=markdown) * [工作人员密码管理](https://www.paloaltonetworks.cn/idira/human/workforce-password-management?ts=markdown) * [供应商权限访问](https://www.paloaltonetworks.cn/idira/human/vendor-privileged-access?ts=markdown) [机器身份](https://www.paloaltonetworks.cn/idira/machine?ts=markdown) * [机密管理](https://www.paloaltonetworks.cn/idira/machine/secrets-management?ts=markdown) * [统一机密监管](https://www.paloaltonetworks.cn/idira/machine/unified-secrets-governance?ts=markdown) * [发送应用程序凭据](https://www.paloaltonetworks.cn/idira/machine/application-credentials-delivery?ts=markdown) [智能体身份](https://www.paloaltonetworks.cn/idira/agentic?ts=markdown) \[![用 Idira 保护下一批具有自主和自我推理能力的智能体](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/nav-agentic-banner.jpg) 用 Idira 保护下一批具有自主和自我推理能力的智能体 身份在确保人工智能安全方面所发挥的作用\](https://www.paloaltonetworks.cn/idira/agentic ?ts=markdown) * [资源](https://www.paloaltonetworks.com/blog/identity-security/?ts=markdown) * 资源 ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) 资源 资源 * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia/identity-security) * [在线社区](https://live.paloaltonetworks.com/) * [技术文档](https://docs.paloaltonetworks.com) * [支持](https://support.paloaltonetworks.com/Support/Index) * [技术合作伙伴](https://www.paloaltonetworks.com/partners/technology-partners) * [客户成功](https://www.paloaltonetworks.com/idira/customer-stories) * [资源中心](https://www.paloaltonetworks.cn/resources?ts=markdown) * [事件](https://events.paloaltonetworks.com) [博客 获得有关现代威胁和趋势方面的专家见解 了解更多](https://www.paloaltonetworks.com/blog/identity-security/) [Idira 实战记录 了解我们的人工智能平台如何实时阻止威胁。 了解更多](https://www.paloaltonetworks.com/idira/request-demo) [客户案例 了解领先的组织如何应对身份带来的挑战。 了解更多](https://www.paloaltonetworks.com/idira/customer-stories) * 联系我们 ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) 联系我们 联系我们 * [申请演示](https://www.paloaltonetworks.com/idira/request-demo) * [联系我们](https://www.paloaltonetworks.cn/company/company?ts=markdown) * [寻找合作伙伴](https://technologypartners.paloaltonetworks.com/English/directory) * [加入我们的社区](https://live.paloaltonetworks.com/) * * [申请演示](https://www.paloaltonetworks.com/idira/request-demo) ![palo alto networks logo icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default.svg) ![white arrow icon pointing left to return to main Palo Alto Networks site](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) [](https://www.paloaltonetworks.com/idira?ts=markdown) 搜索 Close search modal # Idira Endpoint Privilege Manager ## 任何身份都可能享有特权。96% 的人类身份所拥有的访问权限超出了其角色所需范围。将"零信任"模式扩展至每个端点，以取消永久管理员权限、缩小攻击面，并在源头阻止数据泄露。 * [申请演示](#contact-us) * [了解更多](https://www.paloaltonetworks.com/resources/techbriefs/securing-endpoints-and-servers) 挑战 解决方案 关键能力与特性 优势与价值 客户Idira 实战记录 [挑战](#challenges) [解决方案](#solutions) [关键能力与特性](#key-capabilities) [优势与价值](#benefits) [客户](#customers) [Idira 实战记录](#contact-us) {#challenges} 挑战 ## 削弱您终端防御能力的隐藏风险 在 90% 的数据泄露事件中，身份信息是主要攻击途径。特权过高的用户和永久管理员权限会削弱检测工具的效力，并阻碍"零信任"的实施。要增强韧性，就需要通过自动化、基于策略的最小权限原则来弥合这些差距。 \[持续攻击面 ![持续攻击面](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/ico-01.svg) ### 持续攻击面 本地管理员权限和过度的权限会招致攻击者的入侵。一个被入侵的端点会导致横向移动，从而引发全面数据泄露。 了解风险\](https://www.paloaltonetworks.com/blog/identity-security/why-no-user-should-have-local-admin-rights/) \[安全与生产力之间的僵局 ![安全与生产力之间的僵局](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/ico-02.svg) ### 安全与生产力之间的僵局 移除管理员权限会阻碍工作效率，而一刀切的审批则会破坏安全性。您本不该被迫做出选择。 查看用例\](https://www.paloaltonetworks.com/resources/ebooks/buyers-guide-to-managing-endpoint-privileges) \[策略缺口与工具泛滥 ![策略缺口与工具泛滥](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/ico-03.svg) ### 策略缺口与工具泛滥 管理多样化的终端和服务器会导致策略不一致、报告存在缺口，以及工具泛滥，既复杂又耗资巨大。 统一控制\](https://www.paloaltonetworks.com/resources/whitepapers/eliminating-identity-sprawl-idira-guide-to-modernizing-linux-iam) \[日益加剧的审核和保险压力 ![日益加剧的审核和保险压力](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/ico-04.svg) ### 日益加剧的审核和保险压力 若无法证明已遵循最小权限原则，将导致审核失败、违规带来的处罚以及保险费率飙升。 提高合规性\](https://www.paloaltonetworks.com/resources/whitepapers/how-idira-endpoint-privilege-manager-fulfills-federal-mandates) {#solutions} 解决方案 ## 通过智能权限控制保障终端和服务器安全 Idira^®^ Endpoint Privilege Manager 通过使用精细化、按需提升的权限取代常驻管理员权限，从而缩小攻击面，在保障环境安全的同时，确保业务运营的顺畅高效。 [![积极降低网络安全风险](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/proactively-reduce-cyber-risk.webp)](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/proactively-reduce-cyber-risk.webp?ts=markdown) ## 积极降低网络安全风险 通过移除攻击所依赖的权限，从源头阻止攻击。Idira 用基于策略的、针对特定应用程序和任务的即时权限提升机制，取代了常驻管理员权限。这种零信任方法能够化解威胁，并通过智能权限控制来保障终端和服务器安全。 [了解如何实现](https://www.paloaltonetworks.com/blog/identity-security/the-importance-of-identity-security-in-zero-trust-endpoint-defense/) ## 实现持续合规 从临时抱佛脚式的被动审核准备，转变为可验证的持续合规状态。Idira 提供端点和服务器上特权操作活动的审核日志，使企业能够轻松证明合规性，并通过 NIST、PCI DSS 和 ISO 等框架的审计。 [加强合规](https://www.paloaltonetworks.com/resources/webcasts/strengthen-it-compliance-with-endpoint-privilege-manager) [![实现持续合规](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/achieve-continuous-compliance.webp)](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/achieve-continuous-compliance.webp?ts=markdown) [![提高运营效率](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/drive-operational-efficiency.webp)](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/drive-operational-efficiency.webp?ts=markdown) ## 提高运营效率 让您的 IT 和安全团队摆脱手动权限管理的负担。您可以通过 Idira 基于策略的权限提升来实现流程自动化，从而全面提高效率，并减少与特权相关的工单数量。 [提高效率](https://www.paloaltonetworks.com/resources/webcasts/identity-first-least-privilege-practical-endpoint-control-without-breaking-productivity) ## 增强企业韧性 构建一个能够适应不断变化的风险、同时又不影响业务运营的安全基础。当检测到安全事件时，您的 SOC 可通过采用基于身份的精细化控制措施，在不将整个系统下线的情况下遏制威胁，从而更快、更精准地应对网络威胁。 [增强韧性](https://www.paloaltonetworks.com/resources/webcasts/bridging-security-gaps-with-defense-in-depth-tackling-vulnerabilities-of-siloed-security) [![增强企业韧性](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/strengthen-business-resilience.webp)](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/strengthen-business-resilience.webp?ts=markdown) {#key-capabilities} 关键能力与特性 ## 我们如何为终端上每一个身份保障安全 我们提供智能特权控制方案，这是构建现代零信任架构的基础。Idira EPM 可帮助于撤销不必要的权限、控制和隔离应用程序，并在攻击者站定之前将其阻止，同时确保整个过程对最终用户保持透明。 ![How we secure every identity at the endpoint.](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/endpoint-privilege-manager-key-capabilities.jpg) * 效率 * 安全 * 控制 * 即时访问 * 身份保障 * 恢复能力 选择一个主题效率安全控制即时访问身份保障恢复能力 ### 基于策略的权限提升 针对已获批准的应用程序和任务，按需提升权限，且对用户完全透明。该用户永远不会成为拥有完整权限的管理员，这有助于将风险降至最低。 [安全身份](https://www.paloaltonetworks.com/resources/whitepapers/intelligent-privilege-controls-on-the-endpoint) ### 撤销本地管理员权限 自动发现、撤销和管理整个端点和服务器中长期存在的本地管理员权限，从而显著减少主要攻击途径。 [剥夺攻击者的特权](https://www.paloaltonetworks.com/resources/whitepapers/local-admin-rights-your-biggest-cyber-vulnerability) ### 精细的应用程序控制 不要局限于简单的阻止/允许列表。控制应用程序的执行方式及其可访问的资源，并有助于防止合法软件在攻击中被滥用。 [控类应用](https://www.paloaltonetworks.com/blog/identity-security/modern-application-control-done-right-with-least-privilege/) ### 即时管理员访问权限 对于极少数例外情况，可向用户授予临时且经过全面审核的管理员访问权限，有效期有限，且该权限将在会话结束时自动撤销。 [了解如何实现](https://www.paloaltonetworks.com/resources/ebooks/9-bestpractices-for-workstation-protection) ### 持续身份保障 在进行任何特权提升之前，应通过防止网络钓鱼的多因素身份验证 (MFA) 验证用户身份，以确保请求访问的人员确实是其自称的身份。 [端点多因素身份验证](https://www.paloaltonetworks.com/resources/webcasts/secure-every-human-identity-at-the-endpoint-five-mfa-endpoint-use-cases-from-passwordless-sign-in-to-risky-legacy-applications) ### 基于身份的事件响应 在 EDR/XDR 响应方案中添加精细化的响应选项，包括针对性的特权限制和重新进行身份验证，从而在无需完全隔离系统的情况下遏制威胁。 [遏制威胁](https://www.paloaltonetworks.com/resources/webcasts/bridging-security-gaps-with-defense-in-depth-tackling-vulnerabilities-of-siloed-security) {#benefits} * 274% 3 年内的平均投资回报率可达 274%。 * 74% 平均而言，过度特权账户的数量减少 74%。 * 40% 特权提升的工单数量减少 40%。 优势与价值 ## 身份安全领域的领导者带来的切实成果 提高效率和安全性。IDC 对 Idira Endpoint Privilege Manager 进行的商业价值评估表明，客户能够取得可量化的成果并实现成本节约，从而对利润产生积极影响。 [阅读更多](https://www.paloaltonetworks.com/resources/whitepapers/idc-study-the-business-value-of-idira-endpoint-privilege-manager) {#customers} 客户 ## 深受全球行业领袖信赖，为其最核心的资产保驾护航。 全球领先的企业都信赖 Palo Alto Networks，依靠其保护身份安全，并确保从终端到云端的访问安全。我们很自豪能与他们携手，共同推进其身份安全建设。 [![Northern Trust](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/northern-trust.webp)](https://www.paloaltonetworks.com/customers/northern-trust) [![PDF Health](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/customers/pds-health-white-nospace.svg)](https://www.paloaltonetworks.com/customers/pds-health) [![ECAD](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/ecad.webp)](https://www.paloaltonetworks.com/customers/ecad) [![Repsol Logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/customers/Repsol_logo-white.svg)](https://www.paloaltonetworks.com/customers/repsol) {#contact-us} Idira 实战记录 ## 咨询专家，今天就开始行动。 了解 Idira 如何在企业级层面保障人类的身份安全。在不影响业务运营的情况下降低身份风险。 名字姓氏电子邮件公司职位职位Job RoleSelect a job function手机国家/地区国家/地区状态状态ProvinceProvince邮政编码部门 继续继续 注册即可接收有关 Palo Alto Networks 及其合作伙伴的新闻、产品更新、销售推广、活动信息和特别优惠。 提交此表格，即表示我了解我的个人数据将按照 Palo Alto Networks [隐私政策](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)和[使用条款](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)进行处理。 返回 注册 ## 谢谢大家！ Palo Alto Networks 专家将很快与您联系。期待尽快与您交流！ {#resources} 资源 ## 核心见解和资源 数据表 解决方案简介 电子书 白皮书 网络研讨会 博客 [![Idira Endpoint Privilege Manager](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_1_Resources_idira_ds_endpoint-privilege-manager.png) ![mobile Idira Endpoint Privilege Manager](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_1_Resources_idira_ds_endpoint-privilege-manager.png) 数据表 Idira Endpoint Privilege Manager](https://www.paloaltonetworks.com/resources/datasheets/idira-endpoint-privilege-manager-datasheet) [![IDC Study: The Business Value of Idira Endpoint Privilege Manager](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_2_Resources_IDC_executive-summary-the-business-value-of-cyberark-endpoint-privilege-manager.png) ![mobile IDC Study: The Business Value of Idira Endpoint Privilege Manager](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_2_Resources_IDC_executive-summary-the-business-value-of-cyberark-endpoint-privilege-manager.png) 数据表 IDC Study: The Business Value of Idira Endpoint Privilege Manager](https://www.paloaltonetworks.com/resources/whitepapers/idc-study-the-business-value-of-idira-endpoint-privilege-manager) PreviousNext [![Idira Endpoint Privilege Manager Solution Brief](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_3_Resources_idira_sb_endpoint-privilege-manager-intelligent-controls.png) ![mobile Idira Endpoint Privilege Manager Solution Brief](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_3_Resources_idira_sb_endpoint-privilege-manager-intelligent-controls.png) 解决方案摘要 Idira Endpoint Privilege Manager Solution Brief](https://www.paloaltonetworks.com/resources/techbriefs/idira-endpoint-privilege-manager-solution-brief) [![Idira Endpoint Privilege Manager and Cortex](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/resources/solution-brief.png) ![mobile Idira Endpoint Privilege Manager and Cortex](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/resources/solution-brief.png) 解决方案摘要 Idira Endpoint Privilege Manager and Cortex](https://www.paloaltonetworks.com/resources/techbriefs/cortex-and-idira-endpoint-privilege-manager) PreviousNext [![Buyer's Guide to Managing Endpoint Privileges](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_4_Resources_eBook_Buyers-Guide-Managing-Endpoint-Privileges.png) ![mobile Buyer's Guide to Managing Endpoint Privileges](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_4_Resources_eBook_Buyers-Guide-Managing-Endpoint-Privileges.png) 电子书 Buyer's Guide to Managing Endpoint Privileges](https://www.paloaltonetworks.com/resources/ebooks/buyers-guide-to-managing-endpoint-privileges) [![9 Best Practices for Workstation Protection](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_6_Resources_eBook_nine-best-practices-for-workstation-protection.png) ![mobile 9 Best Practices for Workstation Protection](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_6_Resources_eBook_nine-best-practices-for-workstation-protection.png) 电子书 9 Best Practices for Workstation Protection](https://www.paloaltonetworks.com/resources/ebooks/9-bestpractices-for-workstation-protection) PreviousNext [![How Idira Endpoint Privilege Management Fulfills Federal Mandates](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_7_Resources_whitepaper_how%20endpoint-privilege_mgmt_fulfills_fed_mandates.png) ![mobile How Idira Endpoint Privilege Management Fulfills Federal Mandates](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_7_Resources_whitepaper_how%20endpoint-privilege_mgmt_fulfills_fed_mandates.png) 白皮书 How Idira Endpoint Privilege Management Fulfills Federal Mandates](https://www.paloaltonetworks.com/resources/whitepapers/how-idira-endpoint-privilege-manager-fulfills-federal-mandates) [![Local Admin Rights: Your Biggest Cyber Vulnerability](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_8_Resources_whitepaper_Local-Admin-Rights-Your-Biggest-Cyber-Vulnerability.png) ![mobile Local Admin Rights: Your Biggest Cyber Vulnerability](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_8_Resources_whitepaper_Local-Admin-Rights-Your-Biggest-Cyber-Vulnerability.png) 白皮书 Local Admin Rights: Your Biggest Cyber Vulnerability](https://www.paloaltonetworks.com/resources/whitepapers/local-admin-rights-your-biggest-cyber-vulnerability) [![Enhance Your Security by Extending Zero Trust and Identity Security](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/resources/09_9_Resources_whitepaper_Local-Admin-Rights-Your-Biggest-Cyber-Vulnerability.png) ![mobile Enhance Your Security by Extending Zero Trust and Identity Security](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/resources/09_9_Resources_whitepaper_Local-Admin-Rights-Your-Biggest-Cyber-Vulnerability.png) 白皮书 Enhance Your Security by Extending Zero Trust and Identity Security](https://www.paloaltonetworks.com/resources/whitepapers/enhance-your-security-by-extending-zero-trust-and-identity-security) [![Modernizing Linux Identity - Breaking the Legacy Directory Trap](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_10_Resources_whitepaper_modernizing-linux-identity.png) ![mobile Modernizing Linux Identity - Breaking the Legacy Directory Trap](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_10_Resources_whitepaper_modernizing-linux-identity.png) 白皮书 Modernizing Linux Identity - Breaking the Legacy Directory Trap](https://www.paloaltonetworks.com/resources/whitepapers/modernizing-linux-identity-breaking-the-legacy-directory-trap) PreviousNext [![Strengthen IT Compliance with Endpoint Identity Security](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09-11-resources-webinar-strengthen-it-compliance-with-endpoint-identity-security.png) ![mobile Strengthen IT Compliance with Endpoint Identity Security](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09-11-resources-webinar-strengthen-it-compliance-with-endpoint-identity-security.png) 网络研讨会 Strengthen IT Compliance with Endpoint Identity Security](https://www.paloaltonetworks.com/resources/webcasts/strengthen-it-compliance-with-endpoint-privilege-manager) [![Bridging Security Gaps with Defense-in-Depth Tackling Vulnerabilities of Siloed Security](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_12_Resources_Webinar_Bridging-Security-Gaps.png) ![mobile Bridging Security Gaps with Defense-in-Depth Tackling Vulnerabilities of Siloed Security](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_12_Resources_Webinar_Bridging-Security-Gaps.png) 网络研讨会 Bridging Security Gaps with Defense-in-Depth Tackling Vulnerabilities of Siloed Security](https://www.paloaltonetworks.com/resources/webcasts/bridging-security-gaps-with-defense-in-depth-tackling-vulnerabilities-of-siloed-security) PreviousNext [![The Importance of Identity Security in Zero Trust Endpoint Defense](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_14_Resources_blog.jpg) ![mobile The Importance of Identity Security in Zero Trust Endpoint Defense](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_14_Resources_blog.jpg) 博客 The Importance of Identity Security in Zero Trust Endpoint Defense](https://www.paloaltonetworks.com/blog/identity-security/the-importance-of-identity-security-in-zero-trust-endpoint-defense/) [![Why No User Should Have Local Admin Rights](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_15_Resources_blog.jpg) ![mobile Why No User Should Have Local Admin Rights](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_15_Resources_blog.jpg) 博客 Why No User Should Have Local Admin Rights](https://www.paloaltonetworks.com/blog/identity-security/why-no-user-should-have-local-admin-rights/) [![Why Implementing Identity Security Doesn’t Have to Be Complicated](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_16_Resources_blog.jpg) ![mobile Why Implementing Identity Security Doesn’t Have to Be Complicated](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_16_Resources_blog.jpg) 博客 Why Implementing Identity Security Doesn't Have to Be Complicated](https://www.paloaltonetworks.com/blog/identity-security/why-implementing-identity-security-doesnt-have-to-be-complicated/) [![Skeleton Keys and Local Admin Passwords: A Cautionary Tale](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_17_Resources_blog.jpg) ![mobile Skeleton Keys and Local Admin Passwords: A Cautionary Tale](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/idira/endpoint-privilege-manager/09_17_Resources_blog.jpg) 博客 Skeleton Keys and Local Admin Passwords: A Cautionary Tale](https://www.paloaltonetworks.com/blog/identity-security/skeleton-keys-and-local-admin-passwords-a-cautionary-tale/) PreviousNext {#customers} {#faq} 常见问题解答 ## 关于 Idira Endpoint Privilege Manager 的常见问题解答 Idira Endpoint Privilege Manager (EPM) 是什么？ Idira Endpoint Privilege Manager (EPM) 是一款特权提升与委托管理（PEDM，又称端点 PAM）解决方案，为成熟的端点安全解决方案/堆栈提供了关键组件，通过管理和保护台式机、笔记本电脑及服务器等端点上的权限，帮助组织降低遭受网络攻击的风险。它通过撤销过度的用户权限（如本地管理员权限），并控制哪些应用程序可以运行以及它们可以执行哪些操作，从而贯彻"最小权限"原则。 Idira EPM 如何增强您的安全防护能力？ EPM 通过在 Windows、macOS 和 Linux 系统上撤销本地管理员权限来增强安全性。它用基于策略的特权提升机制，取代了传统的常驻权限，仅允许经过授权的进程提升机制。该解决方案集成了 AD 桥接功能，可集中管理 Linux 身份信息；支持通过无密码选项安全地登录终端设备；并通过精细化的权限限制，而不是全机隔离，供 SOC 响应能力。EPM 还通过应用程序隔离机制来阻止"就地取材"攻击，并有助于为智能体 AI 工具链维持最小权限原则。 为什么选择 EPM 而不是其他 PEDM 产品/解决方案？ Idira EPM 是 Idira Identity Security Platform 不可或缺的一部分： * 真正的基于微服务的云解决方案。 * 单一的管理控制台和单一的智能体。 * 已有数千个实际实施案例，为全世界超大规模的组织提供保护。 * 开箱即用的模板、策略和框架，助您快速上手。 * Idira Blueprint 和 Success Path 框架将最佳实践转化为可操作方案，并简化了实施流程。 * 屡次被行业分析师评为领先解决方案。 Idira EPM 支持哪些操作系统？ Idira EPM 为运行 Windows、Windows Server、macOS 和 Linux 的工作站和服务器提供保护。 Idira EPM 的主要功能有哪些？ EPM 提供了一套全面的功能，用于保护您的终端安全： * 撤销本地管理员权限：安全地撤销用户的永久管理员权限，以最大限度地降低风险。 * 实施最小权限原则：确保用户和应用程序仅拥有执行其功能所需的权限。 * 应用程序控制：采用全面、灵活且基于策略的控制措施，结合精细化的隔离机制，以允许、提升权限、阻止或限制应用程序。未知应用程序可以在"受限模式"（隔离环境）下运行，以防止它们访问敏感资源或互联网。 * 即时 (JIT) 提升：允许用户在需要时，针对特定应用程序或任务申请临时的、可审核的高权限访问，而无需授予其永久的管理员权限。 * 安全的终端登录：支持通过身份提供商（IdP）进行登录，并提供包括无密码在内的现代多因素身份验证（MFA）选项。 支持使用现代的 MFA 选项（包括无密码登录）对接 IdP 进行登录。 * Linux Sudo Management 和 Identity Bridge：集中化并简化了 Linux 系统上 sudo 命令的管理，以便大规模实施基于角色的最小权限原则。将 Linux 与 Active Directory（AD 桥接）中的集中式账户，以及通过开放行业协议 (Identity Bridge) 连接的云身份提供程序进行集成 * 基于身份和特权的 SOC 响应方案：作为 XDR 和 NetSec 的执行引擎，通过降低用户权限，以及验证身份来替代对终端设备的隔离。 EPM 如何处理需要管理员权限才能运行的应用程序？ 一旦撤销本地管理员权限，EPM 会根据策略，自动且透明地为需要相应权限的可信应用程序提升权限，从而在不牺牲安全性的前提下，确保用户保持工作效率，并贯彻最小权限原则。对于未受管理的应用程序，用户可以请求提升权限，该请求随后将接受审核。 EPM 在整体安全堆栈中扮演什么角色？EPM 能否与其他安全工具集成？ 可以。EPM 不仅带来了独特的价值，其设计初衷也是成为更广泛的安全生态系统的一部分。得益于对开放行业标准的支持，以及与技术合作伙伴的集成，EPM 向 SIEM 和 SIAM 解决方案提供身份和权限事件，以实现事件审核的集中化管理。它还作为基于身份和权限的执行引擎，为 XDR、XSOAR 和 NetSec 等解决方案提供支持，用于验证终端用户身份、降低用户权限并限制用户可使用的应用程序。 部署 Idira EPM 有多容易？ EPM 旨在实现快速部署并迅速创造价值。该产品以 SaaS 解决方案的形式提供，因此无需本地部署的基础设施。它还包含一组开箱即用的默认策略（快速入门策略），只需稍加配置即可激活，通过撤销本地管理员权限、保护凭据以及防范勒索软件，立即降低风险。Palo Alto Networks 还提供了一份经过实践检验的身份安全部署路线图，名为"Idira Blueprint"，旨在复制并扩展多年来众多企业部署所取得的成功。 Idira EPM 如何与 Linux 配合使用？ EPM 帮助将 Linux 与 Active Directory 或现代云目录中的集中式账户进行集成，允许用户使用相同的 Directory 账户登录 Linux，并支持防范网络钓鱼的强 MFA 及现代身份验证方法。EPM 还能帮助集中化和自动化管理 sudo 规则，从而无需再手动编辑 sudoers 文件，避免了由此可能引发的错误。通过"学习模式"，EPM 可以识别用户需要哪些特权命令以及原因，从而使管理员能够针对所有 Linux 系统创建并实施基于角色的精细化策略，以实现最低权限访问。 EPM 能否帮助满足合规要求？如何帮助？ 可以。通过贯彻最小权限原则、撤销本地管理员权限，并为所有特权操作提供详细的审计日志，EPM 帮助组织满足各项联邦法规和行业监管要求。它符合 NIST Cybersecurity Framework、MITRE ATT\&CK® 等安全框架，并支持 Executive Order (EO) 14028 等指令所概述的零信任架构的核心原则。 Show more + {#footer} 产品和服务 * [实时人工智能驱动的网络安全](https://www.paloaltonetworks.cn/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.cn/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.cn/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.cn/sase/ai-access-security?ts=markdown) * [云交付的安全服务](https://www.paloaltonetworks.cn/network-security/security-subscriptions?ts=markdown) * [高级威胁预防](https://www.paloaltonetworks.cn/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.cn/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.cn/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.cn/network-security/advanced-dns-security?ts=markdown) * [企业数据丢失防护](https://www.paloaltonetworks.cn/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.cn/network-security/enterprise-iot-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.cn/network-security/medical-device-security?ts=markdown) * [工业 OT 安全](https://www.paloaltonetworks.cn/network-security/industrial-ot-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.cn/sase/saas-security?ts=markdown) * [新一代防火墙](https://www.paloaltonetworks.cn/network-security/next-generation-firewall?ts=markdown) * [硬件防火墙](https://www.paloaltonetworks.cn/network-security/hardware-firewall-innovations?ts=markdown) * [软件防火墙](https://www.paloaltonetworks.cn/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.cn/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.cn/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.cn/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.cn/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.cn/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.cn/sase?ts=markdown) * [应用加速](https://www.paloaltonetworks.cn/sase/app-acceleration?ts=markdown) * [自主数字体验管理](https://www.paloaltonetworks.cn/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.cn/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.cn/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.cn/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.cn/sase/sd-wan?ts=markdown) * [远程浏览器隔离](https://www.paloaltonetworks.cn/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.cn/sase/saas-security?ts=markdown) * [基于 AI 的安全运营平台](https://www.paloaltonetworks.cn/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.cn/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.cn/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.cn/cortex/cloud/application-security?ts=markdown) * [云态势安全](https://www.paloaltonetworks.cn/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.cn/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.cn/prisma/cloud?ts=markdown) * [人工智能驱动的 SOC](https://www.paloaltonetworks.cn/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.cn/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.cn/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.cn/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.cn/cortex/cortex-xpanse?ts=markdown) * [Unit 42 托管检测和响应](https://www.paloaltonetworks.cn/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.cn/cortex/managed-xsiam?ts=markdown) * [新一代身份安全](https://www.paloaltonetworks.cn/idira?ts=markdown) * [特权访问管理](https://www.paloaltonetworks.cn/idira/human/privileged-access-management?ts=markdown) * [身份和访问管理](https://www.paloaltonetworks.cn/idira/human/identity-and-access-management?ts=markdown) * [端点特权管理器](https://www.paloaltonetworks.cn/idira/human/endpoint-privilege-manager?ts=markdown) * [身份监管](https://www.paloaltonetworks.cn/idira/human/identity-governance?ts=markdown) * [工作人员密码管理](https://www.paloaltonetworks.cn/idira/human/workforce-password-management?ts=markdown) * [智能体身份](https://www.paloaltonetworks.cn/idira/agentic?ts=markdown) * [机密管理](https://www.paloaltonetworks.cn/idira/machine/secrets-management?ts=markdown) * [统一机密监管](https://www.paloaltonetworks.cn/idira/machine/unified-secrets-governance?ts=markdown) * [应用程序凭证交付](https://www.paloaltonetworks.cn/idira/machine/application-credentials-delivery?ts=markdown) * [供应商特权访问](https://www.paloaltonetworks.cn/idira/human/vendor-privileged-access?ts=markdown) * [威胁情报和事件响应服务](https://www.paloaltonetworks.cn/unit42?ts=markdown) * [主动评估](https://www.paloaltonetworks.cn/unit42/assess?ts=markdown) * [事件响应](https://www.paloaltonetworks.cn/unit42/respond?ts=markdown) * [转变您的安全策略](https://www.paloaltonetworks.cn/unit42/transform?ts=markdown) * [发现威胁情报](https://www.paloaltonetworks.cn/unit42/threat-intelligence-partners?ts=markdown) 公司 * [关于我们](https://www.paloaltonetworks.cn/about-us?ts=markdown) * [人才招聘](https://jobs.paloaltonetworks.com/en/) * [联系我们](https://www.paloaltonetworks.cn/company/contact-sales?ts=markdown) * [企业责任](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [客户](https://www.paloaltonetworks.cn/customers?ts=markdown) * [投资者关系](https://investors.paloaltonetworks.com/) * [位置](https://www.paloaltonetworks.com/about-us/locations) * [新闻资讯](https://www.paloaltonetworks.cn/company/newsroom?ts=markdown) 热门链接 * [博客](https://www.paloaltonetworks.com/blog/?lang=zh-hans) * [社区](https://www.paloaltonetworks.com/communities) * [内容库](https://www.paloaltonetworks.cn/resources?ts=markdown) * [网络百科](https://www.paloaltonetworks.com/cyberpedia) * [事件中心](https://events.paloaltonetworks.com/) * [管理电子邮件首选项](https://start.paloaltonetworks.com/preference-center) * [产品清单](https://www.paloaltonetworks.cn/products/products-a-z?ts=markdown) * [产品认证](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance) * [报告漏洞](https://www.paloaltonetworks.com/security-disclosure) * [网站地图](https://www.paloaltonetworks.cn/sitemap?ts=markdown) * [技术文档](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [请勿出售或分享我的个人信息](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [隐私](https://www.paloaltonetworks.com/legal-notices/privacy) * [信任中心](https://www.paloaltonetworks.com/legal-notices/trust-center) * [使用条款](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [文档](https://www.paloaltonetworks.com/legal) 版权所有 © 2026 Palo Alto Networks。保留所有权利 * [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://unit42.paloaltonetworks.com/unit-42-threat-vector-podcast/) * CN Select your language