Category: CyberArk

CyberArk PAM Master Policy

Posted on by Supreeth Avula in CyberArk, Technology

The Master Policy

Managing and securing privileged access across diverse IT environments is complex and prone to vulnerabilities. Without a centralized approach, inconsistencies in policy enforcement can lead to security breaches and compliance issues.

Using CyberArk’s PAM Master Policy helps standardize and enforce security and compliance policies consistently across all platforms, reducing the risk of unauthorized access and enhancing overall security.

CyberArk’s PAM Master Policy offers a simple and intuitive way to manage an organization’s security policy.

The Master Policy enables us to configure the security and compliance policy of privileged accounts in an organization from a single pane of glass. It allows us to configure compliance-driven rules, which will be defined as the baseline for the organization.

Master Policy: Rules

The Master policy is divided into four higher-level and compliance-driven policy sections, such as:

  1. Privileged Access Workflows
  2. Password Management
  3. Session Management
  4. Audit

Each of the above sections has a set of rules and offers better visibility and control over policy configurations and enforcement.

Master policy rules
Image: Rules of the Master Policy

Master Policy: Exceptions

Master policy settings, when configured, can be applied to most privileged accounts in the organization. However, a few privileged accounts may need to deviate from these global settings for various reasons. We can create exceptions for the accounts that need to deviate from the configured global settings.

Master Policy: Presentation

The following video will explain CyberArk PAM’s Master Policy and it’s rules in detail. Below are the topics covered as part of this video:

  • The Master Policy
  • Master Policy: Main Concepts
  • Master Policy: Rules
  • Master Policy: Configuring a Rule
  • Privileged Access Workflows
  • Password Management
  • Session Management
  • Audit
  • Exceptions
  • Combining Privileged Access Workflows
CyberArk PAM Master Policy: Technical Presentation

Master Policy: Technical Demostration

The following video will provide a detailed technical demonstration on configuring the Master Policy:

CyberArk PAM Master Policy: Technical Demonstration

Conclusion

In conclusion, managing privileged access across diverse IT environments is complex and prone to vulnerabilities. The CyberArk’s PAM Master Policy standardizes and enforces security and compliance policies, reducing the risk of unauthorized access. 

ENH iSecure plays a crucial role in this ecosystem by providing comprehensive support and expertise in implementing and managing CyberArk’s PAM Master Policy. With ENH iSecure, organizations can ensure that their privileged access management is not only effective but also aligned with industry best practices and compliance requirements.

SailPoint IdentityIQ Applications Credential Cycling Using PAM Solution

Posted on by Chaitanya Malladi in CyberArk, Identity Governance, Sailpoint, Technology

A large number of applications on SailPoint IdentityIQ rely on using service accounts to communicate with the application targets. These accounts have the authorizations to perform identity management tasks and should be treated as privileged accounts. When a privileged account management solution like CyberArk or BeyondTrust is used in the organisation, the credentials of the privileged account would be stored on the PAM solution and retrieved by IdentityIQ whenever required. The feature of credential cycling introduced in IdentityIQ 7.3 allows this to be configured with ease.

 

The following presentation discusses the need for credential cycling and how it works:

The following demonstration illustrates a use case where credential cycling is configured with the CyberArk PAM solution:

The next video demonstrates credential cycling when configured with the Thycotic Secret Server PAM solution:

Integrating CyberArk with SailPoint using SCIM

Posted on by Sandilya Krovvidi in CyberArk, Identity Governance, Sailpoint, Technology

Privileged accounts are considered to be “keys to the kingdom” in any IT Infrastructure. Almost every cyber attack that has ever happened involved compromises at the privileged account level. PAM Solutions usually help in managing such accounts, keys or files that would lead to escalated access.

CyberArk is the global leader in PAM solutions with a holistic approach towards privileged account management. It covers not only traditional PAM problems but also extends its capabilities with various features like managing hard-coded application credentials, analytics, on-demand privileges escalation and managing end-user devices like desktops.

Securing and streamlining identity and privileges data present with such solutions is of very high importance.

In the following presentation, we provide a detailed overview of CyberArk integration with SailPoint by integrating Cyberark as a SailPoint’s application.

In the following video, we provide a detailed demo of this integration.

CyberArk Privileged Account Security Architecture

Posted on by Chaitanya Malladi in CyberArk, Identity Governance, Technology

Privileged accounts on a system possess higher authorizations and control. These accounts pose a higher risk if they are compromised. Privileged Identity Management solutions aim to address this by providing security and control over these accounts. CyberArk is a major provider that offers privileged account security and is backed by a patented vaulting technology. CyberArk enables organizations to secure, provision, manage, control and monitor activities associated with privileged accounts.

The following presentation describes privileged account security and the architecture of a CyberArk implementation. The various components of the CyberArk architecture and their functionalities are also discussed.

 

Integrating CyberArk’s PAS Solution With DUO’s 2FA

Posted on by Vishal Kuruganti in CyberArk, Identity Governance, Technology

CyberArk’s PAS solution uses the Password Vault Web Access System which provides the method by which users request passwords and high-level administrators approve the requests. Access to this system should be as secure as possible. Integrating with a multi-factor authentication system like Duo would make the login process more secure by authenticating the user based on LDAP password as well as the response received by the Duo Authentication Proxy using Duo Push setup on the user’s mobile device.

In the current demo, an LDAP user with the name “testuser” is created on the Active Directory Domain Controller as well as the DUO instance.

Once the accounts have been created, the DUO Authentication Proxy is setup and is configured as the primary LDAP host for authentication.

The Duo Authentication Proxy is a service that runs either on Windows or Linux. It is configured by using the file authproxy.cfg 

The details of the Duo instance and the details of the LDAP server which is being used for primary authentication are configured in authproxy.cfg

The firewall must allow outbound traffic to the Duo instance using HTTPS.

Only on successful primary and secondary authentication, access to the PVWA is granted.

Split Brain Scenario in CyberArk

Posted on by Chaitanya Malladi in CyberArk, Identity Governance, Technology

In high availability clustering, split-brain is a problem scenario that can occur when one of the nodes fails. Within a CyberArk implementation with disaster recovery enabled, a split-brain condition might arise if high availability is not configured as per the recommendations.

The following presentation discusses split-brain scenario in a CyberArk implementation and how it can be resolved:

Securing IIQ SPAdmin Account Using CyberArk PAM

Posted on by Chaitanya Malladi in CyberArk, Identity Governance, Sailpoint, Technology

In an enterprise, a large number of privileged accounts are spread over various applications and systems. These accounts have higher authorizations and hence need to be handled with higher security. CyberArk‘s Privileged Account Management solution is targeted at achieving this.

In SailPoint IdentityIQ, accounts can have the highest privilege in form of the ‘System Administrator’ capability. The ‘spadmin’ account that comes out-of-the-box is configured to have this privileged access. This account, if managed by the CyberArk PAM solution, improves safety of the IdentityIQ environment.

 

The following presentation discusses this use case and how it can be implemented using CyberArk PAM:

The following video demonstrates the use-case in action for verifying and changing spadmin password from CyberArk and initiating privileged sessions:

https://www.youtube.com/watch?v=4qRujyxiUBM