What is CyberArk PAM?
CyberArk PAM(Privileged Access Management) is a solution used
to manage the Privileged accounts/admin accounts in a securely
manner.
• Identity Management
Basics of • Access Management
IAM/PAM
• PAM (Privilege Access Management)
What is Privilege Access?
Privileged access refers to accounts with elevated permissions or
capabilities that allow users to perform tasks that are beyond the
scope of regular users. These tasks can include:
• Configuring systems and software
• Creating, modifying, or deleting user accounts
• Installing and uninstalling software
• Backing up, updating, modifying, or deleting data
• Carrying out security and corrective actions
Risks Associated with
Privileged/Admin Accounts
• Password itself is a problem.
• Non-Secure RDP connections
• No Monitoring
• Unauthorized Access
• No accountability
Why PAM 1. Easy to manage Privilege account password-
• No visibility of password
solution • Frequent password rotation
tool like • Push complex password
CyberArk
is 2. Monitoring- Each and every sessions will be
recorded in Video/text logs format.
needed?
3. Stops the unauthorized access
4. Secure RDP/SSH connection
5. Centralized Audit
CyberArk
Thycotic Secret server
Various
BeyondTrust Password Safe
PAM tools
available Centrify Privilege Access Management
in market One Identity Safeguard
Arcon Privileged Access Management
Hashicorp Vault
Delinea PAM
Main Components of CyberArk
1. Vault (EPV/Digital Vault)
2. PVWA (Password vault web access)
3. CPM (Central Policy Manager)
4. PSM (Privileged Session Manager)
Some of the on-demand components-
AIM, CP, CCP, EPM, Conjur,PSMP
Role of CyberArk
Components
1. Vault Server-
A secure server
used to store
privileged
account
information. It is
based on a
hardened
windows server
platform.
2. PVWA (Password vault web access)
PVWA provided a web interface Users can connect to the PVWA Also used by Vault administrators
that allows authorized users to using a web browser. to configure policies
access the privileged account
information securely.
3. CPM (Central Policy Manager)
The CPM is responsible for password management-
• How often to change the password
• Password complexity
• How to change the password (WMI, SSH etc)
• Can manage passwords for various platforms
The CPM is also responsible for automatic accounts discovery
4. PSM (Privileged Session
Manager)
CyberArk Privileged Session The solutions acts as a jump
Manager, enables organizations server and single access control
to isolate, monitor, record and point, prevents malware from
control privileged sessions on jumping to a target system, and
critical systems including Unix records keystrokes and
and Windows- based systems, commands for continuous
databases and virtual machines. monitoring.
Pros and Cons of
CyberArk
Pros:
1 2 3 4 5
1) Enhanced security: 2) Automation: CyberArk 3) Compliance: CyberArk 4) Integration: CyberArk 5) Visibility and control:
CyberArk provides a highly automates the process of helps organizations comply integrates with a variety of CyberArk provides complete
secure environment for managing and rotating with industry regulations systems and platforms, visibility and control over
managing and protecting privileged credentials, and standards, such as providing a unified and privileged accounts, enabling
privileged credentials, reducing the risk of human PCI DSS, HIPAA, and others. streamlined security organizations to monitor and
reducing the risk of data error and improving solution. manage access in real-time.
breaches and unauthorized efficiency.
access.
Cons:
1) Complex implementation: CyberArk can be complex to implement
and requires significant technical expertise to set up and maintain.
2) High cost: CyberArk can be expensive, especially for smaller
organizations with limited resources.
3) Resource-intensive: CyberArk requires a significant amount of
hardware and software resources to run effectively.
4) Requires ongoing maintenance: CyberArk requires ongoing
maintenance and updates to stay secure and effective.
Conclusion
Thank You All…..for giving your
valuable time
