chapter 10 Flashcards
Privileged Session Management
Provides 3 Main Benefits:
1. (blank) - separate endpoints from critical target systems to prevent lateral movement
2. (blank) - detect and track suspicious activities in privileged sessions and events in real time
3. (blank) - support forensic analysis and audit with detailed records of privileged activity
isolation
monitoring
recording
When we talk about PSM, the (blank), we are usually referring to the PSM installed on a Windows server.
You can think of this as the “Universal PSM” because you can
connect through it practically from
any device to any device.
Privileged Session Manager
The (blank) enables
organizations to secure,
control, and monitor privileged access to network devices
* It creates detailed session audits and video recordings of all IT administrator privileged
sessions on remote machines
* Sessions on the target
systems are fully isolated and the privileged account credentials are never exposed to the end-users or their client
applications and devices
PSM
what is this?
- Logon through PVWA
- Connect to PSM using RDP/TLS
- Fetch credential from Vault
- Connect using native protocols
- Logs forwarded to SIEM and PTA
- Store session recording
psm flow
Enable the PSM in the (blank) Policy for all platforms or for
specific platforms by use of exceptions
master
By default, Platforms are associated
with the first installed PSM server
blank
(blank) - define the
configuration settings for using a given third
-party client to
connect to a target platform.
A few common ones are: * SQLPlus
* RDP
* Putty
* WinSCP
Connection Components
(aka Connectors)
Connection Components
(aka Connectors)
There are many connection components available out of the box
* Additional connection
components can be found in the (blank)
* Organizations can also
build and add custom
connection components to the PAM solution
CyberArk
Marketplace
To enable the use of a particular third-party client to connect to a
given account, the appropriate Connection Component needs
to be assigned to the (blank) that manages that account
Platform
The new interface accelerates and simplifies Vault administration by allowing admins to import (blank) connectors and link them to Platforms, all from one
location
psm
The (blank) framework facilitates the creation of custom connection components using a (relatively) simple, freeware programming language called AutoIT
Universal Connector
With an (blank),
users can connect securely to any machine supported by the
PSM if they know the password
* Main use cases:
⎼ Connecting with accounts that are not stored in the CyberArk
Vault
⎼ Connecting with personal accounts
* Provides all the benefits of PSM: isolation, monitoring, and recording
Ad-Hoc Connection
how to enable ad-hox connections?
The (blank) Platform must be activated
* Privileged session
monitoring and isolation
must be enabled for the
PSM Secure Connect
platform. This can be done either globally or via an exception to the Master policy
PSM Secure Connect
when launching an ad-hoc connections the Users will need to specify all the account details when they connect:
* The (blank) they want to use on the PSM
* Target system Address
* Username
* Password, etc.
client
Many organizations block RDP client connections from end-users’ machines for security
reasons or regulatory requirements.
* RDP is a Microsoft protocol, so in order to use it in Linux, Unix, or MAC environments,
users must install a 3rd-party client in order to connect to the PSM.
* The HTML5 Gateway tunnels the session between the end user and the PSM proxy
machine using a secure WebSocket protocol (port 443). This solution eliminates the need
to open an RDP connection from the end user’s machine. Instead, the end user only
requires a web browser to establish a connection to a remote machine through PSM.
* Secure access through HTML5 requires integrating an HTML5 gateway on a Linux server
(can be co-hosted with PSM for SSH). The Gateway is based on Apache Guacamole.
blank
HTML5 Gateway: Flow
- Logon through PVWA and click on Connect
- Connect to HTML5 GW using WebSocket
- Connect to PSM using RDP
- Fetch credential from Vault
- Connect using native protocols
- Logs forwarded to SIEM and PTA
- Store session recording
The HTML5 GW is enabled at the
system level for each (blank) server
PSM
Users can be given the option to connect either an HTML5-based or RDP-file connection method when connecting to the
remote server
* This setting is applied at the (blank) level
Connection Component
- Users connect directly from their desktops with an RDP-compliant client to the PSM, which then connects to the target host using the protocol appropriate to that host: SSH, RDP, etc.
- There is no need to go through the PVWA.
- Users can launch the RDP client and sign in into CyberArk using single- or multi-factor authentication (for example, LDAP with RADIUS).
⎼ The RDP client application must include the ability to configure run “Start Program”
for the RDP connections.
⎼ Connections can be made from Unix / Linux / Mac / Windows end user machines. - PSM continues to provide complete isolation of the target systems, ensuring
that privileged credentials never reach users or their devices
blank
PSM for Windows: Flow
- Connect to PSM using RDP/TLS
- Fetch credential from Vault
- Connect using native protocols
- Logs forwarded to SIEM and PTA
- Store session recording
RDP Client
Settings
PSM IP
* Vault user
* Activate Start Program
* Program path:
⎼ Privileged Account name
⎼ Target address
⎼ Connection Component
Preconfigured
RDP Files
You can also configure
individual RDP files to
connect through the (blank)
* It is possible to configure connections with or without
providing the target system details
psm
PSM for SSH: Overview
- The average enterprise manages hundreds
of Unix servers and network devices - Systems are usually critical, but access to
them is uncontrolled - Network and Unix teams are reluctant to
change their existing workflows and tool sets - PSM for SSH (previously PSM SSH Proxy or
PSMP) is designed to provide a native
Unix/Linux user experience when connecting
to any SSH target system
blank
PSM for SSH
Client Settings
The connection settings for PSM for SSH resemble those of PSM for Windows.
* Connections are not
launched via the (blank),
but through a special
connection string.
pvwa
