CyberArk Privileged Access Security Architecture

Privileged Access Security Solution provides a safe place for the organization where all the administrative passwords can be safely transferred, archived, and shared by authorized users, including IT personals, on-call admins, and local admins at remote sites.

CyberArk  Privileged Access Security is a multi-layered solution that provides highly secure solutions for storing and sharing passwords across the organization. These layers include VPN, authentication, encryption, firewall, access control, and so on. The architecture of CyberArk  Privileged access security consists of the following elements:

Want to know more about CyberArk , visit here CyberArk Tutorial.

Storage Engine:
A storage engine is also known as a vault or Server. It holds the data. It ensured securing the data and authenticated and controlled access.

Interface: 
The interface is responsible for communicating with the storage engine and allows access to users and applications. Communication between the storage engine and the interface is via the vault protocol, which is a safe CyberArk  protocol. 

Prepare for CyberArk  Interview? Here Are Top CyberArk Interview Questions and Answers

Subscribe to our YouTube channel to get new updates..!

Now, let us understand how these components are connected in CyberArk  PAS architecture:

• CyberArk  digital Vault: This is a safe location in the network where the most sensitive data can be stored. The vault is intended to be installed on a dedicated computer in order to completely isolate the data. It is equipped with state-of-the-art security technology and is already set up and ready for use when installed. This indicates that the system does not require any complicated configuration or security expertise to operate it at peak capacity. Accessing your password constantly is very important. If a server fails, access to your passwords may be temporarily blocked. In such a case, the vault can be installed as a cluster of high-availability servers that provide consistent access to accounts within the vault. 
• Password Vault Web Access Interface: It is a web interface that provides a single console that allows the end-users and administrators to request, access, and manage preferred passwords across the company. The automatically-generated list of frequently used passwords of each user makes it easy to access and use them quickly. It also allows the users to access Privileged accounts allowing seamless connectivity and optimum workflows. The simple and intuitive PVWA wizard allows users to set new preferred passwords, while a powerful search mechanism allows you to search for passwords and sensitive files with minimum effort. PVWA dashboard allows you to see the activity overview in your Privileged Access Security Solution along with statistics on all the activities that took place. These dashboards show a graphical view of the managed passwords and links to particular information of the users and passwords that need special attention. 
• PrivateArk client: PrivateArk client is a window application used as an administrative client for the PAS solution. It can be installed on any number of remote computers and can access the vault through any combination of local area network, wide area network, or Internet. To access the vault the vault admin must define the users in the vault and the IP address of the computer where the PrivateArk client is installed. The user has to be authenticated by the vault before accessing it. PAS solution provides highly secure user authentication with a customizable combination of passwords, physical keys, and certificates. After authentication, a user can work with the PrivateArk client to establish a hierarchy in the vault and build safes and users. Users can also monitor and track activities like who accesses the information from where and when. Each request, command, user configuration, and file transfer is encrypted before being transmitted between the vault and the PrivateArk customer to guarantee maximum data protection at any time.
• Central Policy Manager: CyberArk  Central Policy manager puts a break to the Privileged Access Security Solution that can change passwords on remote machines and store new passwords without any intervention of a human being. It also allows the organizations to verify the passwords on remote sites and restore them when required. Because of the distributed architecture of the Privileged Access Security solution, additional CPMs can be installed on different networks to handle passwords that are all stored in a single vault. In load-balancing implementations, the vault also supports shared config files for additional GPCs in high availability implementations and password management per safe. This flexibility allows the PAS solution to support complex distributed environments.
• Privileged session Manager: Privileged Session Manager allows organizations to control, monitor, and secure privileged access to network devices. Vaulting technology is used by PSM to manage access to privileged accounts at a centralized point facilitating a control point to begin privileged sessions. PSM provides some policies that specify which users are allowed to access the privileged accounts, at what time, and for which purpose. It also controls which connection protocol can be accessed by a user by enabling the organization to filter restricted protocols. It records the activities that occur in privileged sessions in a compact format providing detailed session audits and DVR-like playback. These recordings are protected and stored in the vault server and can be accessible to authorized auditors.
• Privileged session Manager for SSH: An organization can monitor, control and secure privileged access to network devices using PSM for SSH. With the help of vault technology, it can manage the access to privileged accounts at a centralized point facilitating a control point to begin privileged sessions. PSM for SSH identifies which users have the right to use privileged accounts and to start a privileged session, when and for what purpose. PSM for SSH can record any activity that takes place in the preferred session in a compact format. Text recordings are protected and stored in a vault server and can be accessed by authorized auditors. PSM for SSH provides Single sign-on capabilities and allows the users to access target devices without any exposure to privileged connection passwords.
• On-Demand Privileges Manager: CyberArk ‘s On-demand Privileges Manager allows the organizations to monitor, control, and secure privileged access to UNIX commands with the help of Vaulting technology for allowing the users to perform tasks with their personal account while maintaining the least privileged concept. It offers a complete solution that strengthens IT and allows complete visibility and control of super-users and privileged accounts throughout the enterprise. In all aspects of privileged account management, the Privileged Access Security solution provides centralized management and auditing from a unified product with the help of OPM. 
• Privileged Threat Analytics: CyberArk  Privileged Threat Analysis monitors the use of Privileged accounts managed by CyberArk  Privileged Access Security platform and accounts that are not managed by CyberArk  and search for indications of misuse or abuse of the CyberArk  platform since the privileged accounts are compromised often as part of an attack. PTA executes sophisticated attacks like Golden Ticket and searches for attackers that compromise privileged accounts. PTA is a part of the CyberArk  PAS solution that provides an extra layer of security, which identifies malicious activities caused by privileged accounts and proactively contains active attacks. PTA supports malicious activity detection in privileged accounts when they are authenticated by either passwords or SSH keys.
• Password Upload Utility: The password Upload utility uploads various password objects to the Privileged Access Security solution, which makes the Vault implementation process faster and more automated. It works by uploading passwords and their bulk properties to the vault from a pre-prepared file, creating the required environment, if necessary. It is executed from a command line when a password upload is needed.
• Administrative APIs: CyberArk Vault Command Line Interface allows users to access the Privileged Access Security solution from anywhere using automated scripts in a highly intuitive command-line environment.
• SDK Interfaces: Application Password SDK eliminates the need for storing the application password attached to the application, configuration files, or scripts and allows these sensitive passwords to be stored centrally, managed, and logged within the PAS solution. This unique approach will enable organizations to comply with internal and regulatory requirements to replace passwords periodically; monitor preferred access to all the systems, applications, and databases. Application Password SDK provides a number of APIs like .Net, Java, CLI, C/C++, COM. Application Password Provider is a “local server” that holds passwords retrieved from the vault securely. Independent of network performance, Application Password Provider provides immediate access to passwords. Application Server Credential Provider manages the application server credentials securely and automatically that are stored in XML data source files. It prevents the need for performing any changes of code to applications and can perform replacement of passwords with no need to restart the application server. Thus it eliminates downtime and allows business continuity.

Do you want to collaborate in the CyberArk world? Begin by learning CyberArk Training In India!

Thus From the above blog, we have learned about CyberArk and its architecture. I hope the information provided in this blog is useful. We have covered all the important information related to CyberArk architecture. If you find that any topic related to CyberArk architecture is missing, or if you think anything to be added, then drop a comment in the comment box.

Related Articles: