CyberArk Architecture: A Guide to Securing Privileged Access
A clear tour of the vault, policy, session, credential and authentication layers that protect privileged accounts in CyberArk.
CyberArk, an industry leading privileged access security firm, safeguards sensitive enterprise data and systems with a comprehensive approach to privileged access management. This report explores its components and principles.
The CyberArk Vault, also called the Privileged Account Security Center or PASC, is the cornerstone. It stores passwords, SSH keys and other sensitive credentials in an encrypted vault and centralises them for easier management. The vault reduces inconsistency and keeps privileged accounts away from unwanted access, abuse or theft.
Central Policy Manager
Central Policy Manager, or CPM, is the core policy component. It lets an organisation set and enforce access controls, session monitoring rules and recording rules for privileged accounts. CPM also connects CyberArk with other security systems and directory services, which supports interoperability and policies that can follow industry standards without losing the flexibility needed for a custom framework.
Session Manager
Session Manager monitors, controls and proxies privileged sessions in real time. Proxying narrows access to specific systems or tasks, while session recording gives an organisation material for audits, investigations, compliance work and incident response. This makes privileged activity visible without leaving the user to work unobserved.
On Demand Privileges Manager
The On Demand Privileges Manager, or OPM, supports just in time privileged access. It gives users and applications temporary, time bound rights, which reduces standing privilege and the attack surface that comes with it. OPM also supports least privilege practice by limiting access to what the job actually needs.
Password Vault Web Access
Password Vault Web Access, or PVWA, provides secure and efficient access to privileged account passwords through a browser. It gives administrators a controlled interface for the tasks that keep the vault useful: retrieving credentials, managing accounts and reviewing policy.
Central Credential Provider
The CyberArk Central Credential Provider, or CCCP, helps an enterprise securely install and manage privileged accounts on Windows systems. Applications and users can interact with normal credentials while the provider keeps privileged credentials protected behind the scenes. The result is stronger security without a disruptive change to infrastructure or daily process.
Layers of defence
CyberArk uses several layers to protect privileged access. Access control enforces least privilege, reducing the attack surface and limiting lateral movement. Multi factor authentication adds another step: a password and a one time passcode before access to a privileged account is granted. Together, these controls make privileged access harder to abuse and easier to audit.
The original report also linked to a reference on SSH keys. That reference is kept here for readers who want the background on key based access.