Enterprise Password Vault stunned us with the breadth of server operating systems, devices and applications for which it can supply privileged password system support.
Cyber-Ark’s product was sent to us in pre-configured VMware-format virtual machines. While it’s Cyber-Ark’s policy to install 100% of its products, we requested this optional product delivery mode that allowed us to install the product ourselves.
Enterprise Password Vault (EPV) stunned us with the breadth of server operating systems, devices and applications for which it can supply privileged password system support.
EPV, because of its comparatively deep LDAP support, could work with virtually everything in our lab, ranging from virtualized Windows, Linux, FreeBSD, and MacOS servers to Microsoft SQL Server and Cisco IOS devices. The examples of how to connect to these devices and customize EPV ‘Vaults’ and ‘Safes’ gave us templates to use that didn’t mandate becoming experts in how this privilege account manager works. EPV’s infrastructure ‘intelligence’ and its integration level are a cut above the competition.
Everything we used in our test bed was covered. Linux? Check. Solaris? Check. MacOS? Check. FreeBSD? Check. If LDAP (this includes Windows LDAP) is correctly configured, the integration is very fast. If you’ve got a quirky LDAP deployment, then the user interface helps you configure generic privileged password objects to be used across the network. EPV also created vaults and safes for secure data storage, as well as secure network directories under LDAP, with ease.
There are four components to the EPV system, its Enterprise Password Vault (the password and access storage system), its Central Password Manager (CPM — the core privileged account management application), its Password Vault Web Access System (PVWA – which provides the method by which users request passwords and high-level administrators approve the requests), and EPV’s Application Identity Management component (AIM — which performs application-to-application password management.)
EPV uses a vault — and safes within the vault where passwords are kept for specific resources on the network – a metaphor to allow administrators to aggregate access groups by like-type.
Inside each vault are groups that use a common methodology to gain access to a resource requiring privileged access. For instance, we tapped recommended vaults provided by Cyber-Ark and used them to create access to our test Windows 2003, Linux, and BSD servers with relative ease, as the settings are understandable and rapidly replicated.
We tested access to each of our hosts and devices using correct and incorrect credentials to see how EPV reacted. EPV responded to requests almost instantly (or alternatively it could be tweaked to delay requests, if it’s needed for security reasons) and within the time needed to also make our RSA SecureID dongles valid (as their numbers expire quickly). All of our use case tests were satisfied correctly and each were documented within EPV’s logs. We were also able to set alarms with regard to failed attempts and have them sent to us quickly via e-mail.
Overall, Cyber-Ark’s approach to the PAM issue is simpler than those taken by other products tested in number of ways. First, numerous ‘sample’ vaults with brand/type-specific access rules are supplied as templates. These templates covered the wide breadth of EPV’s use cases, including everything from Cisco wireless access points and Microsoft’s Active Directory, as well as our extensive LDAP network that includes directory shares, FreeBSD, Solaris 10 and various flavors of MacOS 10.
Second, Cyber-Ark easily imported users and groups from our LDAP-based network, finding hosts from user-member systems, so that it was possible to take advantage of Active Directory group membership (administrative or otherwise) to rapidly develop role-based policies.
Cyber-Ark found servers in our testing through an easy discovery process; and because it understands LDAP thoroughly, it was very able to find our LDAP groups in both OpenLDAP on Linux, and through Active Directory’s listings. It also found numerous devices (mostly operating system server hosts) with aplomb.
Finding and managing an infrastructure ought to be fast for planners and installers of EPV, if the root directory partitions of desired hosts, application, and/or appliances are readily available. It is important to note that sometimes these elements are blocked depending on an organization’s security addressing partitioning for the purpose of thwarting phishing and other cracking attempts.
In the EPV metaphor, group membership is a ticket to access ‘safes’ within its vaults.
Access rights to the safes are either set up to be transient (and expire at a predetermined date), or remain in place permanently.
Groups and users are hierarchical in terms of their accessibility to safes and their capacity to change system parameters. Pre-defined groups (which could be removed if desired) break down by role functions such as administrator, backup, operators, disaster recovery-authorized, auditors and internal managerial accounts.
The ‘Safe Owners’ administratively control access to the safes. Various policies to safe access can be defined, such as permitted times that the safe can be accessed, delays before safe entry, and closing the safe. In turn, the devices to be managed (logon to servers, databases, or other supported security or network devices/appliances) have policies that can be set for them using pre-defined templates (in XML) that can be added, modified, then replicated as needed to support subsequent devices.
Administrator access to privilege passwords follows along the same format as competitors e-DMZ and PowerKeeper, through the use of a browser (request and answer) or through a client application called PrivateArk.
The administrative access to EPV is a Secure-HTTP-rendered page where access to administrative rules, vault and safe characteristics can be addressed. The strength of the user interface lies in the aforementioned vault templates. We could use these quickly to gauge the customizations needed to for each of our variety of test devices to rapidly encompass them within EPV’s protections. Although it’s a tabular interface that’s somewhat similar to PowerKeeper and e-DMZ PAR, we found it intuitive, aggregating like-type objects in a more logical format.
Users of vaults and safes cannot see the activities of each other, and bridging them isn’t allowed except through common group membership. This allows processes used in EPV by one part of an organization to be masked from other members — unless they share common group membership.
Rich administrative reports, though, including all vault activities were also easy for us to generate. The audit trails were also easy to follow. Information regarding a privileged access instance from initial request through to a ‘finished state’ where passwords may be reset are easily tracked and discerned.
