Privileged Identity Management Enterprise Password Vault Privileged Password

Privileged Identity Management Enterprise Password Vault

Privileged Password Management – Agenda • Privileged Users 101 – What are privileged Users • • • The Challenge Common Practices and the Risks Involved Drivers: Regulations and Internal Breaches Business and Technical Requirements Cyber-Ark Enterprise Password Vault – – Technology Architecture Benefits Demonstration • Q&A

Identity Management – Individual Users Component Directories

LDAP/Identity Management Partners The Password Vault and can be integrated with any LDAP or Identity management solution, Cyber-Ark has strategic partnerships with the companies below. Together an organization will be able to manage both users and shared privileged accounts

PIM - White Space for Major IAM Players

What Are Privileged Accounts? Administrative Accounts Shared Predefined: • UNIX root • Cisco enable • DBA accounts • Windows domain • Etc. Application Accounts Hard-coded, embedded: • Resource (DB) IDs • Generic IDs • Batch jobs • Testing Scripts • Application IDs Personal Computer Accounts Windows Local administrator: • Desktops • Laptops Shared: • Help Desk • Fire-call • Operations • Emergency • Legacy applications • Developer accounts Owned by the system: • Not owned by any person or “identity” Service Accounts: • Windows Service Accounts • Scheduled Tasks

Privileged Accounts Today • Common practices: – Storage: Excel spreadsheets, physical safes, sticky notes, locked drawers, memorizing, hard coded in applications and services – Resets: Handled by a designated IT members, call centers, mostly manual – Known to: IT staff, network operations, help desk, desktop support, developers • Common problems: – – – Widely known, no accountability Unchanged passwords Lost passwords Same password across multiple systems Simplistic passwords – easy to remember Passwords not available when needed

Key Business Drivers • Regulatory Compliance (Sarbanes Oxley, PCI, BS 7799 etc. ) – Auditing and Reporting – Control – Segregation of Duties • Proactive Improvement of Information Security Practices – Lost and Risk prevention – Return on Investment – Administrative Password Management • Internal Breach • Return On Investment – Efficiency and Productivity

Mission Statement Vault Safes eo G (V g di tin Au Fi le En cr yp is u al tio n (Local Drive or SAN) Se cu gr Ma rit ap n y) u hi a ca l & l. S ec Ac ur ce ity ss C on tro Au l th en tic at io n Fi re w al l S En es cr sio yp n tio n Cyber-Ark Software is an Information Security company that develops and markets digital vaults for securing and managing highly-sensitive information within and across global enterprise networks. Cyber-Ark Vault Server LAN, WAN, INTERNET

Password Vault Architecture Central Password Manager 1 Unix Servers 2 Password Vault Windows Servers Central Password Manager is periodically regenerating new passwords for all managed accounts on all relevant systems and/or Directory Servers and then stores a copy of the new passwords within the Vault 3 Networking Devices Directory Server 4 The Administrator is now ready to login to its target application or server Privileged Users are defined to the Central Password Manager and a copy of their passwords is stored within the Vault An Administrator needs to perform an administrative task on any system or device. After authenticating to the Vault, and passing relevant security checks the specific password of the target account on the target system is retrieved. WAN Desktops Disaster Recovery Site Main Frame

Application Passwords • Scripts – Shell, Perl, Bat, Sqlplus… • Applications – Custom developed C/C++, COM, Java, . NET code – Application Servers (Web. Sphere, Web. Logic…) • Products – IT Management – ETL tools (Informatica, etc…)

Hard-Coded Password Embedded in Code. . User. Name = “app” Password = “asdf” Host = “ 10. 3. 56” Connect. Database(Host, User. Name, Password). Work with database. source 1. vbs . . User. Name = “app” Password = PVTool. Kit(“Vault. ini”, “User. ini”, “Safe”, “RootPassword”) Host = “ 10. 3. 56” Connect. Database(Host, User. Name, Password). Work with database. source 1 -new. vbs

Requirements for Privileged Accounts Management Solution ü Exceptionally secure solution for the keys of the kingdom ü Supreme performance, availability and disaster recovery due to its mission-critical nature ü Flexible distributed architecture to fit the enterprise complex network topology ü Single standard solution for a multi-facet problem ü Intuitive and robust interfaces

Thank You David Adamczyk Channel Sales Manager Cyber-Ark Software david. adamczyk@cyber-ark. com