CyberArk Defender - Identity cheat sheet

CyberArk's human-identity stack centers on the Vault, which stores and manages privileged credentials; the CPM (Central Policy Manager) rotates them on schedules defined in platform or master policies.

Safe membership is the unit of authorization: a user or group gets access through Safe membership, and Safe permissions (Use, Retrieve, List, Add, Update, Delete, Manage Safe Members) define what they can do with accounts inside.

Master policy governs platform-wide rules (password change intervals, dual control, session recording, required reason); platform policy overrides master policy for exceptions; account-level settings override both.

Dual control requires two authorized approvers before a user can retrieve or connect to a privileged account; it is configured in master or platform policy and enforced on retrieve/connect actions.

On-demand elevation (e.g., via CyberArk's just-in-time access) grants time-bound access to a Safe or account instead of standing access; access expires automatically at the end of the window.

Session isolation and recording: PSM (Privileged Session Manager) proxies sessions to target systems, records them, and can isolate the user from the target; recordings are indexed for audit and searchable by user, target, and time.

Authentication to the Vault supports multiple methods (password, LDAP, RADIUS, SAML/SSO, smart card, PKI); MFA can be required for specific users or directories, and each method is configured as an authentication method in the Vault.

Least privilege for humans: standing admin rights should be replaced with on-demand elevation; the access review process should confirm Safe memberships and platform entitlements against job roles.

Audit trail: every retrieve, connect, and change is logged in the Vault audit; privileged activity reports and SIEM forwarding satisfy monitoring and compliance requirements.

Secrets Manager (Conjur) manages secrets for applications, containers, and CI/CD; the core objects are the policy tree, hosts, and variables, all defined in declarative YAML policies loaded into the Conjur server.

Conjur authenticators include API key, JWT (e.g., for Kubernetes service accounts), AWS IAM, Azure, GCP, and OIDC; the workload authenticates with its platform identity and receives a short-lived access token.

Secrets are stored as variables under the policy hierarchy; access is granted by role-based policy (permit statements) so each host can read only the variables in its permitted branch.

Secret rotation for machine identities is automated by Secrets Manager: rotation can be scheduled or triggered, and the new value is written to the target system and the Vault in the same workflow.

Dynamic secrets (e.g., database credentials) are generated on demand with a short TTL; the workload requests a credential, uses it, and it expires, eliminating long-lived static secrets.

The Vault and Secrets Manager can be integrated so applications fetch secrets through the Secrets Manager while the Vault remains the system of record for privileged accounts.

Secrets sprawl is addressed by discovering hardcoded secrets in code and configs, then migrating them into Secrets Manager and replacing them with references or environment injection at runtime.

Nonhuman identity governance: each workload identity should be tied to an owner, have a defined rotation policy, and be reviewed like a human account; orphaned hosts and API keys are a common audit finding.

Network and transport: Conjur is typically deployed behind TLS; the follower/standby architecture supports high availability, and the leader holds the authoritative policy and secret data.

AI agents are nonhuman identities that act autonomously; they should be registered as first-class identities with an owner, a purpose, and a defined scope of access rather than sharing a human or service account.

Each agent should authenticate with its own short-lived credential obtained through a workload identity mechanism; long-lived API keys embedded in agent code are the primary risk to eliminate.

Agent permissions should be scoped to the minimum set of tools, APIs, and data the agent needs; broad standing permissions turn a prompt-injection or model error into a full-privilege incident.

Tool and API calls made by an agent should be brokered through a policy enforcement point that checks the agent's identity and the requested action before issuing a credential or forwarding the call.

Human-in-the-loop approval is a control for high-impact agent actions: the agent requests the action, a human approves it, and the approval is logged with the agent identity and the request context.

Agent sessions and actions must be logged with the agent identity, the initiating user or trigger, the tools invoked, and the data accessed, so behavior can be audited and anomalous activity detected.

Prompt injection and tool poisoning are agent-specific threats: untrusted content can cause the agent to misuse its credentials, so input trust boundaries and output validation are part of the identity control set.

Agent lifecycle: register, provision scoped credentials, monitor, rotate, and deprovision on retirement; an orphaned agent identity with live credentials is an unmonitored privileged account.

Delegated authority: when an agent acts on behalf of a user, the effective permission should be the intersection of the user's rights and the agent's scope, not the union, and the delegation chain must be recorded.

Endpoint Privilege Manager (EPM) removes local admin rights from standard users and instead applies policy-based elevation: a user requests elevated execution of a specific application, and EPM evaluates the policy before allowing it.

EPM policy types include allow/deny lists for applications, elevation rules (e.g., auto-elevate a signed application, require justification, require approval), and file/registry protection rules.

Application control in EPM uses hash, publisher, or path-based rules; hash rules are strictest, publisher rules survive updates, and path rules are weakest and most easily abused.

EPM can enforce least privilege on Windows and macOS endpoints, block known malicious or unwanted applications, and record elevation events for audit.

Identity Governance covers access certification (periodic reviews of who has what), role mining, and policy enforcement; certification campaigns produce reviewer decisions that must be remediated and evidenced.

Access certification should target privileged entitlements first: Safe memberships, platform entitlements, and standing admin roles are the highest-risk items in a review cycle.

Segregation of duties (SoD) checks detect conflicting access combinations (e.g., a user who can both request and approve the same privileged access); violations are flagged for remediation.

Lifecycle management ties joiner/mover/leaver events to entitlement changes: a leaver's Safe memberships, Vault accounts, and EPM elevation rights must be revoked as part of offboarding.

Governance reporting closes the loop: certification completion rates, SoD violations, and orphaned accounts are tracked as metrics and fed back into policy tuning.

CyberArk's human-identity stack centers on the Vault, which stores and manages privileged credentials; the CPM (Central Policy Manager) rotates them on schedules defined in platform or master policies.

Safe membership is the unit of authorization: a user or group gets access through Safe membership, and Safe permissions (Use, Retrieve, List, Add, Update, Delete, Manage Safe Members) define what they can do with accounts inside.

Master policy governs platform-wide rules (password change intervals, dual control, session recording, required reason); platform policy overrides master policy for exceptions; account-level settings override both.

Dual control requires two authorized approvers before a user can retrieve or connect to a privileged account; it is configured in master or platform policy and enforced on retrieve/connect actions.

On-demand elevation (e.g., via CyberArk's just-in-time access) grants time-bound access to a Safe or account instead of standing access; access expires automatically at the end of the window.

Session isolation and recording: PSM (Privileged Session Manager) proxies sessions to target systems, records them, and can isolate the user from the target; recordings are indexed for audit and searchable by user, target, and time.

Authentication to the Vault supports multiple methods (password, LDAP, RADIUS, SAML/SSO, smart card, PKI); MFA can be required for specific users or directories, and each method is configured as an authentication method in the Vault.

Least privilege for humans: standing admin rights should be replaced with on-demand elevation; the access review process should confirm Safe memberships and platform entitlements against job roles.

Audit trail: every retrieve, connect, and change is logged in the Vault audit; privileged activity reports and SIEM forwarding satisfy monitoring and compliance requirements.

Secrets Manager (Conjur) manages secrets for applications, containers, and CI/CD; the core objects are the policy tree, hosts, and variables, all defined in declarative YAML policies loaded into the Conjur server.

Conjur authenticators include API key, JWT (e.g., for Kubernetes service accounts), AWS IAM, Azure, GCP, and OIDC; the workload authenticates with its platform identity and receives a short-lived access token.

Secrets are stored as variables under the policy hierarchy; access is granted by role-based policy (permit statements) so each host can read only the variables in its permitted branch.

Secret rotation for machine identities is automated by Secrets Manager: rotation can be scheduled or triggered, and the new value is written to the target system and the Vault in the same workflow.

Dynamic secrets (e.g., database credentials) are generated on demand with a short TTL; the workload requests a credential, uses it, and it expires, eliminating long-lived static secrets.

The Vault and Secrets Manager can be integrated so applications fetch secrets through the Secrets Manager while the Vault remains the system of record for privileged accounts.

Secrets sprawl is addressed by discovering hardcoded secrets in code and configs, then migrating them into Secrets Manager and replacing them with references or environment injection at runtime.

Nonhuman identity governance: each workload identity should be tied to an owner, have a defined rotation policy, and be reviewed like a human account; orphaned hosts and API keys are a common audit finding.

Network and transport: Conjur is typically deployed behind TLS; the follower/standby architecture supports high availability, and the leader holds the authoritative policy and secret data.

AI agents are nonhuman identities that act autonomously; they should be registered as first-class identities with an owner, a purpose, and a defined scope of access rather than sharing a human or service account.

Each agent should authenticate with its own short-lived credential obtained through a workload identity mechanism; long-lived API keys embedded in agent code are the primary risk to eliminate.

Agent permissions should be scoped to the minimum set of tools, APIs, and data the agent needs; broad standing permissions turn a prompt-injection or model error into a full-privilege incident.

Tool and API calls made by an agent should be brokered through a policy enforcement point that checks the agent's identity and the requested action before issuing a credential or forwarding the call.

Human-in-the-loop approval is a control for high-impact agent actions: the agent requests the action, a human approves it, and the approval is logged with the agent identity and the request context.

Agent sessions and actions must be logged with the agent identity, the initiating user or trigger, the tools invoked, and the data accessed, so behavior can be audited and anomalous activity detected.

Prompt injection and tool poisoning are agent-specific threats: untrusted content can cause the agent to misuse its credentials, so input trust boundaries and output validation are part of the identity control set.

Agent lifecycle: register, provision scoped credentials, monitor, rotate, and deprovision on retirement; an orphaned agent identity with live credentials is an unmonitored privileged account.

Delegated authority: when an agent acts on behalf of a user, the effective permission should be the intersection of the user's rights and the agent's scope, not the union, and the delegation chain must be recorded.

Endpoint Privilege Manager (EPM) removes local admin rights from standard users and instead applies policy-based elevation: a user requests elevated execution of a specific application, and EPM evaluates the policy before allowing it.

EPM policy types include allow/deny lists for applications, elevation rules (e.g., auto-elevate a signed application, require justification, require approval), and file/registry protection rules.

Application control in EPM uses hash, publisher, or path-based rules; hash rules are strictest, publisher rules survive updates, and path rules are weakest and most easily abused.

EPM can enforce least privilege on Windows and macOS endpoints, block known malicious or unwanted applications, and record elevation events for audit.

Identity Governance covers access certification (periodic reviews of who has what), role mining, and policy enforcement; certification campaigns produce reviewer decisions that must be remediated and evidenced.

Access certification should target privileged entitlements first: Safe memberships, platform entitlements, and standing admin roles are the highest-risk items in a review cycle.

Segregation of duties (SoD) checks detect conflicting access combinations (e.g., a user who can both request and approve the same privileged access); violations are flagged for remediation.

Lifecycle management ties joiner/mover/leaver events to entitlement changes: a leaver's Safe memberships, Vault accounts, and EPM elevation rights must be revoked as part of offboarding.

Governance reporting closes the loop: certification completion rates, SoD violations, and orphaned accounts are tracked as metrics and fed back into policy tuning.