CyberArk Defender - Identity flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Vault master policy

The top-level policy in CyberArk PAM that sets platform-wide defaults such as password change intervals, dual control, session recording, and required reason; platform and account policies can override it for exceptions.

Safe permissions

The set of rights granted to a user or group inside a Safe, including Use, Retrieve, List, Add, Update, Delete, and Manage Safe Members; they determine what actions are allowed on accounts in that Safe.

Dual control

A CyberArk policy requiring two authorized approvers to confirm a request before a user can retrieve or connect to a privileged account; it is configured in master or platform policy and enforced at retrieve time.

CPM rotation

The Central Policy Manager changes privileged account passwords on a schedule defined by the platform or master policy, verifies the new credential works, and reconciles it back into the Vault.

PSM session recording

The Privileged Session Manager proxies connections to target systems, records the session, and indexes recordings by user, target, and time so privileged activity can be audited and reviewed.

Just-in-time elevation

A model where a user receives time-bound access to a Safe or account only when needed, instead of standing privileges; access expires automatically at the end of the approved window.

Vault authentication methods

CyberArk supports password, LDAP, RADIUS, SAML/SSO, smart card, and PKI authentication; each is configured as a method in the Vault, and MFA can be required for specific users or directories.

Vault audit trail

Every retrieve, connect, and change in CyberArk is written to the Vault audit log; the records support privileged activity reporting, compliance evidence, and forwarding to a SIEM.

Conjur policy YAML

Secrets Manager (Conjur) defines its policy tree, hosts, and variables in declarative YAML loaded into the server; permit statements in that policy grant each host read access to specific variables.

Conjur JWT authenticator

A Secrets Manager authenticator that lets a workload present a platform-issued JWT, such as a Kubernetes service account token, and exchange it for a short-lived Conjur access token.

Dynamic secrets

Credentials generated on demand with a short TTL, such as database accounts; the workload requests one, uses it, and it expires, which removes long-lived static secrets from the environment.

Secret rotation workflow

Secrets Manager can rotate a machine credential on a schedule or trigger, write the new value to the target system, and update the stored secret in the same automated workflow.

Secrets sprawl

Hardcoded credentials scattered across source code, configs, and CI pipelines; remediation means discovering them, migrating them into Secrets Manager, and injecting them at runtime instead.

Conjur host identity

A workload registered in the Conjur policy tree as a host; it authenticates with its platform identity and is granted read access only to the variables its role permits.

Orphaned machine identity

A workload host or API key with no current owner and no rotation policy; it is a common audit finding because live credentials remain usable after the owning team or application is gone.

Conjur leader and followers

A high-availability deployment where the leader holds authoritative policy and secret data and followers serve requests; the cluster sits behind TLS for transport protection.

Agent as first-class identity

An AI agent should be registered with its own identity, owner, purpose, and scoped access rather than sharing a human or service account, so its actions can be attributed and governed.

Short-lived agent credentials

Agents should obtain their own short-lived credentials through a workload identity mechanism; long-lived API keys embedded in agent code are the primary risk to eliminate.

Agent least privilege scope

An agent's permissions should cover only the tools, APIs, and data it needs; broad standing permissions turn a prompt-injection or model error into a full-privilege incident.

Policy enforcement point

A broker that checks an agent's identity and the requested action before issuing a credential or forwarding a tool call, so agent access is mediated rather than direct.

Human-in-the-loop approval

A control for high-impact agent actions: the agent requests the action, a human approves it, and the approval is logged with the agent identity and request context.

Agent action logging

Agent sessions should be logged with the agent identity, the initiating user or trigger, the tools invoked, and the data accessed, enabling audit and anomaly detection.

Prompt injection risk

Untrusted content can cause an agent to misuse its credentials; input trust boundaries and output validation are therefore part of the agent identity control set.

Agent lifecycle management

Register, provision scoped credentials, monitor, rotate, and deprovision on retirement; an orphaned agent identity with live credentials is an unmonitored privileged account.

Delegated authority intersection

When an agent acts for a user, effective permission is the intersection of the user's rights and the agent's scope, not the union, and the delegation chain must be recorded.

EPM elevation policy

A rule that decides whether a standard user may run a specific application elevated; it can auto-elevate signed apps, require justification, or require approval before execution.

EPM application control rules

Rules can match by hash, publisher, or path; hash is strictest, publisher survives application updates, and path is weakest and most easily abused by attackers.

Access certification

A periodic review in which reviewers confirm or revoke entitlements; decisions must be remediated and evidenced, and privileged items such as Safe memberships should be reviewed first.

Segregation of duties

A governance check that detects conflicting access combinations, such as a user who can both request and approve the same privileged access; violations are flagged for remediation.

Joiner-mover-leaver governance

Lifecycle management ties HR events to entitlement changes: a leaver's Safe memberships, Vault accounts, and EPM elevation rights must be revoked as part of offboarding.

EPM local admin removal

Endpoint Privilege Manager removes local administrator rights from standard users and replaces them with policy-based elevation of specific applications, recording each elevation event for audit.

Governance metrics loop

Certification completion rates, segregation-of-duties violations, and orphaned accounts are tracked as metrics and fed back into policy tuning to close the governance loop.