CyberArk EPM-DEF cheat sheet
CyberArk EPM-DEF · Keep the key ideas within reach.
Endpoint privilege, application rules and controlled deployment
Elevate an authorized task rather than grant standing privilege by default.
Verify assignment, agent state, effective matches and actual precedence.
Hash, publisher and path criteria have different trust and update trade-offs.
Product/version terminology and current certification availability need separate verification.
Identity, access and cryptographic protection
Identification, authentication, authorisation and accounting are four distinct steps.
MFA needs two different factor categories, not two instances of one.
RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.
Kerberos uses a KDC with TGT and service tickets for SSO.
Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.
Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.
ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.
Host and middleware hardening foundations
Harden from a documented baseline image: minimal services, default-deny host firewall, secure boot.
With conventional requested modes 0666/0777, umask 027 yields 0640 files and 0750 directories.
SUID/SGID binaries must be inventoried as escalation paths; avoid shared root.
EDR adds behaviour detection and response beyond signature antivirus.
Third-party applications are as important to patch as the operating system.
Security operations, monitoring and response
Asset inventory and configuration baselines underpin every operational control.
Changes need an appropriate authorization path, recovery planning and relevant evidence.
Emergency changes still require retrospective documentation within a defined window.
Monitor log sources for silence, not just for events.
Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.
Containment precedes eradication in almost every scenario.
Capture volatile evidence (memory, connections) before disk and before power-off.
Vulnerability discovery, prioritization and verification
Validate findings and prioritize with exposure and business impact.
CVSS severity is not a complete organizational risk score.
Assessments and testing require appropriate authorization and scope.
Verify remediation and review documented exceptions.
Cyber-risk identification and analysis
Risk assessment cycles through identification, analysis, and evaluation, producing a maintained risk register
Single loss expectancy = asset value x exposure factor; annualized loss expectancy = SLE x annualized rate of occurrence
Risk requires a threat, a vulnerability, and an impact; none alone is sufficient
Inherent risk is before controls, residual risk after them - always state which is being scored
Control effectiveness and uncertainty affect any expected-loss comparison.
Continuity, backup and technical recovery
Distinguish tolerated data loss from tolerated interruption.
A recovery point and restore time must both meet the stated targets.
A same-failure-domain snapshot alone does not cover loss of that domain.
Verify complete restore procedures and actual dependency behavior.