CyberArk PAM-SEN cheat sheet

Vault is the encrypted repository; the Vault server stores the encrypted file, the Database holds metadata and object references, and the PrivateArk Client is the administrative GUI.

Safe is the basic access-control container; safe membership grants permissions (Use accounts, Retrieve accounts, List accounts, Add/Delete, Manage Safe). Object-level permissions can override safe-level permissions only when explicitly set on the object.

Master Policy governs account password change, dual control, exclusive access, and session recording; exceptions are defined as Master Policy exceptions applied to specific safes or accounts.

Password change workflow: CPM (Central Policy Manager) verifies the password, generates a new one per platform policy, changes it on the target, then verifies again; failed verification triggers retries per platform settings.

Dual control requires two authorized users to approve a retrieval or password-change action; exclusive access locks the account to one user for a defined period and blocks other retrievals.

PSM (Privileged Session Management) proxies connections and records sessions; PSM for SSH records Unix sessions, and connection components define the client and target protocols (RDP, SSH, SQL).

Authentication methods include CyberArk password, LDAP, RADIUS, SAML, PKI, and multi-factor; authentication order is configured per directory mapping in the Vault.

Ticketing integration (ServiceNow, Remedy) enforces that a valid ticket number is required for a connection; the PSM validates the ticket before launching the session.

Account discovery (Account Discovery / Discovery and Audit) scans domains and network ranges to find unmanaged privileged accounts and can onboard them automatically into safes.

Secrets Manager (Conjur) manages machine identities via policies written in YAML; policy statements define users, hosts, layers, and permissions (read, execute, update).

Conjur policy types: !user, !host, !layer, !group, !policy, !variable, !webservice; permissions are granted via !permit with role, privilege, and resource.

Authenticators: authn (API key), authn-iam (AWS IAM), authn-azure, authn-gcp, authn-k8s, authn-oidc, and authn-jwt; each authenticator must be enabled in the Conjur configuration.

Application integration: fetch secrets at runtime via REST API GET /secrets/{variable-id} with an access token; tokens expire per configured TTL.

Secret rotation: dynamic secrets are generated on demand (e.g., database credentials via the Conjur DB rotator); static secrets are rotated by scheduled jobs or the Secrets Manager rotation mechanism.

Kubernetes integration: the Conjur Kubernetes authenticator uses service account tokens; the Secrets Provider injects secrets into pods via init/sidecar containers.

Cloud provider integrations: AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager can be synchronized; CyberArk can rotate credentials stored in these vaults.

Credential providers: CCP (Central Credential Provider) exposes a REST API for applications to retrieve credentials without embedding them in code; AAM (Application Access Manager) manages application identity.

Secrets Manager uses a follower/leader architecture; the leader holds the database, followers replicate and serve API requests; load balancing distributes requests across followers.

EPM (Endpoint Privilege Manager) controls application execution on Windows and macOS endpoints via agent policies; the agent enforces rules pushed from the EPM server.

Policy types: application control (allow/block lists), privilege elevation (run as admin without granting admin rights), and threat protection (ransomware and credential theft detection).

Application control rules match by file hash, publisher certificate, file path, or file name; hash and publisher rules are stronger than path rules.

Just-in-time elevation: a standard user requests elevation, an approver authorizes it, and the application runs elevated for a limited time window.

Threat protection detects suspicious behavior such as ransomware encryption patterns and credential dumping, then blocks or alerts based on policy action.

EPM agent communicates with the EPM server over HTTPS; endpoint policies are assigned to computer groups, and policy precedence determines which rule applies.

Audit and reporting: EPM logs application execution, elevation requests, and blocked events; these events are viewable in the EPM console and exportable to SIEM.

macOS support includes application control and privilege elevation; the agent is installed via a package and managed from the same EPM server.

IGA (Identity Governance and Administration) provides identity lifecycle management, access requests, certifications, and role management; it integrates with the Vault for privileged access governance.

Access certification campaigns assign reviewers to certify or revoke user access; campaign scope defines which users, safes, or entitlements are reviewed.

Role-Based Access Control (RBAC) maps users to roles; roles aggregate permissions, and role mining identifies candidate roles from existing access.

Segregation of Duties (SoD) policies detect conflicting access combinations (e.g., a user who can both request and approve the same access); violations are flagged for remediation.

Access request workflow: a user requests access, the request routes to approvers per policy, and on approval the entitlement is provisioned or granted in the target system.

Identity lifecycle: joiner, mover, and leaver events trigger provisioning, access updates, and deprovisioning; leaver events must revoke privileged access promptly.

IGA integrates with HR systems as the authoritative source for identity data; reconciliation compares the authoritative source against target systems.

Audit reporting includes certification results, SoD violations, access request history, and provisioning events; reports support compliance evidence for auditors.