The CyberArk Defender - PAM (PAM-DEF)

 By default, external vault users and groups are synchronized once every 24 hours between 1 AM and 5 AM.  This synchronization schedule is determined by the  AutoSyncExternalObjects  parameter in the  DBParm.ini  file, which specifies that the Vault’s external users and groups will be synchronized with the External Directory during this time frame 1 .

References :

CyberArk Docs - Synchronize External Users and Groups in the Vault with the External Directory

 Changes to the REST API that could cause existing scripts to fail include  removing parameters . When parameters are removed from an API, scripts that rely on those parameters being present may no longer function correctly because they expect certain data to be available.  This can lead to errors or unexpected behavior in the scripts that use the API 1 .

References :

CyberArk Docs: REST APIs 1

The Immediate Interval setting in a CPM policy is used to control how often the CPM looks for User Initiated CPM work, such as manual password changes, retrievals, or requests. The Immediate Interval setting defines the frequency, in minutes, that the CPM will check the accounts that are associated with the policy and perform the actions that were initiated by the users. For example, if the Immediate Interval is set to 2, the CPM will check the accounts every 2 minutes and change, retrieve, or authorize the passwords according to the user requests. The Immediate Interval setting does not affect System Initiated CPM work, such as password changes, verifications, or reconciliations that are triggered by the policy settings, such as Expiration Period or One Time Password. These actions are controlled by the Interval setting in the CPM policy. The Immediate Interval setting also does not control how often the CPM rests between password changes or the maximum amount of time the CPM will wait for a password change to complete. These parameters are configured in the CPM.ini file, which is stored in the root folder of the < CPM username > Safe.  References :

[Defender PAM eLearning Course], Module 5: Password Management, Lesson 5.1: CPM Policies, Slide 9: CPM Policy Settings

[Defender PAM Sample Items Study Guide], Question 6: CPM Policy Settings

[CyberArk Documentation Portal], CyberArk Privileged Access Security Implementation Guide, Chapter 5: Managing Passwords, Section: CPM Policy Settings, Subsection: Immediate Interval

 Dual Control is a feature that allows you to set up a workflow for approving access requests to sensitive accounts. You can configure up to two levels of authorization for each account, meaning that you need up to two different authorizers to approve the request before the user can access the account. The authorizers can be either users or groups, and they can have different approval methods, such as email, SMS, or CyberArk interface.  References:

[Defender PAM] course, Module 5: Privileged Session Management, Lesson 5.2: Dual Control

[Defender PAM Sample Items Study Guide], Question 31

[CyberArk Documentation], Dual Control

 Non-repudiation in the context of CyberArk Master Policy settings refers to the assurance that a user cannot deny the validity of their actions. The settings that ensure non-repudiation are those that enforce accountability and traceability of actions.  Enforcing check-in/check-out exclusive access  ensures that only one user can access an account at a time, and their actions can be traced back to them Enforcing one-time password access  means that passwords are used only once and then changed, which prevents the reuse of credentials and ties actions to specific instances of access 1 2 .

References :

CyberArk Docs: Master Policy Rules 2

CyberArk Docs: The Master Policy 1

Vault keys should be rotated when there is a significant event that could potentially compromise the security of the keys, such as when migrating to a new data center. This is because the keys may be exposed to new environments and systems, and rotating them ensures that any potential exposure does not result in a security breach.  Additionally, periodic rotation of encryption keys is recommended to maintain the integrity of the encryption and to adhere to best practices for security 1 .  References :

CyberArk Docs: Credentials Rotation Policy 2

HashiCorp Developer: Key Rotation

 A platform is a set of parameters that defines how CyberArk manages passwords and sessions for a specific type of account or system. To allow users to access a Linux endpoint, the platform needs to have a PSM-SSH connection component, which enables transparent connections to Linux machines using the SSH protocol. The PSM-SSH connection component is configured in the Master Policy and defines the settings for the PSM connection, such as the port, the authentication method, and the terminal type. If the platform is missing the PSM-SSH connection component, the users will not be able to click to connect to the Linux endpoint.  References :  Connection Components ,  PSM-SSH Connection Component

In a default CyberArk installation, to view the “reports” page in the PVWA (Privileged Web Access), a user must be a member of the  PVWAMonitor  group 1 . This group is specified in the  ManageReportsGroup  parameter in the Reports section of the Web Access Options in the System Configuration page. Being a member of this group grants the user the necessary permissions to generate and view reports within the PVWA.

References :

CyberArk’s official documentation on Reports in PVWA outlines the requirement for users to belong to the PVWAMonitor group to access the reports page and generate reports 1 .

The server key and the public recovery key are required to be present in order to start the PrivateArk Server service. The server key opens the Vault, much like the key of a physical Vault. The public recovery key is part of the asymmetric recovery key that enables the Master User to log on to the Vault in case of a disaster. The server key and the public recovery key are usually stored on a removable media, such as a disk or CD, so that they can be safely secured in a physical safe. The recovery private key and the safe key are not needed to start the PrivateArk Server service. The recovery private key is only used for recovery purposes and the safe key is only used to access a specific safe that is defined with an external key.  References:   Server keys ,  Server Components