Privileged Access Management (PAM) is a set of technologies, policies, and procedures used to manage and monitor access to critical systems and sensitive data within an organization. PAM solutions aim to mitigate the risk of unauthorized access to privileged accounts, which are often used by administrators, IT staff, and other privileged users to manage critical systems and applications.

The goal of PAM is to ensure that privileged access is only granted to authorized users, and that access is granted on a need-to-know basis.

PAM solutions typically involve several components, including privileged account discovery, credential management, access control, session management, and monitoring and reporting.

• Credential Management involves securely storing and rotating passwords and other credentials used to access privileged accounts.

• Access control involves implementing policies and procedures to control who has access to privileged accounts and when.

• Session management involves monitoring and terminating privileged sessions to prevent unauthorized access and misuse.

• Monitoring and reporting involves tracking all privileged access activity and generating alerts when suspicious activity is detected.

Implementing a robust PAM solution can help organizations improve their security posture, reduce the risk of data breaches, and comply with regulatory requirements.

However, PAM solutions require careful planning and implementation to ensure they do not disrupt business operations or create additional security risks.

Privilege Access Management in PAM has various subsections for configuring its various components. These subsections are as follows:

• Configuration

• Devices

• Vault User

• History

• Vaulting Configuration

• Break Glass Configuration

• SignOn Policy

• Report &

• Dormancy Disable Config

All these sections help in configuring PAM, Servers and the Users. It also shows the reports and other additional configurations.

What is a vault user?

A "vault user" refers to a user account that has access to a secure resources on a server. When configuring PAM, credentials of the vault user are used to connect to the destination server.

Each device/ server configured can have a vault user created for it. It is also possible that a same user created at a centrally located place like an Active Directory can be used to access multiple devices/ server.

Cymmetri allows you to Access and Manage Vault Users a vault user and use it to access the server.

Adding a vault user

1. Click on Vault User in the Privilege Access Management Section
2. This opens a pop up that asks for your current password. This is done to confirm the request is actually made by the PAM Administrator
3. Once the password is entered It shows the list of all Vault Users
4. On the Top Right there is a button for Add Vault User. Click on that to Add a new vault user.
5. A new modal opens up where you need to provide username and password for creating a vaut user
6. Here the User Name has to be unique and Password is optional we may create a user just with the User Name

7. Once entered click on Save and a user is created as shown below

Editing a vault user details:

1. For editing the details of a vault user we need to click on the ellipses next to the vault user's name and Select Edit as shown below:
2. This opens a modal similar to adding a vault user where you can change the vault user credentials and save

Deleting a vault user:

1. For deleting a vault user we need to click on the ellipses next to the vault user's name and Select Delete as shown below:
2. Once you click on delete it asks for confirmation, Once confirmed the user is deleted.

The first section in PAM is Configuration. In this section we can configure the PAM server credentials that will help us to connect to the PAM server.

A PAM server is a component of a Privileged Access Management (PAM) solution that is responsible for managing privileged access to critical systems and applications within an organization. The PAM server acts as a central point of control for managing and monitoring privileged accounts and their access.

PAM servers can be deployed on-premises, in the cloud, or as a hybrid solution. They can also be integrated with other security and IT management solutions, such as identity and access management (IAM) systems like Cymmetri.

To configure the PAM Server we need to provide the IP Address and Port No of the PAM server as shown below:

1. Navigate to your Cymmetri Tenant for e.g. sunstarcafe.newqa.cymmetri.in/login

2. Login into your tenant by entering your username and password of the Organization Administrator and Click "Login"
3. Enter Cymmetri Authenticator Code and Click "Verify"
4. Go To "Configurations"

And Click on "Admins"

1. Select PAM Write Access option and Click "Add New" to add a new PAM Write Access Administrator

1. Find the user who needs to be the Administrator and Click "Assign"
2. Ensure correct Role is selected and Click "Save"
3. Ensure the selected user is appearing in the list of Admins
4. Follow the same steps to assign a PAM Read Access Administrator
5. And PAM Report Access Administrator
6. Logout from the current login

1. And login again using the login credentials of the PAM Admin that was just added

1. Since the user is now an administrator we will need to provide the authenticator code and click on "Verify" to login
2. To Access PAM we need to Click on "Products"
3. And then select Privilege Access Management
4. This opens the screen for Privilege Access Management as shown below

A device or server represents the critical systems within an organization.Servers play a critical role in Privileged Access Management (PAM) solutions, as they are often the targets of unauthorized access by attackers seeking to gain control over critical systems and sensitive data.

PAM solutions manage and control privileged access to these systems. By leveraging PAM solutions to manage privileged access to servers, organizations can improve their security posture, reduce the risk of data breaches, and comply with regulatory requirements.

In Cymmetri it is the Actual Server(Windows or Linux) that the Privileged User will be connecting to using either RDP or SSH.

Cymmetri allows you to add this device/ server.

The steps to add a RDP device or server are as below:

1. Click on the Devices sub-section on the PAM Page and click on the Add Server Button
2. This opens up a new window for adding a server and it gives two options: RDP(Remote Desktop Protocol) and SSH(Secure Shell Protocol)., we need to select RDP for a Windows Server and SSH for a Linux Server. Currently we will select RDP as we want to add a Windows Server
3. When you select RDP a pop up shows up on the right and it asks for 3 details i.e.

   1. Device Label

   2. Hostname and

   3. Username
4. Device Label represents name of the device/ server and hence has to be unique.

5. HostName is the actual server name or its ip.

6. Username represents the actual server username to be used to connect to the server.

7. We will change these details as given below:

   1. Device Name: Windows RDP Server

   2. Hostname: 65.0.122.207

   3. Username: Administrator

8. And then click on Add Device button to add the server
9. To check if the device is correctly added Click on Devices again and you can see the newly added server should be visible as shown below

The steps to add a SSH device or server are as below:

1. Click on the Devices sub-section on the PAM Page and click on the Add Server Button
2. Now from the two options available we need to select SSH
3. A similar popup like in RDP opens up with Device Label prefilled.
4. We need to change the Device Label, Hostname and Username as given below:

   1. Device Name: Linux SSH

   2. Hostname: 10.0.1.7

   3. Username: kiran
5. We then click on Add Device to add the Server and it can be seen in list as shown below:

When a device is added it is added with minimum configuration, i.e. Device Label, Hostname and Username. You can further configure the connection and other device related information if it needs to be customized

For configuring the device further the steps are as follows:

1. Click on the device you want to configure
2. Click on Settings
3. A Settings Page opens when you can find numerous options to configure as show below:
4. Connection Attributes for any device are read-only as show here, but other attributes can be configured
5. Shown below are the attributes of a device/ server that can be configured:

Vaulting Configuration section allows you to configure various details about vaults that are necessary for proper and efficient usage of vault users

It allows you to configure the following:

1. Password Policy

2. Active Directory (A central location for vault users)

3. Manual Generation of Passwords for Vault Users (All or Specific Users)

Password Policy

1. Cymmetri allows you to select a specific Password Policy for Vault Users, If nothing is changed it uses the default password policy of Cymmetri.

2. For Changing the Password Policy for Vault Users, Select Vaulting Configuration and then select the Password Policy that you wish to implement from the dropdown provided as shown below:

Active Directory

1. If the vault users are stored at a central location like Active Directory then we need to configure the location and access credentials of this Active Directory.

2. For configuring the Active Directory we need to provide the following information as shown below:

   1. Active Directory Domain: Here we need to provide the Active Directory LDAP URL and the root domain details. For e.g. ldaps://EC2AMAZ-2LBJU5A.cymmetri.in:636;DC=cymmetri,DC=in

   2. User Name: This is the Active Directory Administrative username. For e.g. Cymmadmin

   3. Password: This is the Active Directory Administrative password.

Generation of Passwords for Vault Users (All or Specific Users)

For Generating Password for Vault User we need to do the following configurations:

1. One or more users who will receive an email that contains the list of usernames and passwords

2. Password for opening the file which contains the list of usernames and passwords

3. Configure a scheduler to reset the password of users and send an email to the above configured use

4. Manually send the list of usernames and passwords of all or specific users

One or more users who will receive an email that contains the list of usernames and passwords:

For adding users who will receive the email containing the list of usernames and passwords we need to select one more cymmetri users here as shown below:

Password for opening the file which contains the list of usernames and passwords

For Configuring the password simply enter the password in the password box provided

Configure a scheduler to reset the password of users and send an email to the above configured use

For configuring a schedular we need to enable the scheduler and provide the following details:

• A start execution date and

• cron expression

The cron expression can also be generated using the Generate Cron Expression option as shown below:

Manually reset and send the list of usernames and passwords of all or specific users

• Password of vault users can be reset manually and sent an email for all or for specific users

• You can either reset password for all users and send a list by selecting the All users option and clicking on Generate Password button as shown below:
• Alternatively you may also send a list of only specific usernames and passwords by selecting To specific users option and then selecting the users whose details you need to reset and send.

Dormancy Disable Config refers to configuring a setting that allows to automatically deprovision access of a user to the server in case the user has been dormant for more than the mentioned number days in this setting. This might be useful for governance purpose as PAM users are high risk users and this setting can help in removing such dormant accesses.

Following steps need to be performed to configure Dormancy Disable

1. Go To Privilege Access Management -> Dormancy Disable Config
2. The in the Config Days section need to provide the number of days after which the acoounty activiity can be considered dormant and hence deprovision the access
3. The status need to be enabled and then you can save the setting for the mentioned number of days.

PAM Reports

Cymmetri provide you with various PAM Reports that the administrator can use to have various insights.

For accessing PAM Reports you need to access Privilege Access Management ->Report as shown below:

PAM Reports sections provides you with the following types of reports:

PAM History

PAM server can monitor and record privileged sessions, providing audit trails of all privileged access activities. This allows security teams to quickly identify and investigate any suspicious or unauthorized activity.

PAM History shows a complete history of usage by PAM users of the various devices/ servers configured in PAM. PAM History maintains recording of all privileged access activity which can be seen by the administrator as and when needed.

To Access PAM History you need to access Privilege Access Management->History. To view the session recording you need to click on the video icon in right most column Logs

The image below shows a sample recording that the administrator can view

What is break glass configuration?

"Break glass configuration" in Cymmetri refers to a method of obtaining the list of username and passwords of vault users without resetting them. It involves setting up special user accounts that can be used in emergencies to generate an envelope of vault user credentials and send it as a email to the configured user.

For configuring the user(s) we need to select the user(s) from the dropdown as shown below and need to enter a password.

Sending the vault user credentials can be done in two ways:

1. Configure a scheduler which sends the email at the configured date-time and mentioned frequency as shown below:
2. Generate and send the envelope manually for All or specific user(s) as shown below:

The email sent to the configured user consists of a .csv file containing user details in encrypted format as shown here:

The User then needs to use a Utility called PassEnvelopeReader to decrpyt the encrypted data and view the list of usernames and password. This utility asks for a password at the beginning to be able to access and decrypt the user details.