Avari Solutions

CyberArk CorePAS

CyberArk provide Privileged Access Management (PAM) software, this is an end-to-end solution that protects, manages and audits both user and application credentials, provides least privilege access and session isolation while recording, monitoring and responding to all real time privileged activity using intelligent threat analytics.

Features

  • Enterprise Password Vault (EPV)
  • Secure and tamper proof digital vault with multiple security layers
  • Privileged Session Manager (PSM)
  • Single-sign-on control point that isolates, records and audits privileged access
  • Privileged Threat Analytics (PTA)
  • Intelligent real time audit with ability to respond to threats

Benefits

  • Manage Privilege at an Enterprise level through policy driven rules
  • Protection all privileged Accounts and SSH Keys
  • Control Access to Privileged Accounts
  • Initiate and Monitor Privileged Sessions
  • Manage application and service credentials
  • Comply with audit and regulatory requirements
  • Streamlined management of Privileged Accounts
  • Seamlessly integrate with enterprise systems
  • Detect and respond to known threats such as over-pass-the-hash
  • Risk Scoring of privileged use and session behaviours

Pricing

£7,960 a unit

  • Education pricing available
  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ross.garman@avari.solutions. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 12

Service ID

4 7 6 5 1 5 0 7 0 6 0 5 4 0 9

Contact

Avari Solutions Ross Garman
Telephone: 08450360040
Email: ross.garman@avari.solutions

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
"Application Access Manager (AAM)
Secrets management for DevOps and automation processes, prevent hardcoded credentials
On-Demand Privileges Manager (OPM)
Control and monitor super users commands and replacement of SUDO
Endpoint Privilege Manager (EPM & EPM SaaS)
Server and Workstation least privilege, application control, credential theft protection

Please ask for more
Cloud deployment model
  • Private cloud
  • Hybrid cloud
Service constraints
Supplied upon request, contact ross.garman@avari.solutions to arrange an initial needs assessment session to capture your service specific requirements
System requirements
Available upon request

User support

Email or online ticketing support
Yes, at extra cost
Support response times
1 Hour
User can manage status and priority of support tickets
No
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
No
Onsite support
Onsite support
Support levels
Individually quoted for each customer
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Onsite, online and remote jumpstarts
Service documentation
Yes
Documentation formats
PDF
End-of-contract data extraction
"CyberArk is a client hosted solution (even in the cloud), as such users will always exclusively own and hold their data which they can export and report on. Users can export metadata, but not passwords from
the solution. Users are able to produce reports on activity using the web portal."
End-of-contract process
Additional services for customisation or support outwith the contract is not included in the original costs.

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
Application to install
Yes
Compatible operating systems
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • Windows Phone
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
The system works on both mobile and desktop devices.
Service interface
Yes
Description of service interface
Services such as knowledgebase, logging and reviewing support tickets as well as communicating with the support team. Downloading new versions, patches and software updates
Accessibility standards
None or don’t know
Description of accessibility
End users cannot customise the Solution. However, when setting up the CyberArk solution, it should be customised with several user defined parameters in line with the clients requirements. E.g. time logs files are kept for, rules for raising flags and reporting content & scheduling etc.
Accessibility testing
N/A
API
Yes
What users can and can't do using the API
End users cannot customise the Solution. However, when setting up the CyberArk solution, it should be customised with several user defined parameters in line with the clients requirements. E.g. time logs files are kept for, rules for raising flags and reporting content & scheduling etc.
API documentation
Yes
API documentation formats
HTML
API sandbox or test environment
Yes
Customisation available
Yes
Description of customisation
End users cannot customise the Solution. However, when setting up the CyberArk solution, it should be customised with several user defined parameters in line with the clients requirements. E.g. time logs files are kept for, rules for raising flags and reporting content & scheduling etc.

Scaling

Independence of resources
"SLA's will be defined once the target operating model with the
buyer is agreed."

Analytics

Service usage metrics
No

Resellers

Supplier type
Reseller providing extra features and support
Organisation whose services are being resold
Auth0, CyberArk, Securenvoy, Idaptive, Okta, Varonis, Centrify, Ping,

Staff security

Staff security clearance
Conforms to BS7858:2012
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • United Kingdom
  • Other locations
User control over data storage and processing locations
Yes
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least every 6 months
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
Physical access control, complying with CSA CCM v3.0
Data sanitisation process
Yes
Data sanitisation type
Explicit overwriting of storage before reallocation
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
"CyberArk is a client hosted solution (even in the cloud), as such users will always exclusively own and hold their data which they can export and report on. Users can export metadata, but not passwords from
the solution. Users are able to produce reports on activity using the web portal."
Data export formats
CSV
Data import formats
CSV

Data-in-transit protection

Data protection between buyer and supplier networks
  • TLS (version 1.2 or above)
  • Bonded fibre optic connections
  • Legacy SSL and TLS (under version 1.2)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
"SLA's will be defined once the target operating model with the
buyer is agreed."
Approach to resilience
There are many methods of designing resiliency into a CyberArk system. It is always a highly business-critical system and the CyberArk solution has evolved over many years to maximise availability and remove single points-of-failure. Further details are available on request.
Outage reporting
Public Dashboard & Email

Identity and authentication

User authentication needed
Yes
User authentication
2-factor authentication
Access restrictions in management interfaces and support channels
For a full description of how the CuberArk solution Authenticates users, please see the attached service definition document: file name = CyberArk_Core Privileded Access Security_2019.pdf
Access restriction testing frequency
At least every 6 months
Management access authentication
2-factor authentication

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
User-defined
How long system logs are stored for
User-defined

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
The Standards Institute Israel
ISO/IEC 27001 accreditation date
1 April 2017
What the ISO/IEC 27001 doesn’t cover
Certificate is Applicable to Business processes: Research, development, sales and support of information security solutions and
technologies.

System/products: Cloud services: CRM, ERP. Coroporate networks, development enviroment.
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
No

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
"The Information Security Department must provide direction and technical expertise to ensure that CyberArk’s information is properly protected. This includes consideration of confidentiality, integrity, and availability of information and the systems that handle it. The Department act as liaison on InfoSec matters between all departments, and must be the focal point for all InfoSec activities throughout CyberArk.

The Department performs risk-assessments, prepares action-plans, evaluates vendor-products, participates on in-houseIT system development projects, assists control Implementations, investigates information security breaches, trains staff members.

The InfoSec Department has the authority to create and periodically modify both technical standards and standard operating procedures that supports the InfoSec policy. When approved by appropriate CyberArk management, new requirements have the same scope and authority as if they were included in existing policy documents.

An information security steering committee, consisting of the CEO, GM, CIO and CISO
must meet bi-weekly to review the current status of information security at CyberArk,
approve and later review information security projects, and perform other necessary
high-level information security management activities. Other employees may join the
committee according to necessity and relevance.

An information security Audit committee is being updated with information security
work plan and risks management on a bi-quarterly basis."

Operational security

Configuration and change management standard
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach
Supplier defined controls
Vulnerability management type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach
As opposed to other cloud service providers who only provide a service but use 3rd-party technologies, CyberArk developed all the technologies it uses from scratch and only uses standard servers and routers (no 3rd-party technologies). This allows much more flexibility and rapid reaction to new threats and attack vectors as we do not have to wait for updates and patches – we do them ourselves immediately. In order to fight todays sophisticated and constantly changing attack patterns we have CyberArk’s 24x7 SOC - manned with security experts that can handle any attack in real time.
Protective monitoring type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach
Available on request
Incident management type
Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach
We have defined process of incident response and an incident response team whose responsibilities include: Analysis of the security issue risk (based on Severity Matrix and CVSS), remediation and recommendation. SLA of handling the issue according to the risk level. In case the decision is to fix, the fix is like any standard feature\bug development, including validation (QA) and automation. Security bulletin - in case a security issue found risky, and requires patch, we have a mechanism of publishing "security bulleting" to our customers. This bulletin contains explanation of the issue, and mitigation steps (including patch if needed)

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks
No

Pricing

Price
£7,960 a unit
Discount for educational organisations
Yes
Free trial available
Yes
Description of free trial
Full product on qualified 14- day proof-of-concept trial. The CyberArk Discover and Audit (DnA) module is also available to run free-of-charge to baseline and establish PAM requirements

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ross.garman@avari.solutions. Tell them what format you need. It will help if you say what assistive technology you use.