Armadillo Managed Services

CyberArk CorePAS Privileged Access Management (PAM)

CyberArk provide Privileged Access Management (PAM) software, this is an end-to-end solution that protects, manages and audits both user and application credentials, provides least privilege access and session isolation while recording, monitoring and responding to all real time privileged activity using intelligent threat analytics.

Features

  • (EPV) Secure and tamper proof digital vault
  • (PSM) Single-sign-on control point that isolates
  • (PTA) Intelligent real time audit to respond to threats.

Benefits

  • Manage Privilege at an Enterprise level through policy driven rules
  • Protection all privileged Accounts and SSH Keys
  • Control Access to Privileged Accounts
  • Initiate and Monitor Privileged Sessions
  • Manage application and service credentials
  • Comply with audit and regulatory requirements
  • Streamlined management of Privileged Accounts
  • Seamlessly integrate with enterprise systems
  • Detect and respond to known threats such as over-pass-the-hash
  • Risk Scoring of privileged use and session behaviours

Pricing

£665.2 per user

  • Free trial available

Service documents

G-Cloud 11

759661871408736

Armadillo Managed Services

John Webster

02080888222

gcloud@wearearmadillo.com

Service scope

Service scope
Software add-on or extension Yes, but can also be used as a standalone service
What software services is the service an extension to "Application Access Manager (AAM)
Secrets management for DevOps and automation processes
On-Demand Privileges Manager (OPM)
Control and monitor commands and replacement of SUDO
Endpoint Privilege Manager (EPM)
Server and Workstation least privilege, credential theft protection
Privileged Session Manager for Cloud (PSM4C)
Control point that isolates, records and audits privileged access"
Cloud deployment model
  • Private cloud
  • Hybrid cloud
Service constraints Supplied upon request, contact your CyberArk Partner to arrange an initial needs assessment session to capture your service specific requirements
System requirements See release notes for CorePAS in the CyberArk Implementation Guide

User support

User support
Email or online ticketing support Yes, at extra cost
Support response times 1 hour
User can manage status and priority of support tickets Yes
Online ticketing support accessibility None or don’t know
Phone support Yes
Phone support availability 24 hours, 7 days a week
Web chat support No
Onsite support Yes, at extra cost
Support levels Bespoke options available upon requirements
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started CyberArk Training and Certification is available and required before customers can access the main Support service. https://www.cyberark.com/services-support/professional-services/training-certification/
Service documentation Yes
Documentation formats
  • HTML
  • ODF
  • PDF
End-of-contract data extraction N/A
End-of-contract process Customers who do not have an active license agreement cannot access the CyberArk Support service

Using the service

Using the service
Web browser interface Yes
Supported browsers
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install Yes
Compatible operating systems
  • Android
  • IOS
  • Linux or Unix
  • MacOS
Designed for use on mobile devices No
Accessibility standards None or don’t know
Description of accessibility N/A
Accessibility testing N/A
API Yes
What users can and can't do using the API N/A
API documentation Yes
API documentation formats PDF
API sandbox or test environment Yes
Customisation available Yes
Description of customisation End users cannot customise the Solution. However, when setting up the CyberArk solution, it should be customised with several user defined parameters in line with the clients requirements. E.g. time logs files are kept for, rules for raising flags and reporting content & scheduling etc.

Scaling

Scaling
Independence of resources CyberArk Core PAS is not a shared service. It is implemented as an individual instance per enterprise so there is complete independence from the demands of other businesses.

Analytics

Analytics
Service usage metrics Yes
Metrics types "Metrics include: transactions per second, number of users,
average queue time, number of successful
changes/verifications/reconciliations , number of failed
change/verifications/reconciliations."
Reporting types
  • Regular reports
  • Reports on request

Resellers

Resellers
Supplier type Reseller providing extra support
Organisation whose services are being resold CyberArk

Staff security

Staff security
Staff security clearance Other security clearance
Government security clearance Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • EU-US Privacy Shield agreement locations
User control over data storage and processing locations Yes
Datacentre security standards Supplier-defined controls
Penetration testing frequency At least every 6 months
Penetration testing approach In-house
Protecting data at rest Other
Other data at rest protection approach We do not hold data at rest
Data sanitisation process No
Equipment disposal approach Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data importing and exporting
Data export approach "CyberArk is a client hosted solution (even in the cloud), as such users will always exclusively own and hold their data which they can export and report on. Users can export metadata, but not passwords from
the solution. Users are able to produce reports on activity using the web portal."
Data export formats
  • CSV
  • Other
Other data export formats SIEM API
Data import formats CSV

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks Private network or public sector network
Data protection within supplier network TLS (version 1.2 or above)

Availability and resilience

Availability and resilience
Guaranteed availability "SLA's will be defined once the target operating model with the
buyer is agreed."
Approach to resilience There are many methods of designing resiliency into a CyberArk system. It is always a highly business-critical system and the CyberArk solution has evolved over many years to maximise availability and remove single points-of-failure. Further details are available on request.
Outage reporting Public Dashboard & Email

Identity and authentication

Identity and authentication
User authentication needed Yes
User authentication 2-factor authentication
Access restrictions in management interfaces and support channels For a full description of how the CuberArk solution Authenticates users, please see the attached service definition document: file name = CyberArk_Core Privileded Access Security_2019.pdf
Access restriction testing frequency At least every 6 months
Management access authentication 2-factor authentication

Audit information for users

Audit information for users
Access to user activity audit information Users have access to real-time audit information
How long user audit data is stored for User-defined
Access to supplier activity audit information Users contact the support team to get audit information
How long supplier audit data is stored for User-defined
How long system logs are stored for User-defined

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification Yes
Who accredited the ISO/IEC 27001 The Standards Institute Israel Certificate
ISO/IEC 27001 accreditation date 01/04/2017
What the ISO/IEC 27001 doesn’t cover Certificate is Applicable to Business processes: Research, development, sales and support of information security solutions and
technologies.
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security certifications No

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance certified Yes
Security governance standards ISO/IEC 27001
Information security policies and processes "The Information Security Department must provide direction and technical expertise to ensure that CyberArk’s information is properly protected. This includes consideration of confidentiality, integrity, and availability of information and the systems that handle it. The Department act as liaison on InfoSec matters between all departments, and must be the focal point for all InfoSec activities throughout CyberArk.

The Department performs risk-assessments, prepares action-plans, evaluates vendor-products, participates on in-houseIT system development projects, assists control Implementations, investigates information security breaches, trains staff members.

The InfoSec Department has the authority to create and periodically modify both technical standards and standard operating procedures that supports the InfoSec policy. When approved by appropriate CyberArk management, new requirements have the same scope and authority as if they were included in existing policy documents.

An information security steering committee, consisting of the CEO, GM, CIO and CISO
must meet bi-weekly to review the current status of information security at CyberArk,
approve and later review information security projects, and perform other necessary
high-level information security management activities. Other employees may join the
committee according to necessity and relevance.

An information security Audit committee is being updated with information security
work plan and risks management on a bi-quarterly basis."

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach Available on request
Vulnerability management type Supplier-defined controls
Vulnerability management approach As opposed to other cloud service providers who only provide a service but use 3rd-party technologies, CyberArk developed all the technologies it uses from scratch and only uses standard servers and routers (no 3rd-party technologies). This allows much more flexibility and rapid reaction to new threats and attack vectors as we do not have to wait for updates and patches – we do them ourselves immediately. In order to fight todays sophisticated and constantly changing attack patterns we have CyberArk’s 24x7 SOC - manned with security experts that can handle any attack in real time.
Protective monitoring type Undisclosed
Protective monitoring approach Available on request
Incident management type Undisclosed
Incident management approach We have defined process of incident response and an incident response team whose responsibilities include: Analysis of the security issue risk (based on Severity Matrix and CVSS), remediation and recommendation. SLA of handling the issue according to the risk level. In case the decision is to fix, the fix is like any standard feature\bug development, including validation (QA) and automation. Security bulletin - in case a security issue found risky, and requires patch, we have a mechanism of publishing "security bulleting" to our customers. This bulletin contains explanation of the issue, and mitigation steps (including patch if needed).

Secure development

Secure development
Approach to secure software development best practice Supplier-defined process

Public sector networks

Public sector networks
Connection to public sector networks No

Pricing

Pricing
Price £665.2 per user
Discount for educational organisations No
Free trial available Yes
Description of free trial Full product on qualified 14- day proof-of-concept trial. The CyberArk Discover and Audit (DnA) module is also available to run free-of-charge to baseline and establish PAM requirements

Service documents

pdf document: Pricing document pdf document: Service definition document pdf document: Terms and conditions
Service documents
Return to top ↑