Softcat Limited

CyberArk CorePAS

CyberArk provide Privileged Access Management (PAM) software, this is an end-to-end solution that protects, manages and audits both user and application credentials, provides least privilege access and session isolation while recording, monitoring and responding to all real time privileged activity using intelligent threat analytics.

Features

  • Enterprise Password Vault (EPV)
  • Secure and tamper proof digital vault with multiple security layers
  • Privileged Session Manager (PSM)
  • Single-sign-on control point that isolates, records and audits privileged access
  • Privileged Threat Analytics (PTA)
  • Intelligent real time audit with ability to respond to threats.

Benefits

  • Manage Privilege at an Enterprise level through policy driven rules
  • Protection all privileged Accounts and SSH Keys
  • Control Access to Privileged Accounts
  • Initiate and Monitor Privileged Sessions
  • Manage application and service credentials
  • Comply with audit and regulatory requirements
  • Streamlined management of Privileged Accounts
  • Seamlessly integrate with enterprise systems
  • Detect and respond to known threats such as over-pass-the-hash
  • Risk Scoring of privileged use and session behaviours

Pricing

£8820 per unit

  • Education pricing available
  • Free trial available

Service documents

Framework

G-Cloud 11

Service ID

7 8 4 0 3 7 2 9 2 6 3 9 6 0 5

Contact

Softcat Limited

Charles Harrison

01612725766

psitq@softcat.com

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
"Application Access Manager (AAM)
Secrets management for DevOps and automation processes, prevent hardcoded credentials
On-Demand Privileges Manager (OPM)
Control and monitor super users commands and replacement of SUDO
Endpoint Privilege Manager (EPM & EPM SaaS)
Server and Workstation least privilege, application control, credential theft protection

Please ask for more
Cloud deployment model
  • Private cloud
  • Hybrid cloud
Service constraints
Supplied upon request, contact your CyberArk Partner to arrange an initial needs assessment session to capture your service specific requirements
System requirements
Available upon request

User support

Email or online ticketing support
Yes, at extra cost
Support response times
1 Hour
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
None or don’t know
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
Dependant on the level of support quoted
Support available to third parties
Yes

Onboarding and offboarding

Getting started
CyberArk Training and Certification is available and required before customers can access the main Support service. https://www.cyberark.com/services-support/professional-services/training-certification/
Service documentation
Yes
Documentation formats
  • HTML
  • ODF
  • PDF
End-of-contract data extraction
N/A
End-of-contract process
Customers who do not have an active license agreement cannot access the CyberArk Support service

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install
Yes
Compatible operating systems
  • Android
  • IOS
  • Linux or Unix
  • MacOS
Designed for use on mobile devices
No
Service interface
Yes
Description of service interface
Services such as knowledgebase, logging and reviewing support tickets as well as communicating with the support team. Downloading new versions, patches and software updates
Accessibility standards
None or don’t know
Description of accessibility
N/A
Accessibility testing
N/A
API
Yes
What users can and can't do using the API
N/A
API documentation
Yes
API documentation formats
PDF
API sandbox or test environment
Yes
Customisation available
Yes
Description of customisation
End users cannot customise the Solution. However, when setting up the CyberArk solution, it should be customised with several user defined parameters in line with the clients requirements. E.g. time logs files are kept for, rules for raising flags and reporting content & scheduling etc.

Scaling

Independence of resources
CyberArk Core PAS is not a shared service. It is implemented as an individual instance per enterprise so there is complete independence from the demands of other businesses.

Analytics

Service usage metrics
Yes
Metrics types
"Metrics include: transactions per second, number of users,
average queue time, number of successful
changes/verifications/reconciliations , number of failed
change/verifications/reconciliations."
Reporting types
  • Regular reports
  • Reports on request

Resellers

Supplier type
Reseller providing extra support
Organisation whose services are being resold
CyberArk

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • EU-US Privacy Shield agreement locations
User control over data storage and processing locations
Yes
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
At least every 6 months
Penetration testing approach
In-house
Protecting data at rest
Other
Other data at rest protection approach
We do not hold data at rest
Data sanitisation process
No
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
"CyberArk is a client hosted solution (even in the cloud), as such users will always exclusively own and hold their data which they can export and report on. Users can export metadata, but not passwords from
the solution. Users are able to produce reports on activity using the web portal."
Data export formats
  • CSV
  • Other
Other data export formats
SIEM API
Data import formats
CSV

Data-in-transit protection

Data protection between buyer and supplier networks
Private network or public sector network
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
"SLA's will be defined once the target operating model with the
buyer is agreed."
Approach to resilience
There are many methods of designing resiliency into a CyberArk system. It is always a highly business-critical system and the CyberArk solution has evolved over many years to maximise availability and remove single points-of-failure. Further details are available on request.
Outage reporting
Public Dashboard & Email

Identity and authentication

User authentication needed
Yes
User authentication
2-factor authentication
Access restrictions in management interfaces and support channels
For a full description of how the CuberArk solution Authenticates users, please see the attached service definition document: file name = CyberArk_Core Privileded Access Security_2019.pdf
Access restriction testing frequency
At least every 6 months
Management access authentication
2-factor authentication

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
User-defined
How long system logs are stored for
User-defined

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
The Standards Institute Israel
ISO/IEC 27001 accreditation date
1 April 2017
What the ISO/IEC 27001 doesn’t cover
Certificate is Applicable to Business processes: Research, development, sales and support of information security solutions and
technologies.
System/products: Cloud services: CRM, ERP. Coroporate networks, development enviroment.
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
No

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
"The Information Security Department must provide direction and technical expertise to ensure that CyberArk’s information is properly protected. This includes consideration of confidentiality, integrity, and availability of information and the systems that handle it. The Department act as liaison on InfoSec matters between all departments, and must be the focal point for all InfoSec activities throughout CyberArk.

The Department performs risk-assessments, prepares action-plans, evaluates vendor-products, participates on in-houseIT system development projects, assists control Implementations, investigates information security breaches, trains staff members.

The InfoSec Department has the authority to create and periodically modify both technical standards and standard operating procedures that supports the InfoSec policy. When approved by appropriate CyberArk management, new requirements have the same scope and authority as if they were included in existing policy documents.

An information security steering committee, consisting of the CEO, GM, CIO and CISO
must meet bi-weekly to review the current status of information security at CyberArk,
approve and later review information security projects, and perform other necessary
high-level information security management activities. Other employees may join the
committee according to necessity and relevance.

An information security Audit committee is being updated with information security
work plan and risks management on a bi-quarterly basis."

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Available on request
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
As opposed to other cloud service providers who only provide a service but use 3rd-party technologies, CyberArk developed all the technologies it uses from scratch and only uses standard servers and routers (no 3rd-party technologies). This allows much more flexibility and rapid reaction to new threats and attack vectors as we do not have to wait for updates and patches – we do them ourselves immediately. In order to fight todays sophisticated and constantly changing attack patterns we have CyberArk’s 24x7 SOC - manned with security experts that can handle any attack in real time.
Protective monitoring type
Undisclosed
Protective monitoring approach
Available on request
Incident management type
Undisclosed
Incident management approach
We have defined process of incident response and an incident response team whose responsibilities include: Analysis of the security issue risk (based on Severity Matrix and CVSS), remediation and recommendation. SLA of handling the issue according to the risk level. In case the decision is to fix, the fix is like any standard feature\bug development, including validation (QA) and automation. Security bulletin - in case a security issue found risky, and requires patch, we have a mechanism of publishing "security bulleting" to our customers. This bulletin contains explanation of the issue, and mitigation steps (including patch if needed).

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks
No

Pricing

Price
£8820 per unit
Discount for educational organisations
Yes
Free trial available
Yes
Description of free trial
Full product on qualified 14- day proof-of-concept trial. The CyberArk Discover and Audit (DnA) module is also available to run free-of-charge to baseline and establish PAM requirements

Service documents

Return to top ↑