CyberArk Privileged Access Management Implementation Guide for Enterprises

Overview

CyberArk is an enterprise Privileged Access Management (PAM) platform designed to protect privileged accounts, application secrets, and administrative sessions. Enterprises use it to reduce credential theft risk, enforce least privilege, automate password rotation, isolate privileged sessions, and provide audit trails for compliance frameworks such as ISO 27001, PCI DSS, SOX, and NIS2.

Its core value is the separation of humans and workloads from direct knowledge of privileged credentials. Instead of sharing static passwords, administrators authenticate to CyberArk components such as the Digital Vault, Password Vault Web Access (PVWA), Central Policy Manager (CPM), and Privileged Session Manager (PSM). CyberArk then brokers access, rotates credentials, and records privileged sessions.

Architecture

A typical CyberArk deployment includes:

• Digital Vault: Hardened credential repository storing passwords, keys, and metadata.
• PVWA: Web portal and API layer for user access, administration, and integrations.
• CPM: Rotates passwords and verifies account reconciliation.
• PSM: Proxies RDP, SSH, and web sessions without exposing credentials.
• PSM for SSH: Isolates SSH access and records command activity.
• AAM/Secrets Manager: Delivers application secrets to workloads and CI/CD pipelines.

Deployment models

• Self-hosted on Windows Server for regulated or air-gapped environments.
• Hybrid with on-prem Vault and cloud-hosted workloads.
• SaaS via CyberArk Identity Security Platform for reduced operational overhead.

Data flow

1. User authenticates to PVWA using LDAP, SAML, or RADIUS.
2. PVWA authorizes access to a Safe and target account.
3. For direct credential retrieval, PVWA requests the secret from the Vault.
4. For brokered access, PSM retrieves the credential from the Vault and initiates the target session.
5. CPM rotates the password after use or on policy schedule.
6. Audit logs and session recordings are retained for investigations.

Implementation Guide

1. Prepare infrastructure

• Deploy separate Windows servers for Vault, PVWA, CPM, and PSM.
• Join PVWA, CPM, and PSM to the domain; keep Vault isolated.
• Open required ports, typically 1858 to Vault, 443 to PVWA, and target-specific ports from PSM.

2. Validate connectivity

Test-NetConnection vault01.corp.example.com -Port 1858
Test-NetConnection pvwa01.corp.example.com -Port 443

3. Register a REST API session

curl -sk -X POST "https://pvwa01.corp.example.com/PasswordVault/API/Auth/LDAP/Logon" -H "Content-Type: application/json" -d '{"username":"svc_cyberark_bind","password":"Str0ngPass!"}'

4. Create a Safe

curl -sk -X POST "https://pvwa01.corp.example.com/PasswordVault/API/Safes" -H "Authorization: <token>" -H "Content-Type: application/json" -d '{"SafeName":"Unix-Production","Description":"Production Unix privileged accounts","ManagingCPM":"PasswordManager"}'

5. Onboard an account

curl -sk -X POST "https://pvwa01.corp.example.com/PasswordVault/API/Accounts" -H "Authorization: <token>" -H "Content-Type: application/json" -d '{"name":"root@rhel-app-01","address":"rhel-app-01.corp.example.com","userName":"root","platformId":"UnixSSH","safeName":"Unix-Production","secretType":"password","secret":"InitTempPass#2024"}'

6. Configure a platform policy

Edit the platform XML or policy via PVWA to enforce:

• password length 24
• change every 1 day
• one-time access for break-glass accounts
• immediate reconcile on failed verification

7. Enable session isolation

Configure PSM connection components for RDP and SSH, then assign users to Safe roles with Use accounts but not Retrieve passwords where possible.

8. Integrate SIEM

Forward PVWA, CPM, and PSM logs to Splunk or Microsoft Sentinel using syslog or Windows Event Forwarding.

Code Examples

curl -sk -X GET "https://pvwa01.corp.example.com/PasswordVault/API/Accounts?search=root" -H "Authorization: <token>"

safe_permissions:
  role: Linux-Admins
  permissions:
    useAccounts: true
    retrieveAccounts: false
    listAccounts: true
    accessWithoutConfirmation: false
    initiateCPMAccountManagementOperations: false

import requests
base = "https://pvwa01.corp.example.com/PasswordVault/API"
token = requests.post(f"{base}/Auth/LDAP/Logon", json={"username":"svc_api","password":"SecretPass!"}, verify=False).text.strip('"')
headers = {"Authorization": token}
r = requests.get(f"{base}/Accounts?search=oracle", headers=headers, verify=False)
print(r.status_code)
print(r.text)

Security Hardening

• Place the Vault on a dedicated hardened segment with strict inbound ACLs.
• Enforce MFA for all PVWA access and require federation through SAML where possible.
• Disable direct password retrieval for admins who can use PSM brokered sessions.
• Use TLS 1.2+ with enterprise-issued certificates on PVWA, CPM, and PSM.
• Rotate reconciliation accounts and protect them in separate Safes.
• Restrict local administrator rights on CyberArk servers and use jump hosts for maintenance.
• Send session recordings and audit logs to immutable storage or SIEM retention tiers.

Comparison

Troubleshooting

Error 1: PVWA authentication failure

Log sample:

[2025-02-14 08:21:44,912] ERROR CyberArk.Services.Authentication LDAP logon failed for user svc_api. Code: ITATS542I Invalid credentials

Fix: Verify LDAP bind account password, domain format, and clock sync between PVWA and domain controllers.

Error 2: CPM password change failed

Log sample:

2025-02-14 09:03:11,227 [CPM] PasswordManager.exe Warning CACPM406E Change password process failed for root@rhel-app-01. SSH authentication error.

Fix: Confirm platform policy matches target OS, reconcile account is valid, and target allows the negotiated SSH ciphers.

Error 3: PSM session launch denied

Log sample:

2025-02-14 09:41:02,118 PSMAppLauncher.exe Error [PSMConnect] Connection component SSH requires exclusive access; account is locked by another session.

Fix: Review exclusive access settings, clear stale locks in PVWA, and verify session timeout policies.

Best Practices

Do

• Use separate Safes for production, non-production, and break-glass accounts.
• Prefer Connect via PSM over password reveal.
• Apply granular Safe permissions, for example allowing DBAs to use oracle-prod without retrieving the password.
• Rotate passwords immediately after emergency access.
• Integrate with SIEM and alert on mass retrievals, failed CPM changes, and after-hours privileged access.

Don't

• Do not place Vault and PVWA on the same server.
• Do not grant Retrieve accounts when Use accounts is sufficient.
• Do not use shared unmanaged root passwords outside CyberArk.
• Do not leave platform defaults unchanged for high-risk systems such as domain controllers, firewalls, and hypervisors.