CyberArk Privileged Session Manager for Cloud

Privileged Access Management (PAM) has become a central cybersecurity discipline for securing and governing privileged access for IT administrators and privileged business users across hybrid IT environments. Privileged shared accounts in cloud and web applications create a broad attack surface, often lacking strong multi-factor authentication (MFA), and making cloud admins frequent targets due to their extensive access to cloud consoles, mission-critical SaaS apps, shared corporate social media accounts, and DevOps consoles.

Within PAM, Privileged Session Management (PSM) is a core baseline capability alongside Shared Account Password Management (SAPM) and Controlled Privileged Elevation and Delegation Management (CPEDM). PSM addresses credential exposure, limited visibility into (outsourced) operations, weak auditing/monitoring, and insufficient forensic readiness. Key features include session isolation via secure session brokering, SSO, time- and approval-based controls, command controls and termination, session recording/playback, real-time monitoring and alerting, and forensic investigation support.

CyberArk’s core solution combines credential protection (Enterprise Password Vault), session isolation/monitoring (Privileged Session Manager), and threat detection/response (Privileged Threat Analytics), supplemented by modules for application credentials, endpoint privileges, and DevOps. The Privileged Session Manager operates as an agentless secure proxy, integrating with the vault to inject credentials so administrators can log in without knowing passwords, reducing credential theft and hijacking risks. It supports broad target coverage, tamper-resistant session storage, command-level search, dual control for supervised sessions, and integrations for MFA and ITSM-driven approvals.

To meet cloud access patterns, CyberArk introduced Privileged Session Manager for Cloud, strengthened by the acquisition of Vaultive (March 2018). It emphasizes native connectors, strong MFA even where third-party MFA integrations are unavailable, continuous per-application and per-transaction monitoring, correlated activity views across cloud and on-premises, and risk-based scoring via analytics. The offering is positioned as distinct from CASB tools, aiming to unify privileged controls without disrupting native user experience.

• PAM baseline technologies include Privileged Session Management (PSM), Shared Account Password Management (SAPM), and Controlled Privileged Elevation and Delegation Management (CPEDM).
• PSM addresses credential exposure, limited visibility into outsourced operations, lack of privileged activity auditing, and weak forensic investigation capabilities.
• CyberArk’s Core Privileged Access Security Solution includes Enterprise Password Vault, Privileged Session Manager, and Privileged Threat Analytics.
• CyberArk Privileged Session Manager operates as an agentless secure proxy server acting as a centralized control point.
• Privileged Session Manager integrates with Enterprise Password Vault to retrieve and inject passwords so administrators can log in without knowing them.
• Session recordings are stored in tamper-resistant vault storage in a compressed and retrievable format.
• Command-level indexing and search are provided for recorded sessions to support playback and forensic investigations.
• Dual control allows approved auditors or managers to supervise live sessions and intervene if required.
• CyberArk selectively acquired Vaultive technology in March 2018 to strengthen cloud application privilege management capabilities.
• Privileged Session Manager for Cloud supports AWS, Azure, Google Cloud consoles, Salesforce, OpenShift console, and Twitter, LinkedIn, Facebook, and Instagram.

• “Privileged shared accounts access to cloud and web applications is a broad attack surface that lacks the fundamental strong multi-factor authentication security principle.”
• “Cloud administrators and privileged business users become frequent targets for cyber-attacks as they have broad and often unlimited access to a range of management consoles, mission critical SaaS applications, shared corporate social media accounts as well as DevOps consoles.”
• “PSM is also one of the most sought-after security capabilities by security leaders to gain visibility and control over privileged activities in their IT environment that is consistent with the organization’s security policies and regulatory regimes.”
• “CyberArk Privileged Session Manager operates in an agent-less, secure proxy server configuration that acts as a centralized control point for securing access, enforcing monitoring and recording of privileged activities across the datacenter.”
• “As a single-access control point for access to multiple systems, Privileged Session Manager prevents malware spread by putting a hardened proxy server layer between the easily compromised user end-points and the protected target systems.”
• “The implications of unmonitored and unaudited administrative access for cloud can be disastrous not only for an organization’s security but also for its business.”
• “Most data theft or malicious activities go undetected for a long period of time because the channel for credential theft is entirely different from the channel of exploitation.”
• “CASB’s are focused on providing security controls and management support for standard business users and do not address the detailed session control, monitoring as well as analytics and alerting requirements of privileged access as well as corporate use of social media.”
• “Most proxy-based CASB vendors, are unable to match the granularity of session controls such as user activity correlation with sensitive credentials retrieval, risks detection in post-logon activity and full accountability for operations in cloud applications and management consoles…”
• “A future integration with CyberArk’s Privilege Cloud SaaS offering will offer an entirely cloud-based Privileged Session Manager solution that is delivered from the cloud for applications and infrastructure residing in the cloud.”