CyberArk를 위한 온디맨드 HSM

Protecting privileged access management credentials presents one of the largest security risks an organization faces today. These access accounts allow control of an organization’s resources, disable security systems, and enable access to vast amounts of sensitive data. Forrester estimates that 80 percent of security breaches involve privileged credentials. These breaches can come from external attackers and malicious insiders seeking a way to gain direct access to the heart of the enterprise. The fast adoption of ‘everything to the cloud’ has increased the IT footprint, creating an increasingly porous enterprise perimeter. Protecting this widely dispersed corporate and customer data, along with their associated user credentials, is paramount to a corporation’s reputation, and their success.

At the core of CyberArk Privileged Account Security Solution is the CyberArk Digital Vault that contains a highly secure database for storing privileged account credentials, access control policies, credential management policies, and audit information. To protect both the Digital Vault database and the data stored within the database, CyberArk has designed a multi-layered encryption hierarchy that uses FIPS 140-2 compliant encryption. Each individual file and safe within the Digital Vault database is encrypted with its own unique encryption key. The Digital Vault Server uses key-hierarchy for protecting each object in the Vault. Based on this unique and highly secure approach, CyberArk has the top-level encryption key (server key) required to start the Digital Vault.

Once the vault is installed, the server key can be generated on the service, where it is stored as a non-exportable key.