The PAM Playbook

Championship Implementation Guide

CyberArk Core Privileged Access Security (PAS)

1. Executive Summary: The Championship Strategy

The CyberArk Core PAS is a complex suite designed to be the “Master’s Jacket” of your security infrastructure¹¹¹¹. The primary objective of this implementation is to secure, manage, and monitor every privileged account across the Golf Cyber landscape². By deploying this solution, Golf Cyber will centralize credential management, enforce automated rotation, and provide fully audited access to all critical systems³.

2. Architectural Overview: The Pro’s Bag

The deployment consists of four core components that work together to secure the course⁴ :

Digital Vault (EPV):

The hardened “Trophy Vault” where all secrets and credentials are stored securely⁵.

Password Vault Web Access (PVWA):

The web-based “Clubhouse” interface for users and administrators⁶.

Central Policy Manager (CPM):

The automated “Grounds Crew” engine that changes passwords and performs system health checks⁷.

Privileged Session Manager (PSM):

The “Course Proxy” that records, isolates, and monitors all RDP/SSH sessions⁸.

3. Pre-Implementation: Course Requirements

Before teeing off, ensure the following hardware and network specifications are met ⁹ :

Hardware Requirements

Component	CPU	RAM	Storage	Notes
Vault	4 vCPU	16GB	2x 100GB HDD	Must be standalone/non-domain joined¹⁰
Component Servers	4 vCPU	16GB	100GB HDD	CPM/PVWA/PSM (Separate recommended)¹¹

Software & Connectivity

OS:

Windows Server 2016, 2019, or 2022¹².

Database:

Built-in Vault database; no external SQL required¹³.

Network Ports:

* Port 1858 (TCP): Vault to Component Servers¹⁴.

Port 443 (HTTPS):

Users to PVWA15.

Port 3389/22:

PSM to Target Servers (RDP/SSH)¹⁶.

4. Implementation Roadmap: The Playbook

Phase 1: The Core (Vault Installation)

Server Hardening:

Run the CyberArk hardening script to disable unnecessary services and close all ports except 1858¹⁷.

Vault Setup:

Execute the Digital Vault installation¹⁸.

Key Generation:

Generate the Master and Operator Keys¹⁹.

Critical: Store the Master Key on a physical USB/CD and place it in a physical safe²⁰.

Licensing:

Upload the provided license.xml file²¹.

Phase 2: The Interface (PVWA & CPM)

IIS Role:

Enable the IIS role on the PVWA server before running the installer²².

CPM Setup:

Install the CPM; this requires a dedicated “Password Manager” user in the Vault²³.

Verification:

Confirm the interface is active by logging into the Password Vault web portal²⁴.

Phase 3: The Proxy (PSM Installation)

RDS Role:

Install the Remote Desktop Services (Session Host) role²⁵.

PSM Install:

Run the PSM installer and link it to the Vault²⁶.

Hardening:

Apply the PSM hardening GPO to ensure users cannot “break out” of their proxy sessions²⁷.

5. Post-Installation: The Scorecard Setup

Identity Integration:

Integrate with Active Directory (LDAP) and map AD groups (e.g., GolfCyber_Admins ) to Vault groups²⁸.

Safe Structure:

Establish a logical safe structure, including Golf_Windows_Admins, Golf_Network_Core, and Golf_Database_Prod²⁹.

Key Generation:

Account Onboarding: Configure platforms (Windows/Unix) and use Bulk Upload or the Discovery Tool to ingest accounts³⁰.

Verification:

Trigger a “Change” task in the CPM to confirm communication with target systems³¹.

6. Pro Tips & Groundskeeping

Dual Control:

Enable “Request/Approval” workflows for highly sensitive Domain
Admin accounts³².

SIEM Integration:

Forward Vault syslog data to your SOC (Splunk/Sentinel)³³.

Key Generation:

Disaster Recovery: Implement a DR Vault in a separate geographic zone for
high availability³⁴.

Monthly Health Check:

Perform credential rotation tests and review Compliance
Reports in the PVWA³⁵.

Download The PAM Playbook