CyberArk

DiscoveryandAudit(DNA)ManualDiscoveryCyberArkDiscovery&Audit(DNA)

FreetooltogainvisibilityoftheprivilegedaccountenvironmentDiscoverallaccounts(privilegedandnon-privileged)Identifyprivilegedaccountsandcredentialsincluding:Embedded&hard-codedcredentialsinWebSphere,WebLogicandIISserversGoldenTicketattackriskSSHkeysPasswordhashesInsecureprivilegeescalationsinUnixEasilyviewresultsinthe

ExecutiveSummaryDashboardEnhanceinsightwithvisualmapsof

passwordhashesand

SSHkeytrustrelationshipsGainvisibilitywithoutimpactingperformanceRequiresnoinstallationConsumesverylowbandwidthHowdoesitwork?

Simpletorun.Conciseresults.ExecutiveSummaryDashboardDNAprovides:Alotofinformation…WhatshouldIdowithit?HowcanIuseit?PasswordAge

Pass-The-HashVulnerabilities

DomainAccountsDistribution3SimpleStepstoDNAAnalysis1.DNA–SortbyPasswordAge1.DNA–SortbyPasswordAge2.DNA–SortbyP-t-HVulnerabilities+1+2DNA–Combinationof:P-t-H&PasswordAgeHowvulnerableyouaretocredentialtheft?Howcananattackbecarriedoutinmyorganization?WhichserversshouldIprotectfirst?Whichaccounts?2-Asaresult-HowmanymachinesarevulnerabletoPass-the-Hash?1-Howmanyaccounts&machinescausevulnerabilities?3-WhatifIusedPrivilegedAccountSecuritytomanagemyaccountsbyutilizingOne-TimePasswords?WhatcanCyberArkdotomitigatePtH?LeveragePrivilegedAccountSecurityto:Hasheseobsoletewith:Frequentpasswordchanges,e.g.One-timepasswordsControllingandmanagingthe“keystothekingdom”Implementing“l(fā)east-privilege”strategy(OPM)decreasesprobabilityofriskonceahashisstolenLeastprivilegePSMeliminatesCredentialTheftonendpointswith

P-SSO(preventscredentialtheftandnot“hash”theft)PrivilegedSingle-Sign-OnWhenpossible,uselocalinsteadofdomainaccountsCyberArkhelpsdetect,provision,managelocalaccountsaswellastransparentlyconnecttotargetsystemsSegregationofduty3.DNA–DomainAccountsDistributionActiveDirectoryWinSRV1WinSRV2WinSRV3WinSRV4GoldenTicketattackriskresultsWhataboutDNAforUnix/Linuxplanning?PasswordAgeFlagspotentialexcessiveprivilegesinSudoersWhataboutDNAforUnix/Linuxplanning?(cont.)SSHKEYsSSHKeyDiscovery:

ExecutiveDashboard+MapHard-CodedCredentialsinWebSphere,WebLogicandIISServersWhatdoyouwanttoshowyourcustomerwithDNA?TherearemoreprivilegedaccountsthanthecustomerwillcaretoacknowledgeMultiplemethodswhereattackerscanstealcredentialsandreuseitoverandagainStolenprivilegedcredentialsputtheattackerinchargeofyournetworkServersarehighlylucrativeforpass-the-hashServiceaccountsarehighlydangerouswhenleftunchangedOftenwithnon-expiringpasswords.Theolderthepassword,thehighertheriskHowdoyougetDNA?ContactyourCyberArkSEorSalesManagerProspects–1monthlicensewith100nodesExistingcustomers–6monthslicensewithunlimitednodesFreetouseforpartnersHowdoyouhandleobjectioninusingDNA?DNAdonotmakeanychangestothemachineitisrunfrom(SomeregistrychangesforEULAacceptance,report,andlogfiles).DNAdonotmakeanychangestotargetmachine(Readonly)DNAscanconsumeslownetworkbandwidthandinsignificantnetworkresourcesDomainadministratorforWindows…orequivalentDomainuser(readtoAD,localadmintoWindows)RootforLinux…oradminaccountwithsudoDNAValuesDNAScansPOCsSalesOpportunitiesDNAValuesMoreDNAScans=MoreSalesOpportunitiesHowmanyDNAscansareyoudoingtoday?ASEANDNASPIFFCampaign

(SalesPerformanceIncentiveFundFramework)Thiscouldbeyours!AppleWatchSports42mmTerms&ConditionsIncentiveAwardAPPLEWATCHSPORTS42mmAUTHORIZEDRESELLERS

Conductaminimumof6scansAUTHORIZEDDISTRIBUTORSSubmitaminimumof9scanswhichmayONLYbeaccumulatedfromnon-authorizedpartnersTerms&ConditionsINCENTIVEPERIODAugust1st,2016toDecember31st,2016.AppleWatchSportswillbeawardedtothefirst8partnerSEswhofulfilthecriteriaasstated.

AllscanssubmittedhastobeapprovedbyCyberArk’sPSTeaminASEANtoqualifytowardsthisincentiveprogramme.Terms&Conditions:ScanCriteriaAnyscanorsetofscansperformedatthesameprospectorcustomercustomer’sBusinessUnitenvironmentwillbecountedasoneeligiblescan.Eachscanmustcoveratleast100machines.PartnermustprovideoneofthefollowingconfirmationsthatDNAscanwasperformed(inbothscenarios,thenameofthecustomer/prospectmustbedisclosed):A“raw”o