CyberArk EPM Implementation and Integration

1. Executive Summary This project aims to replace the current BeyondTrust PrivilegeManagementPolicyEditor elevation solution and GPO-based administrator controls with CyberArk Endpoint Privilege Manager (EPM). CyberArk EPM will help remove permanent local administrator rights and provide secure, controlled administrative access only when required through Just-in-Time (JIT) access. The solution will enforce Least Privilege and Zero Trust security principles, control application elevation, manage local administrator passwords (LAPS), and centrally govern privileged access across Windows, macOS, and Linux endpoints. The implementation will improve endpoint security, reduce the risk of credential theft and ransomware attacks, strengthen compliance, and provide better visibility and auditing of privileged activities. 2. Project Objectives Primary Objectives • Eliminate permanent local administrator rights. • Replace BeyondTrust elevation policies with CyberArk EPM. • Implement Just-in-Time (JIT) privilege elevation. • Deploy endpoint privilege management across Windows, macOS, and Linux devices. • Integrate CyberArk EPM with Active Directory (Privilege Guard OUs) and Microsoft Entra ID. • Implement LAPS for local administrative accounts. • Prevent credential theft and ransomware attacks. • Improve visibility, auditing, and compliance reporting. 3. CyberArk EPM Deployment Platform Configuration • CyberArk SaaS Tenant Configuration • Administrative Roles Configuration • Administrator RBAC Configuration • Communication Configuration • Security Hardening 4. Privilege Elevation Management Elevation Policy Creation Policy Methods • Trusted Publisher • Digital Certificate • File Hash CyberArk EPM Implementation | Scope of Work • File Path • Parent Process • Command Line • URL Reputation • Source-Based Trust 5. Application Control & Ransomware Protection Application Governance Controls • Block unauthorized applications • Block executable files downloaded from the internet • Control PowerShell execution 6. Just-In-Time (JIT) Administration JIT Framework Features • Temporary Local Admin Access • Time-Based Access • Session-Based Elevation • Approval-Based Elevation • Emergency Access Requests • Self-Service Elevation Integration • Ticketing System Integration • Approval Workflow Integration • Audit Logging 7. Local Administrator Password Management (LAPS) Password Security Controls Windows • Windows LAPS Integration • Password Rotation • Password Retrieval Control macOS • Local Administrator Password Rotation • Secure Storage Configuration Linux • Privileged Account Password Rotation • Secure Retrieval Process CyberArk EPM Implementation | Scope of Work Deliverables • LAPS Configuration • Password Rotation Policy • Recovery Procedures • 8. Active Directory, Microsoft Entra ID & SIEM Integration Activities • Synchronize Microsoft Entra ID and map on-premises elevation OUs 9. Monitoring & Policy Optimization Monitoring Mode Activities • Application Monitoring • Administrative Activity Monitoring • Privilege Usage Monitoring • Elevation Requirement Discovery 10. Advanced Policy Management Dynamic Policy Controls Conditions • Time-Based Access • Day-Based Access • Location-Based Policies • Network-Aware Policies • Script Controlled Policies 11. Tamper Protection Endpoint Agent Security Features • Self-Protection • Secure Uninstallation • Safe Mode Protection • Service Protection • Configuration Tamper Protection CyberArk EPM Implementation | Scope of Work 12. Reporting, Auditing & SIEM Integration Reporting Standard Reports • Policy Audit Reports • User Activity Reports • Application Reports • Endpoint Compliance Reports • Privilege Usage Reports 13. Validation Tests • Application Elevation • Blocking Policies • JIT Administration • LAPS Rotation • Threat Protection • Reporting • SIEM Logging