Architecture

CyberArk Architecture and Core Components

How the vault, the management components, the endpoint controls and the integrations fit together.

Architecture

A small set of components around a hardened vault

CyberArk Training is built as a small number of tightly coupled components around a hardened vault. Understanding how those components connect makes it much easier to plan a deployment, write a firewall rule set, or test a recovery. The architecture is deliberately centralised: the vault holds the secrets, and every other component exists to broker controlled access to it.

The sections below describe the main components, the tiers they sit in, the path a privileged session takes, and the resilience choices that matter most during a rollout.

At a glance

The four architectural tiers

Keeping the tiers separate is the single most useful design decision you can make.

Vault tier

The Digital Vault cluster and its disaster recovery vault. Tier zero, isolated, and reachable only by the management components.

Management tier

The web interface, the policy engine and the session gateway. These broker access between people and the vault.

Endpoint tier

Agents and controls on workstations and servers that reduce standing administrator rights.

Integrations

Directory services, multi factor authentication, SIEM and ticketing that the platform relies on.

Core components

Digital Vault

The Digital Vault is the centre of the platform. It stores privileged credentials and the policies that govern them, encrypted and protected by strict access control. The vault is typically deployed as a hardened server or appliance, can run as an active and passive pair, and can be paired with a separate disaster recovery vault. Users never connect to the vault directly; only authorised components do, over a defined and narrow set of ports.

Password Vault Web Access

Password Vault Web Access, usually shortened to PVWA, is the web interface and API layer. People use it to request, retrieve and check in accounts, while administrators use it to define safes, policies and authorisations. It also exposes a REST API that other tools use to automate access without touching the vault itself.

Central Policy Manager

The Central Policy Manager is the policy engine. It rotates, verifies and reconciles passwords on the systems that hold privileged accounts, using connectors for operating systems, databases, network devices and applications. When a rotation fails, reconciliation brings the stored credential and the target system back into agreement.

Privileged Session Manager

The Privileged Session Manager is the session gateway. A user connects to the gateway rather than to the target system, and the gateway opens the session on their behalf. This isolates the session from the endpoint, records it, and can restrict which commands or applications are available. Recordings and logs are kept for audit and investigation.

Administrative clients

CyberArk Administrator and the PrivateArk Client are the administrative tools used to manage the vault itself: safe creation, user and group management, and day to day operations. Access to these tools should be limited to a very small group and protected with strong authentication.

Discovery and Audit

Discovery and Audit scans the environment for privileged accounts and the dependencies between them. It turns an unknown estate into an inventory, which is the starting point for onboarding and for understanding which systems depend on which credentials.

Endpoint Privilege Manager

Endpoint Privilege Manager removes standing local administrator rights from endpoints and applies least privilege instead. It can elevate specific applications on request, apply application control, and help defend against credential theft on workstations.

Privileged Threat Analytics

Privileged Threat Analytics watches privileged behaviour for patterns that do not fit. It raises alerts when activity looks anomalous, and it forwards events to the SIEM so that the security team can correlate them with the rest of the estate.

Conjur

Conjur extends the same discipline to applications, containers and pipelines. It stores secrets outside code and configuration, and exposes them through an API and policy as code, so that software can authenticate without hard coded credentials.

CyberArk Identity

CyberArk Identity provides workforce identity services such as single sign on, multi factor authentication and lifecycle management. It strengthens the front door to the platform and to the applications that surround it.

How a privileged session flows

Authentication. The user signs in to PVWA, ideally through the directory and with multi factor authentication.
Request. The user asks for an account or a connection. PVWA checks the policy and the user's authorisation before anything is released.
Credential handling. The vault supplies the credential to the authorised component. The user does not see the password unless policy explicitly allows it.
Rotation. The Central Policy Manager rotates and reconciles the credential according to policy, so the secret stays fresh.
Session brokering. The Privileged Session Manager opens the session to the target system and isolates it from the endpoint.
Recording. The session, the commands and the metadata are recorded and stored for audit.
Detection. Events flow to Privileged Threat Analytics and the SIEM, where unusual behaviour is flagged for review.

Deployment and resilience

Network placement. Keep the vault in its own protected segment. Allow only the required ports from the management components, and never expose the vault to user networks.
High availability. Run the vault as an active and passive pair, and place multiple PVWA, Central Policy Manager and Privileged Session Manager instances behind load balancing.
Disaster recovery. Pair the primary vault with a disaster recovery vault, and test failover rather than assuming it works.
Backup. Back up the vault on a schedule, store the backup separately, and verify that a restore is possible.
Hardening and patching. Harden every component, keep the platform patched, and review the configuration after each change.
Monitoring. Send component and session events to the SIEM, and alert on failed authentications, unusual access and rotation failures.

Design principles

Isolate the vault and treat it as tier zero.
Separate duties so that no single person controls both policy and audit.
Deny by default, and grant access by role with a clear owner.
Record privileged sessions and review the recordings.
Rotate credentials on a schedule and after use where possible.
Integrate with identity and monitoring from the start, not as an afterthought.