Anyone moved away from CyberArk PAM back to regular AD accounts?

Posted by Sufficient_Duck_8051@reddit | sysadmin | View on Reddit | 13 comments

Has anyone here moved away from CyberArk PAM-managed accounts back to standard Active Directory accounts for admin/service access? In our environment CyberArk added quite a bit of operational overhead. Checkouts, password rotations, etc. sometimes slow down troubleshooting and daily work, so we’re starting to question whether the complexity is worth it in our case.

Reply to Post

13 Comments

[-]

Lancegoodheart@reddit

I don't think going back to AD accounts is your best option for securing admin access. If your challenge is admin rights - the tools suggested in this thread work really well. If its password rotation you have alternatives like Secure-den Unified PAM that are quite fast for daily work. Move away from complexity - not from security best practices. I also agree with u/ThyDarkey \- these 'Enterprise' PAM tools do a lot, in many cases more than what is required - at a very high cost.

[-]

acurtis85@reddit

Its a tradeoff, security vs convenience, we had admin accounts and recently moved to PAM but because of the industry I am in, can't risk having 24/7 admin rights on an account. We don't use CyberArk and instead use Netwrix but same concept, elevate/request rights, have those rights for a period of time, and it times you out. From a compliance standpoint.

[-]

Successful-Assist986@reddit

Have you checked out AutoElevate? I went from Cyberark to them and I couldn’t be happier

[-]

Geekestro@reddit

You can list down your exact security requirements, if its just admin/service access - there are PAM tools with much lesser overhead that are easier to implement. Something like Securden PAM (they have a free download), or Netwrix.

[-]

DiabolicalDong@reddit

If you chose Cyberark for compliance, then look into other PAM products. Some are easier to set up and work with. Requiring a technician with a specialized certification (issued by Cyberark) for running the solution is a huge red flag for me. They are likely complicating things unnecessarily just to strengthen their revenue stream from their academy.

[-]

SenTedStevens@reddit

At a previous place, we gradually phased out CyberArk because of random issues with the vaults and the SMEs would accidentally click on the reconcile(?) button on core service accounts causing P1 issues at the worst times. I was in so many training meetings effectively saying, "Unless you know exactly what you're doing, DON'T HIT RECONCILE ON YOUR ACCOUNTS!"

[-]

ThyDarkey@reddit

We ditched CyberArk due to the overhead of the tech. Causing full stops every other month, for various bit we had it integrated with. We ripped it out and replaced it with beyond trust pathfinder. Overall been a good experience thus far only been 3 months since the full integration.

[-]

Anyone moved away from CyberArk PAM back to regular AD accounts?

Reply to Post

13 Comments

Lancegoodheart@reddit

acurtis85@reddit

Successful-Assist986@reddit

Geekestro@reddit

DiabolicalDong@reddit

SenTedStevens@reddit

ThyDarkey@reddit

Exetras@reddit

Test-NetConnection@reddit

xxdcmast@reddit

cyr0nk0r@reddit

XInsomniacX06@reddit

TheCyberThor@reddit