The following sections outline security considerations for Privileged Access Manager at Application Layer level:
NOTE:
Privileged Access Manager has TLS 1.2 enabled by default.
For Password Management, ensure to use ports 5985 and 5986.
Privileged Access Manager bundles FIPS-capable OpenSSL 1.0.2 and for encrypting all communication channels for all communication channels with internal and external services. It also uses OpenSSL 1.0.2 for the encryption of data in details such as, Credential Vault, confidential configuration data.
Ensure to use the privileged access approach while accessing the product. For more information, see Configuring Privileged Access.
The following are recommended access policies:
Allow/Deny commands instead of the complete session access. For more information, see Application Command List.
Just-In-Time Access Framework. For more information, see Just In Time Access Framework.
Configured user roles added in the Administrator group instead of complete access. For more information, see Configuring a User Role.
Configuring Command Risk. For more information, see Setting the Command Risk.