Implementing Privileged Session Monitoring

When to Use

• Deploying or configuring session recording for all privileged access to critical servers and databases
• Meeting compliance requirements (PCI-DSS 10.2, SOX, HIPAA, ISO 27001) that mandate privileged activity monitoring
• Investigating an incident where an administrator or third-party vendor may have performed unauthorized actions
• Implementing real-time alerting for high-risk commands executed during privileged sessions
• Establishing a forensic audit trail of all administrative actions on production infrastructure

Do not use for monitoring standard user sessions or endpoint activity; use EDR/UBA solutions for general user behavior monitoring. Privileged session monitoring focuses specifically on elevated-access sessions.

Prerequisites

• CyberArk PAM Self-Hosted or Privilege Cloud deployment with Digital Vault configured
• CyberArk Privileged Session Manager (PSM) or PSM for SSH (PSMP) installed on a hardened Windows/Linux jump server
• Network architecture where all privileged access is routed through the PSM proxy (no direct RDP/SSH to targets)
• PVWA (Password Vault Web Access) deployed and accessible for session review
• Active Directory integration for authenticating PAM users
• Sufficient storage for session recordings (estimate: 50-250 KB per minute for RDP, 5-20 KB per minute for SSH)
• Alternatively for open-source: Teleport, Apache Guacamole with session recording, or script/ttyrec for Linux

Workflow

Step 1: Architecture — Route All Privileged Access Through PSM

Ensure no direct privileged access bypasses the recording proxy:

Architecture Overview:

  Admin User ──> PVWA (Web Portal) ──> PSM (Jump Server) ──> Target Server
       │                                     │                     │
       │         Credentials never           │   Session is        │
       │         exposed to admin            │   recorded and      │
       │                                     │   stored in Vault   │
       └── MFA + AD Auth ──────────────────> │                     │
                                              └── RDP/SSH proxy ──>│

Network Controls:
- Firewall: DENY direct RDP (3389) and SSH (22) to target servers from user networks
- Firewall: ALLOW RDP/SSH to target servers ONLY from PSM server IPs
- Firewall: ALLOW PVWA access (443) from admin user networks
- PSM server: Hardened, no internet access, local admin access restricted

Step 2: Configure PSM Connection Components

Define how PSM connects to target systems. In the PVWA administration console:

PVWA > Administration > Configuration > Connection Components

For Windows RDP targets:
  Connection Component: PSM-RDP
  Protocol: RDP
  Client Application: mstsc.exe
  Recording Settings:
    Record Sessions: Yes
    Recording Format: AVI (video) + Keystrokes (text)
    Record Windows Titles: Yes

For Linux SSH targets:
  Connection Component: PSM-SSH
  Protocol: SSH
  Client Application: PSM-SecureCRT or PSM-Putty
  Recording Settings:
    Record Sessions: Yes
    Recording Format: AVI + Text commands
    Record Unix Commands: Yes

For Database targets (SQL Server Management Studio):
  Connection Component: PSM-SSMS
  Protocol: Custom
  Client Application: SSMS.exe
  Recording Settings:
    Record Sessions: Yes
    Record SQL Queries: Yes (via keystroke logging)

Step 3: Configure Session Recording Policies

Define recording rules based on risk level and compliance requirements:

PVWA > Administration > Platform Management > [Platform] > Session Management

Session Recording Settings:
  Enable Session Recording: Yes
  Recording Type: Record and Save (not just Monitor)

  Keystroke Logging:
    Enable Transcript: Yes
    Enable Window Events: Yes

  Storage:
    Recordings Storage Location: Vault (encrypted, tamper-proof)
    Retention Period: 90 days (adjust per compliance requirement)

    PCI-DSS:  Retain for 1 year, available for 3 months
    SOX:      Retain for 7 years
    HIPAA:    Retain for 6 years

  Compression:
    Enable Recording Compression: Yes
    Compression Level: Medium (balance storage vs. quality)

For granular control, configure per-safe recording policies:

Safe: Production-Servers-Admin
  Record all sessions: Yes

Safe: Development-Servers
  Record all sessions: No (optional for non-production)

Safe: Third-Party-Vendor-Access
  Record all sessions: Yes
  Enable real-time monitoring: Yes

…