Implementing Zero Standing Privilege with CyberArk

Overview

Zero Standing Privileges (ZSP) is a security model where no user or identity retains persistent privileged access. Instead, elevated access is provisioned dynamically on a just-in-time (JIT) basis and automatically revoked after use. CyberArk implements ZSP through its Secure Cloud Access (SCA) module, which creates ephemeral, scoped roles in cloud environments (AWS, Azure, GCP) that exist only for the duration of a session. The TEA framework -- Time, Entitlements, and Approvals -- governs every privileged access session.

When to Use

• When deploying or configuring implementing zero standing privilege with cyberark capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• CyberArk Identity Security Platform (Privilege Cloud or self-hosted)
• CyberArk Secure Cloud Access (SCA) license
• Cloud provider accounts (AWS, Azure, GCP) with admin access for integration
• ITSM integration (ServiceNow, Jira) for approval workflows
• CyberArk Vault configured with safe management

Core Concepts

TEA Framework (Time, Entitlements, Approvals)

ZSP Architecture

User requests access via CyberArk
        │
        ├── CyberArk evaluates request against policies:
        │   ├── Is user eligible for this access?
        │   ├── Does the request comply with TEA policies?
        │   └── Is approval required?
        │
        ├── [If approval needed] → Route to approver (ITSM/ChatOps)
        │
        ├── Upon approval:
        │   ├── CyberArk creates ephemeral IAM role in target cloud
        │   ├── Scopes permissions to minimum required entitlements
        │   ├── Sets session TTL (time-bound)
        │   └── Provisions temporary credentials
        │
        ├── User accesses cloud resources via session
        │   ├── All actions logged and recorded
        │   └── Session monitored for policy violations
        │
        └── Session expires:
            ├── Ephemeral role deleted
            ├── Temporary credentials revoked
            └── Zero standing privileges remain

CyberArk Components

Workflow

Step 1: Integrate Cloud Providers

AWS Integration:

1. Create a CyberArk integration role in AWS IAM
2. Configure cross-account trust policy allowing CyberArk to assume roles
3. Create IAM policies that define maximum allowed entitlements
4. Register AWS accounts in CyberArk SCA

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::CYBERARK_ACCOUNT:role/CyberArkSCARole"
        },
        "Action": "sts:AssumeRole",
        "Condition": {
            "StringEquals": {
                "sts:ExternalId": "cyberark-external-id"
            }
        }
    }]
}

Azure Integration:

1. Register CyberArk as an enterprise application in Microsoft Entra ID
2. Grant CyberArk application permissions: Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory
3. Create custom Azure roles with scoped permissions
4. Register Azure subscriptions in CyberArk SCA

GCP Integration:

1. Create a service account for CyberArk in GCP
2. Grant IAM Admin and Service Account Admin roles
3. Configure workload identity federation for cross-cloud access
4. Register GCP projects in CyberArk SCA

Step 2: Define Access Policies

Create policies that map job functions to cloud entitlements:

# CyberArk SCA Policy Example
policy_name: "developer-aws-read-access"

…