Implementing Privileged Session Monitoring

Step 1: Route All Privileged Access Through PSM

Architecture:
  Admin User --> PVWA (Web Portal) --> PSM (Jump Server) --> Target Server

Network Controls:
  - DENY direct RDP (3389) / SSH (22) to targets from user networks
  - ALLOW RDP/SSH to targets ONLY from PSM server IPs
  - ALLOW PVWA access (443) from admin user networks

Step 2: Configure PSM Connection Components

PVWA > Administration > Connection Components

For Windows RDP:
  Connection Component: PSM-RDP
  Record Sessions: Yes
  Recording Format: AVI (video) + Keystrokes (text)
  Record Windows Titles: Yes

For Linux SSH:
  Connection Component: PSM-SSH
  Record Sessions: Yes
  Record Unix Commands: Yes

Step 3: Configure Session Recording Policies

PVWA > Platform Management > Session Management

  Enable Session Recording: Yes
  Keystroke Logging: Enable Transcript + Window Events
  Storage: Vault (encrypted, tamper-proof)

  Retention periods (per compliance):
    PCI-DSS:  1 year available, 3 months accessible
    SOX:      7 years
    HIPAA:    6 years

  Per-Safe policies:
    Production-Servers-Admin: Record all, real-time monitoring
    Third-Party-Vendor-Access: Record all, dual authorization required

Step 4: Enable Real-Time Monitoring and Alerting

Configure CyberArk Privileged Threat Analytics (PTA):

PTA > Configuration > Security Events

Rule: High-Risk Command Detected
  Trigger patterns:
    - rm -rf /
    - chmod 777
    - useradd / passwd root
    - wget http* | sh / curl * | bash
    - nc -e /bin/sh
  Action: Alert SOC + Flag session as high-risk

Rule: Credential Access Attempt
  Trigger:
    - mimikatz.exe
    - procdump.exe targeting lsass
    - ntdsutil.exe
  Action: Terminate session + Alert SOC + Lock account

Rule: Unusual Session Duration
  Trigger: Session > 4 hours
  Action: Alert SOC for review

Step 5: Configure Session Review Workflow

PVWA > Recordings > Search and Review

Review features:
  - Video playback with timeline scrubbing
  - Keystroke transcript alongside video
  - Window title log for application tracking
  - Risk events highlighted on timeline
  - Text search within keystroke transcript
  - Auditor can mark: Reviewed-OK, Suspicious, Requires-Investigation

Step 6: Open-Source Alternative - Teleport

# /etc/teleport.yaml