Press Releases

Cyber-Ark Sees Industry Spike for Application Identity Management Security Solutions

Cyber-Ark's Enterprise Password Vault™ Provides the First App2App Solution to Meet Large Enterprise Requirements

NEWTON, MA - March 25, 2008 - Recent breaches around the world, amounting to billions of dollars, has shaken the world's business community into closely scrutinizing their "back-office" security controls. Companies such as Cyber-Ark Software are seeing an unprecedented demand from corporations globally looking for solutions that will securely manage their privileged identities.

Cyber-Ark Software, the leader in Privileged Identity Management, recently released a breakthrough approach to securing application-to-application credentials - which has been timely in light of predictions that both Jerome Kerviel at Société Générale and the anonymous informant who gave out customers' details at the Liechtenstein Bank, part of the LGT Group to both the German and UK Tax Authorities, were able to do so due to the lack of security controls over privileged users. Enterprise Password Vault (EPV) 4.5 addresses the full range of security and audit challenges surrounding application identities within applications, scripts and application servers.

"The investigations are not complete, but both of these recent occurrences within European financial institutions most probably came down to the lack of IT security controls and processes to protect and manage privileged access to systems and applications," said Udi Mokady, president and CEO of Cyber-Ark. "Organizations have got to learn to take greater care of their sensitive information to make sure it is not accessible to staff without proper controls. Securing sensitive data and managing access to privileged accounts is crucial if more institutions are not going to hemorrhage vital information, costing them greatly financially as well as leaving their reputation somewhat tainted."

Research by CERT and law enforcement agencies shows that 86 percent of those who've committed cyber-crimes held technical positions and an overwhelming 90 percent had system administrator or privileged system access.

Managing credentials for application authentication poses security, auditing and administration challenges, and the lack of management of these powerful identities has been the "elephant in the room" in the IT infrastructure. Medium to large enterprises usually have thousands of servers, each running many applications, thousands of processes, and scripts that constantly use the credentials in order to communicate with databases and other systems.

Despite this fact, while more than 90 percent of enterprises regularly change passwords for employees, up to 42 percent never change hard-coded and embedded passwords for application IDs, testing scripts and batch jobs. This is in direct conflict with their own internal security policies, and is increasingly being highlighted by both internal and external audits covering a range of governmental and industry specific regulations such as SOX, PCI, Basel II and NERC/FERC.

"While all of the platforms accessed via a privileged password are critical and vulnerable, a particularly complex situation arises with embedded application passwords," said Sally Hudson, research director for IDC's Security Services and Identity Management Products program. "The danger of these application-embedded passwords being misappropriated or mishandled is growing accordingly, and organizations should take measures to make Application Identity Management a strong component of their overall IAM system implementation."

"What we're seeing and hearing from customers, partners and prospects is that securing privileged accounts-and application passwords in particular-is their number one area of concern right now. Cyber-Ark has never seen a greater interest from global companies seeking us out for a technology solution that can securely manage, store and audit their application identities," added Mokady.

What's New in EPV 4.5 for Applications?
The latest release of Cyber-Ark's Enterprise Password Vault (EPV), version 4.5, provides the only solution to fully address the challenges of Inter-application authentication. EPV eliminates the need to store App2App passwords in applications, scripts or configuration files, and allows these highly-sensitive credentials to be centrally stored, logged and managed with Cyber-Ark's patented Vaulting Technology®. Using EPV, organizations may comply with internal and regulatory requirements for regularly replacing passwords and securely monitoring privileged access across all systems, databases and applications.

EPV 4.5 enhancements for Application Identity Management (AIM) include:

Application and Scripts Credential Management

• Secure Cache for Performance and Availability EPV 4.5 introduces an advanced local password cache which greatly improves the solutions performance, scalability and availability to thousands of calling applications and scripts.
• New Application identity Management infrastructure Version 4.5 introduces the next generation of the Application Identity Infrastructure. With options for error detection, timeout periods and other finely tuned options, applications can now optimize secure, efficient and auditable password management.

Application Server Credential Management

• No Code Changes Required Cyber-Ark's EPV 4.5 introduces a patent-pending approach to eliminating hard-coded credentials in Application Servers' data sources. The unique advantage of this solution is that no code changes are required in applications that use the application server's data sources. With out of the box support for IBM WebSphere and BEA Weblogic, EPV 4.5 ensures that critical passwords required for applications running on Application Servers are always available but are never exposed or vulnerable.
• Eliminating Downtime During Password Change Process EPV 4.5 introduces a novel approach to password replacement for pooled credentials that does not require the Application Server to be restarted in order to synchronize its connection pools. With many customers using mission-critical production Application Servers, the ability to avoid restarting them as part of a password replacement process provides huge benefits in reduced administrative overhead, operational risk mitigation and no downtime.

For more information about EPV 4.5, please visit www.cyber-ark.com or contact Kim Baker of PAN Communications at +1-978-474-1900 today.

About Cyber-Ark
Cyber-Ark® Software is the leading provider of Privileged Identity Management (PIM) solutions for securing privileged user accounts and highly-sensitive information across the enterprise. Long recognized as an industry innovator for its patented Vaulting Technology®, Cyber-Ark's digital vault products include: The Enterprise Password Vault™ for the secure management of administrative, application and privileged user passwords; the Inter-Business Vault®, a secure infrastructure for cross-enterprise data exchange of highly-sensitive information, and the Sensitive Document Vault™ for secure storage and management of highly-sensitive documents. Cyber-Ark's Vaulting platform has been tested by ICSA Labs, an independent division of Cybertrust and the security industry's central authority for research, intelligence, and certification testing of security products. Cyber-Ark's award-winning technology is deployed by more than 400 global customers, including 100 of the world's largest banks and financial institutions. Headquartered in Newton, MA, Cyber-Ark has offices and authorized partners in North America, Europe and Asia Pacific. For more information, visit www.cyber-ark.com