CyberArk – Endpoint Privilege Manager 10.7

February 28, 2019

Tech update

CyberArk has released Endpoint Privilege Manager 10.7. New is this release: MacOS Agent enhancements; Rest APIs dor data extraction; New beta Threat Detection Policies; New user interface for the privileged managegement, application control and policy audit raw events; Security and performance improvements on the EPM Server, MaxOS Agents and Windows Agents.

What’s New in this Release

1. MacOS Agent enhancements
   1. Application installations can be copied to the shared Applications directory.
   2. DMG file support:
      1. Block or Run DMG files based on file location and file name
      2. Elevate PKG files contained in a DMG file

2. Rest APIs for data extraction – More products, services, and platforms are exposing their data and functionality via RESTful APIs. REST has emerged as the de-facto standard for building and exposing web APIs to enable third parties to hook into your data and functionality. Newly available APIs:
   1. Get aggregated events – This method retrieves the aggregated EPM events according to a predefined filter
   2. Get raw events – This method retrieves the raw EPM events per unique File ID and a predefined filter
   3. Get raw event data – This method retrieves full information for a specific event ID

3. The following new beta Threat Detection Policies have been added:
   1. PuTTy Credentials Theft: PuTTy is a popular SSH client for Windows. The application stores private SSH keys and enables you to store passwords for proxy servers locally. Storing the private SSH keys or proxy passwords leaves user credentials exposed to attackers.
   2. Okta AD Agent Tamper Protection: Okta is an identity management solution that provides a single sign-on experience. OKTA has an AD Agent that manages connection from an Active Directory environment. The agent stores a token to the domain that can be abused by an attacker to steal user credentials from the domain.
   3. Total Commander Credentials Theft: Total Commander is a popular file manager for Windows that can also manage FTP connections. Users can choose to store their FTP server passwords locally using Total Commander, exposing their credentials to potential attackers running on the machine.

4. UI Revamp – new user interface for the privilege management, application control and policy audit raw events (Inbox drill down)

5. Security and performance improvements on the EPM Server, MacOS Agents, and Windows Agents.

6. Bug fixes.