Symantec Privileged Access Manager Reviews

For me, it is the robust API which is the most valuable feature. This allows for low maintenance costs and allows applications to automatically connect. This is great to automate security of the DevOps pipeline for shared secrets across environments. Also, being on Linux and a virtual appliance is great.

Before we had a vaulting solution that had a manual provisioning of the DB and privileged accounts. Now, we can automate this provisioning through APIs which are easy to understand and implement.

I wish it could create local accounts on desktops. But, what I really want to do with it is automatically manage DevOps pipelines through tools like Docker/Puppet/Chef. It would manage shared secrets to the segregated environments. I am hoping that the API is helpful for this.

We have used it just for a PoC, but we are purchasing it soon. From going through the selection process, we felt CA PAM was the best option for our company.

CA technical support has been very responsive the past couple years. It has come a long way.

I have used ERPM, but it was difficult to upgrade the product. The structure of the vaulting policies was not conducive to Ally’s organization. Plus, it ran on Windows, which in our world you want to always go with a Linux solution, when possible.

In the PoC, it seems very easy to get started.

Don’t go with an agent model. Don’t go with a model that has you buying a thousand different parts. Go with PAM that gives you everything, or you’ll just be paying costs of implementing another tool that PAM would have just given you up front. PAM can monitor exponentially more devices than it competitors. This covers a large audit item for us.

We looked at CyberArk, BeyondTrust, ERPM and ObserveIT.

If you truly want to secure a DevOps world that is constantly changing the architecture and number of boxes, then you need CA PAM.

The product is for privileged access for a jump server using a PIV card.

So far, with the functionality of what we had, there has not been much improvement at this point of time. I am not able to comment at this time.

I think it works just enough because it is a mandate from the customer to have the privileged access for the administrators to manage the servers using the PIV cards. We haven't used it long enough to comment on areas for improvement.

We clearly know what the functionality is that we need from the product. I think this has been accomplished by the functionality that exists in the PAM of Xceedium.

We have been using this solution for six months.

We don't use it that often and it is only for admin users. So far, there have been no issues with stability.

There were no issues with scalability.

I would give technical support a rating of 10/10. It's a matter of a learning curve for my administrators. When they requested support, they were quick to respond. It's not really a problem. It's basically a lack of awareness of the product. It was quickly resolved talking to the technical support people.

There was not a previous solution.

We did not have any team members who were trained in Xceedium. For the setup, we got directions from the manual that was provided by the reseller.

We then went to Xceedium, which is now CA. They helped us if we had any issues from the technical point of it.

I would rate the setup as 80/20: 80% being simple and the remaining 20% needed some help from the technical folks at CA.

We did not evaluate different products. There was no choice for us. We didn't have a choice to evaluate other solutions because they mandated the use of this product.

I think it's a good solution for anybody who is looking for a single sign-on implementation for administration of the servers.

It's a straightforward solution. It has been in the federal space for quite some time. It has been part of our TRM.

The CA PAM’s ability to seamlessly integrate and provide a demarcation between users and systems is the most attractive aspect. It:

• Enables all control to start with Xsuite’s Deny All, Permit by Exception (DAPE) approach to limit privilege access controls.
• Enables all privileged users to see only those systems and access methods to which they’re expressly allowed access. Privileged users include Vendor Integration and Partners.
• Enables and verifies all system policies, providing an additional level of control by selectively filtering commands issued.
• Enables unauthorized commands to be blocked, with optional user warnings and policy violation alerts to security teams and logs.
• Enables sessions of users attempting to violate policies to be terminated, or accounts deactivated; enterprise policy control.
• Enables “leapfrogging” prevention, which allows one system to be used as a launch point for additional attacks / lateral movement.
• Enables full stack and system integration.
• Enables service integration with all systems using APIs or application to application.

These features greatly assist us and our clients in protecting their data privacy.

In retrospect, we and our clients have seen a reduction in service-related issues for application server and mainframe environments, a reduction in the provisioning lifecycle and requirements for systems such as mainframes, and a substantial increase in security flow and protection.

I believe continued expansion of integration to multiple systems including SSO and SAML technologies will provide a more-expansive, enterprise view of access orchestration, which will in turn strengthen the security of the environment.

I have been involved with this product for three years, both using and implementing for client architectures.

I have not encountered any issues with stability.

I have not encountered any issues with scalability; this is a true enterprise expandable product for mid-market and beyond.

In my experience with the CA PAM, their support apparatus has improved immensely over the past 12 months and continues to improve based on client feedback. Indications from my clients are that CA Technologies actually listens to their concerns and takes action.

Being in the technology sector for many years, we did not initially use products such as the CA PAM. We relied on common architecture, such as Microsoft and Oracle. As the need for more segregation of duties became prevalent, we looked to enhance our security with privileged access management. The feedback from most clients surrounding PAM is it provides a segregated extension of access control framework to enable better protection of customer privacy/data.

The initial setup is not complex. The design and integration can become complex without the proper solution architecture and understanding the impacts changes in technology place on a companies operational process and employee behavioral management. These topics became more complex to manage and establish than the product itself.

Product pricing and licensing is related to short-term or long-term business planning. In many cases, this solution should be looked at as a long-term solution. Therefore, considering the long-term savings in perpetual vs annual licensing is paramount to a progressive architecture. Therefore, I believe it is in the interest of the business to make these decisions prior to OEM engagement; they need to be vetted and defined as a value to the company at large.

No other options were evaluated because this PAM has made substantial gains in system integration, which outweigh industry choices.

I am a proponent of the product in many ways but most importantly, I believe a solid, well-thought-out strategy and solid architectural plan for the future needs to be the priority, not buying a product to fit the unknown.

• Ease of use.
• The way in which it can learn about the connectivity to systems, e.g., VMware vCenter Console; it can wrap that into its internal Java-based shell. Therefore, one does not need a terminal server solution.
• The non-Java based client.
• Two integration options with AD using SAML and the AD GC ports.
• The API explorer.

This system comes with a built in Java client which handles the connectivity to remote systems, e.g. the VMware vCenter Console Web Interface.

When you add the system to the CA PAM, you can put the connection into “learn mode” where you map out where the username and the password and submit fields are. You can then configure the system in PAM with the relevant credentials and then based on the information it “learned” about where the username and password and submit fields are and what needs to go where, it presents you with a vCenter Web Interface and logs you onto vCenter automatically based on your PAM permissions. This vCenter Web Console is effectively proxied via this Java Client that CA PAM has available and happens through the PAM system – the end user does not make a direct connection to vCenter.

In other PAM solutions that we tested, one had to setup a Microsoft Remote Desktop Server (TS) and publish the vCenter Web Interface and integrate that published app with the PAM solution so that when a user wants to access the particular vCenter server, PAM initiates the Remote Desktop Server published app – inserts the credentials – to provide you with access to vCenter.

When integrating with Active Directory for authentication purposes – most vendors support LDAP. For larger AD environments, the LDAP integration supports the Microsoft MSFT ports (3268 & 3269) that allows one to look for nested group memberships across multiple child domains. Another way to integrate with AD is to use SAML.

We were able to use both methods with the CA PAM solution. With another vendor we tested, they did not support SAML.

We only did an evaluation of the product, but we do feel that it will improve our security and governance posture and shave time off our engineers having to connect to systems managed by the PAM solution. It also gives us the accountability we are looking for.

• Reporting is very limited.
• Online Help is not detailed enough.
• Canned reports provided results for all targets and cannot simply be run for a particular customer when used in a service provider environment; one has to create some custom filtering.
• Multi-tenancy (reporting, AD users, customer devices, customer credentials).
• Interface and routing configuration (no individual routing tables per interface, cannot see routing table).
• Network connectivity to multiple networks where these networks might have overlapping IP address spaces.
• Session recording not included by default without an additional license.
• Session recording mount point is often disconnected after a system restart.
• Additional configuration required for multi-domain AD forests in order to find groups in child domains and to expand their membership.

We used it over a period of about 2-3 months, up to slightly less than two months ago as part of our proof of concept tests.

I have not encountered any stability issues; it is very stable.

I have not encountered any scalability issues; it scaled easily.

Technical support is very good.

I did not previously use a different solution.

Initial setup was straightforward, but we had some problems initially understanding what needed to be done to get an end device under management and how to set up the networking.

• Take note that Session Recording is not included by default.
• One would likely also have to invest in other infrastructure in a service provider environment when wanting to use the same solution for multiple clients to allow for the necessary networking.
• Additional costs that need to be catered for:
  • Storage space, NAS or SAN for session recording data.
  • A Terminal Server and CALs for more-complex end devices, e.g., Cisco UCS – the client needs to be run from a Terminal Server as a published application by the PAM solution

We ran a PoC with CA and BeyondTrust at the same time.

It reduces the viral attacks on my website. It also allows certain users access to see what happens daily.

The password manager is a valuable feature. It saves time for the user. The users do not have to remember the password or change the password. It is a user-friendly solution.

The stability is very good. 

There is enough power to support our whole organization and the scalability potential is very wide. We currently have between 50-100 users of the solution. 

The tech support is good. They are very helpful.

The setup was complex. It took one month and we needed collaboration between various different departments. We used a consultant to help us. We needed two people to integrate the solution and we currently employ one person for maintenance.

It is reasonably priced.

This solution is our gateway to access other servers. We plan to continue with this product as our company grows. 

We use Symantec Privileged Access Manager for controlling administrator and privileged user access. We can check the activities in the server for fragile files and documents in case of any issues.

There should be some training platform similar to Microsoft and IBM. We can't find useful documentation or YouTube videos to learn about the process. They should include some assignments in the test environment to explore the product's features.

We have been using Symantec Privileged Access Manager for four months.

It is a stable platform.

It is a scalable platform.

The product is easy to install.

The product's pricing depends on the agreement. They offer per-device, per-user, or monthly and yearly licensing models.

I rate Symantec Privileged Access Manager an eight out of ten.

• Session Management (Session Control and Recording)
• Very good in reliability
• Deployment Model: Available in both hardware and software appliance with one step installation only

Not applicable. I’m distributor of this product, not an end user.

Live session

GUI command keystroke and filtering

Session limitation

Live Session is a common feature now on PAM technology. By having this feature, an Administrator can monitor on live session about a privileged user activity, same like what we saw in CCTV. CA should add this feature on their PAM product, then they can compete with competitors.

Command keystroke and filtering on GUI session is needed to record and filter which commands allowed or not allowed privileged user work on GUI sessions, i.e., RDP Windows. By having this feature an Administrator can prevent dangerous commands when a privileged user on an RDP Session and open PowerShell or Windows Command or Database Engine CLI (MySQL, Oracle, etc.)

Session limitation is a very critical feature that cannot be addressed by CA PAM. By having this feature, only one username can allowed to login to the PAM dashboard at the same time and prevent another person to login using the same username (sharing password/username).

I have used this solution for two years.

There were no issues with stability.

There were no issues with scalability.

I would give technical support a rating of four out of five.

We did not use a solution before this one.

The initial setup was straightforward and very easy to setup.

There is a combination of user and target devices pricing/licensing. There is no point to charge on target device pricing for 1000+ target devices. I would suggest charging for user percentages.

I’m very satisfied with the product.

CA PAM has session recording, which is a very valuable feature. Overall, it is generally easy to use. It's a relatively simple product to setup and configure. You're not looking at tons of Professional Services hours to get it running.

Its primary benefits are the ability to regulate and control privileged access accounts, and their usage. Say for instance, that you have an administrator account for your Oracle EBS system: you obviously don't want your system administrators all sharing a single account. If you do find yourself in a situation where you only have one administrator account, you can setup Privileged Access Manager to track which administrators are using that single administrator account. That is very useful.

They actually just announced adding features that I would have liked included in the release that we're using. These new features all revolve around reporting and analytics. The basic reporting that comes with it is basic. They are not broad enough or deep enough. Apparently, with the latest release that was announced yesterday, there's a new analytics piece to it that really expands on its reporting capabilities.

Some of the key analytics that I would like to see are consolidated dashboard views with information about any privileged access usage that is out of the norm from a security perspective. That is now included in this new module; but I don’t think that this module is part of the Base Privileged Access Manager

Also, the licensing model, with cost as you scale with the number of users and recordable sessions. If it was cheaper, I would give it a perfect ranking.

I have had no stability issues whatsoever with it.

We have a relatively small implementation, but from what we've seen so far, it would scale pretty well.

We’ve used a little bit of technical support. It was really just a couple of questions here and there, and the support has been very good so far.

We did not have a solution in place.

Initial setup is pretty straightforward.

My organization had a push to increase our security posture this year. One of the areas we're looking at concentrating on is the use and control of privileged accounts. We obviously looked at the feature functionality set; then cost, then ease of use with a proof of concept demo.

We considered Thycotic Secret Server and we looked at a ManageEngine product. Ultimately, it came down to a choice between the Thycotic product and CA's PAM.

The only advice that I would give is to also consider some of the new pure Cloud-based offerings that are out. They weren't necessarily strong enough for us to consider when we were looking.