The credential injection feature is highly valued, particularly for RDP sessions. A majority of customers use it for RDP, and a couple for Linux servers. The broader capabilities, including access to multiple systems, web-based applications, and clustering, have never posed an issue. The threat analytics aspect is also a robust feature that analyzes all pertinent information.

We have implemented both the remote access and credential management features. The agent-based credential management solution allows clients to programmatically use the agent to collect passwords during runtime from Symantec Privileged Access Manager. The password management solution and password rotation policy using third-party certificates are easy to implement.

Symantec PAM is easier to deploy compared to its competitors, such as BeyondTrust. It is also a stable product that is easy to implement. It is scalable, allowing deployments over thousands of servers and devices. Its session recording features are highly valuable for us as they ensure all privileged accounts pass through PAM.

It's easy to use and easy to configure. Compared to BeyondTrust, it's a little complicated.

It is simple to integrate. For other solutions, we have to install a component that can directly deploy from the OVA in this system.

The best features are the comprehensive coverage of the required features for the PAM solution like a credential vault, a session recording, an endpoint agent, security analytics. All those things. 

The password manager is a valuable feature. It saves time for the user. The users do not have to remember the password or change the password. It is a user-friendly solution.

The most common features that I use are password vaulting and password management. 

The DB clustering is a really good benefit of using CA PAM.

Privileged account management for Windows (domain and local) and Unix.

One of the key things for us about the product is around its simplicity. Being able to put in the technology that allows the business to remove complexity and also allow the security improvements. This is high on our agenda. 

I have been in the security business for almost 30 years. We have never had a solution in place where we could really manage and control privileged accounts in the company. This solution really makes a big difference. We started rolling it out for our Linux base. It has been invaluable to us already, and it has only been a year.

Whoever built it from the ground up, they understand how an organization is laid out. You can tell. When a user comes in, it automatically picks up their information. It is very easy to use. The interface is very friendly, colorful, and bold. I really like that. It is friendly to the users. 

The session recording is useful. We can capture what each of our users are doing.

It gives you list of servers, so you can see which users have access to which servers. This is really useful, so we can make sure nobody is getting extra access than what is needed. It is also isolated from Internet, so there is no way hackers or anybody can come into the systems.

Transparent login for users of privileged IDs (Linux, Windows). This prevents sharing of the password because it is never seen.

The tool helps us manage local, domain, and service accounts. It helps us meet compliance standards.

If I remember correctly, it was the two factor authentication, and the single most important capability was it supported PIV and CAC as one of the two factors. That was pretty huge for us.

Access management and security compliance.

Password Management and Session Recording. The simplicity and ease that it is to be up and running out-of-the-box is very much appreciated.

The recording feature uses a proprietary format that is very light, even with high definition videos, allowing you to use very little hard drive space. This has proven very valuable when managing large amounts of sessions.

For me, it is the robust API which is the most valuable feature. This allows for low maintenance costs and allows applications to automatically connect. This is great to automate security of the DevOps pipeline for shared secrets across environments. Also, being on Linux and a virtual appliance is great.

The password vault and access to the systems are the most valuable features. It meets with the objective of password vault with controlled access to systems.

Gives us the ability to rotate passwords automatically in the vault, on in any interval, via a scheduled job or password view. This takes out the management of passwords from the user and CA PAM can control the password maintenance.

Some of the valuable features are safe access to company resources, quick, comprehensible, and intuitive management interface, and good integration capabilities. Control on targets could be extended through CA PAM Server Control component. It now includes an optional risk evaluation engine (CA Threat Analytics for Privileged Access Manager).

Access control and Password Management, because almost every customer wants to protect and audit their server(s), as well as their credentials.

One of the most valuable items is the load balancing feature.

The solution has the capability to address hybrid eco-systems, both on-premises and cloud services. Most of the high privileges now include tenant administrator credentials.

Integration with the AD RBAC model is also a great feature, as we can tie it to the central repository.

The FIPS-140-2 certification is really a nice option with every governmental response.

It offers access control of privileged accounts.

The most valuable element is the keystroke tracking feature.

We use the tool in our FedRAMP data centers. Whenever an employee does some work at the command line in the servers, app servers or database servers, we need to track what they do.

We use the tool to do just that. We bought it for that purpose. That is why this is the most important feature for us.

Manager user/admin’s password, so it’s more secure and password will be changed on time.

• Password management (Linux/Windows) and session recording.
• Platform to access any (RDP, Telnet, SSH device in Datacenter).

So far, we’re using the RDP-gateway and the “published application” features.

• The RDP-gateway: For limiting which server an operator can access.
• The “published applications” feature: To minimize the exposure of sensitive usernames and passwords.

The possibility to control the remote activity and establish different policies, because it depends on the position of workers, how much access they needed, and in what platforms they connect. The possibility to separate this in an easy way is very useful.

I mostly do support for the product so I’m aware of all the features this product offers. I like the fact that passwords are checked-in automatically. In case you forget to release the account so that other people can use it, it keeps the account secured by changing the password automatically.

You can do A2A integration. You can have your own script, which can then run outside of PA to retrieve the password and perform other tasks.

It has CLI commands for bulk changes. I’ve used that feature to on-board thousands of accounts, and it saved time and effort rather than doing it manually.

Used for securing privileged accounts. This is the why people choose this particular product: To manage credentials and record sessions.

One of the valuable features is the randomly generated password. It is a strong way to protect the security access to the network and servers in our department of Homeland Security Environmental Management System.

Session Recording: This feature is very useful and powerful. This application is very easy, fast, and trustworthy!

• Session Management (Session Control and Recording)
• Very good in reliability
• Deployment Model: Available in both hardware and software appliance with one step installation only

When you look at the whole PAM itself, session manager is very important. It records what happens. Access manager and credential manager are very important as well. Those are the key things. Session manager, access manager, and credential manager.

The product is for privileged access for a jump server using a PIV card.

Transparent login and cluster synchronization. This is quite stable compared with other products. It is easy to manage for the administrator.

• Consolidates access to all the systems
• Easy to deploy/virtual
• Records access for troubleshooting issues

Monitoring privileged users’ actions is valuable because of the high level of trust and wide-ranging access insiders typically enjoy. The impact of an insider breach incident can be quite high.

• High availability/stability
• Flexibility
• Security
• Excellent support

We need a solution that is very reliable for our users. We need something that has the ability to handle requests for network ports and various configurations. Security is one of the highest priorities and part of that is tracking/auditing. Xceedium/CA PAM support has been excellent and that is one of the main reasons we have stuck with this solution. We have had the same core team supporting us over the years and they work with us through any issues.

The most important feature is that we do not need to know the passwords any more; just having access to the end point; and that it’s easy to manage users and the account.

I have found the automated authentication to be most valuable.

The most valuable feature is the general concept of securing privileged passwords. Having worked in IT for a long time, I know how privileged passwords can float around. They pass from person to person and don’t get changed when they should be changed, such as when someone key who knows them leaves the organization. So, I appreciate the value of locking all that down.

With CA PAM, it's mainly the vaulting of credentials that we're looking for, and then after that, probably the bastion functionality where we force all of our administrators through that to get to the servers. We'll also do session recording of both RDP and the SSH sessions through it.

CA PAM has session recording, which is a very valuable feature. Overall, it is generally easy to use. It's a relatively simple product to setup and configure. You're not looking at tons of Professional Services hours to get it running.

So far the best value is the centralized management of all administrative accounts. Before PAM, domain administrators, Unix administrators with root access, end-users with elevated desktop privileges, and so on, were managed by those individual groups themselves. Now we have a way to separate the management of accounts with and without elevated privileges. This provides better control over who can see what information, and who can perform which actions.

So all the different roles (such as database admin, Unix admin, network administrator), are now centralized into one system. Users are authenticated with a single sign-on to access only what is appropriate for their role. It also enables us to take a generic role, like an administrator, and grant certain access rights to that role. Then you can apply the generic role, but go inside and make it granular. That isn't available in the product off the shelf, like in Microsoft or Red Hat.

It also integrates with our identity management system in which the roles and responsibilities are defined. Syncing the two systems is very helpful as well.

The CA PAM’s ability to seamlessly integrate and provide a demarcation between users and systems is the most attractive aspect. It:

• Enables all control to start with Xsuite’s Deny All, Permit by Exception (DAPE) approach to limit privilege access controls.
• Enables all privileged users to see only those systems and access methods to which they’re expressly allowed access. Privileged users include Vendor Integration and Partners.
• Enables and verifies all system policies, providing an additional level of control by selectively filtering commands issued.
• Enables unauthorized commands to be blocked, with optional user warnings and policy violation alerts to security teams and logs.
• Enables sessions of users attempting to violate policies to be terminated, or accounts deactivated; enterprise policy control.
• Enables “leapfrogging” prevention, which allows one system to be used as a launch point for additional attacks / lateral movement.
• Enables full stack and system integration.
• Enables service integration with all systems using APIs or application to application.

These features greatly assist us and our clients in protecting their data privacy.

• Ease of use.
• The way in which it can learn about the connectivity to systems, e.g., VMware vCenter Console; it can wrap that into its internal Java-based shell. Therefore, one does not need a terminal server solution.
• The non-Java based client.
• Two integration options with AD using SAML and the AD GC ports.
• The API explorer.

This system comes with a built in Java client which handles the connectivity to remote systems, e.g. the VMware vCenter Console Web Interface.

When you add the system to the CA PAM, you can put the connection into “learn mode” where you map out where the username and the password and submit fields are. You can then configure the system in PAM with the relevant credentials and then based on the information it “learned” about where the username and password and submit fields are and what needs to go where, it presents you with a vCenter Web Interface and logs you onto vCenter automatically based on your PAM permissions. This vCenter Web Console is effectively proxied via this Java Client that CA PAM has available and happens through the PAM system – the end user does not make a direct connection to vCenter.

In other PAM solutions that we tested, one had to setup a Microsoft Remote Desktop Server (TS) and publish the vCenter Web Interface and integrate that published app with the PAM solution so that when a user wants to access the particular vCenter server, PAM initiates the Remote Desktop Server published app – inserts the credentials – to provide you with access to vCenter.

When integrating with Active Directory for authentication purposes – most vendors support LDAP. For larger AD environments, the LDAP integration supports the Microsoft MSFT ports (3268 & 3269) that allows one to look for nested group memberships across multiple child domains. Another way to integrate with AD is to use SAML.

We were able to use both methods with the CA PAM solution. With another vendor we tested, they did not support SAML.

It consists of three components that work well together: access controls, SIEM, and password recording capabilities.