Symantec Privileged Access Manager Reviews

The most valuable element is the keystroke tracking feature.

We use the tool in our FedRAMP data centers. Whenever an employee does some work at the command line in the servers, app servers or database servers, we need to track what they do.

We use the tool to do just that. We bought it for that purpose. That is why this is the most important feature for us.

The product has not improved our organization. It is an intentionally limiting product. That’s why we have it.

It limits the number of CIs. Why not have unlimited CIs?

As I understand the licensing, we purchase the PAM product and pay for it based on the number of CIs. (A “CI” is a “configuration item”. It’s an ITIL term.)

That means the number of servers, routers, switches, etc. for which PAM controls access and tracks activity. Why not charge us a flat fee and give us unlimited CIs?

We have been using the solution for around four years.

We did not encounter any issues with stability.

We had scalability issues, particularly in regards to the limit of CIs.

The technical support is very good. They are very helpful. They are knowledgeable and follow-up when we have issues.

We did not use a previous solution.

I don’t know about the initial setup. I was not involved in the initial setup.

I am not involved in pricing and licensing.

I don’t know about the evaluation of other products. I was not involved in that part of the process.

Make sure you can track enough CIs and have room for growth.

I mostly do support for the product so I’m aware of all the features this product offers. I like the fact that passwords are checked-in automatically. In case you forget to release the account so that other people can use it, it keeps the account secured by changing the password automatically.

You can do A2A integration. You can have your own script, which can then run outside of PA to retrieve the password and perform other tasks.

It has CLI commands for bulk changes. I’ve used that feature to on-board thousands of accounts, and it saved time and effort rather than doing it manually.

PA is a global vault application which is essential in our day-to-day tasks is retrieving and using privileged accounts. Also provides a nice logging and notification to management as well as audit.

I think most people that use the product are concern with performance and they are also used to the user inference. We shouldn’t compromise a better looking UI with performance. It’s hard to say, because ever since I’ve started using the product, we have had performance issues.

What I hope happens with the new product CA PAM is to keep all the useful features that exist in PA, but what I’ve noticed with many new products is the UI gets polished but systems lags stability and performance or it adds additional complexity instead of simplifying the user experience.

I hope that’s not the case with the new product. And of course with any new product, there should be improvements in stability, usability, performance and support.

We have used this solution for over two years.

Stability is a problem that we fight every day.

We have scalability issues. For our current stress test, it looks like the system is not able to handle a large number of users at peak times.

I think there are two points to this. It’s very hard to get to level 2 or 3 support to answer questions. We had cases that were dragged on for years with no answer waiting for engineering. It almost sounds like we are on our own and this product is not “really supported” or CA is so busy with other more important issues that higher level support is almost never available.

I am not sure. When I joined the bank, this was what they were using.

I was not part of the bank at that point.

I think this product is no longer available. But if it is, I would recommend a full stress test before they even implement it. Make sure you can run it on the newest web or application servers.

For me, it is the robust API which is the most valuable feature. This allows for low maintenance costs and allows applications to automatically connect. This is great to automate security of the DevOps pipeline for shared secrets across environments. Also, being on Linux and a virtual appliance is great.

Before we had a vaulting solution that had a manual provisioning of the DB and privileged accounts. Now, we can automate this provisioning through APIs which are easy to understand and implement.

I wish it could create local accounts on desktops. But, what I really want to do with it is automatically manage DevOps pipelines through tools like Docker/Puppet/Chef. It would manage shared secrets to the segregated environments. I am hoping that the API is helpful for this.

We have used it just for a PoC, but we are purchasing it soon. From going through the selection process, we felt CA PAM was the best option for our company.

CA technical support has been very responsive the past couple years. It has come a long way.

I have used ERPM, but it was difficult to upgrade the product. The structure of the vaulting policies was not conducive to Ally’s organization. Plus, it ran on Windows, which in our world you want to always go with a Linux solution, when possible.

In the PoC, it seems very easy to get started.

Don’t go with an agent model. Don’t go with a model that has you buying a thousand different parts. Go with PAM that gives you everything, or you’ll just be paying costs of implementing another tool that PAM would have just given you up front. PAM can monitor exponentially more devices than it competitors. This covers a large audit item for us.

We looked at CyberArk, BeyondTrust, ERPM and ObserveIT.

If you truly want to secure a DevOps world that is constantly changing the architecture and number of boxes, then you need CA PAM.

The product is for privileged access for a jump server using a PIV card.

So far, with the functionality of what we had, there has not been much improvement at this point of time. I am not able to comment at this time.

I think it works just enough because it is a mandate from the customer to have the privileged access for the administrators to manage the servers using the PIV cards. We haven't used it long enough to comment on areas for improvement.

We clearly know what the functionality is that we need from the product. I think this has been accomplished by the functionality that exists in the PAM of Xceedium.

We have been using this solution for six months.

We don't use it that often and it is only for admin users. So far, there have been no issues with stability.

There were no issues with scalability.

I would give technical support a rating of 10/10. It's a matter of a learning curve for my administrators. When they requested support, they were quick to respond. It's not really a problem. It's basically a lack of awareness of the product. It was quickly resolved talking to the technical support people.

There was not a previous solution.

We did not have any team members who were trained in Xceedium. For the setup, we got directions from the manual that was provided by the reseller.

We then went to Xceedium, which is now CA. They helped us if we had any issues from the technical point of it.

I would rate the setup as 80/20: 80% being simple and the remaining 20% needed some help from the technical folks at CA.

We did not evaluate different products. There was no choice for us. We didn't have a choice to evaluate other solutions because they mandated the use of this product.

I think it's a good solution for anybody who is looking for a single sign-on implementation for administration of the servers.

It's a straightforward solution. It has been in the federal space for quite some time. It has been part of our TRM.

The CA PAM’s ability to seamlessly integrate and provide a demarcation between users and systems is the most attractive aspect. It:

• Enables all control to start with Xsuite’s Deny All, Permit by Exception (DAPE) approach to limit privilege access controls.
• Enables all privileged users to see only those systems and access methods to which they’re expressly allowed access. Privileged users include Vendor Integration and Partners.
• Enables and verifies all system policies, providing an additional level of control by selectively filtering commands issued.
• Enables unauthorized commands to be blocked, with optional user warnings and policy violation alerts to security teams and logs.
• Enables sessions of users attempting to violate policies to be terminated, or accounts deactivated; enterprise policy control.
• Enables “leapfrogging” prevention, which allows one system to be used as a launch point for additional attacks / lateral movement.
• Enables full stack and system integration.
• Enables service integration with all systems using APIs or application to application.

These features greatly assist us and our clients in protecting their data privacy.

In retrospect, we and our clients have seen a reduction in service-related issues for application server and mainframe environments, a reduction in the provisioning lifecycle and requirements for systems such as mainframes, and a substantial increase in security flow and protection.

I believe continued expansion of integration to multiple systems including SSO and SAML technologies will provide a more-expansive, enterprise view of access orchestration, which will in turn strengthen the security of the environment.

I have been involved with this product for three years, both using and implementing for client architectures.

I have not encountered any issues with stability.

I have not encountered any issues with scalability; this is a true enterprise expandable product for mid-market and beyond.

In my experience with the CA PAM, their support apparatus has improved immensely over the past 12 months and continues to improve based on client feedback. Indications from my clients are that CA Technologies actually listens to their concerns and takes action.

Being in the technology sector for many years, we did not initially use products such as the CA PAM. We relied on common architecture, such as Microsoft and Oracle. As the need for more segregation of duties became prevalent, we looked to enhance our security with privileged access management. The feedback from most clients surrounding PAM is it provides a segregated extension of access control framework to enable better protection of customer privacy/data.

The initial setup is not complex. The design and integration can become complex without the proper solution architecture and understanding the impacts changes in technology place on a companies operational process and employee behavioral management. These topics became more complex to manage and establish than the product itself.

Product pricing and licensing is related to short-term or long-term business planning. In many cases, this solution should be looked at as a long-term solution. Therefore, considering the long-term savings in perpetual vs annual licensing is paramount to a progressive architecture. Therefore, I believe it is in the interest of the business to make these decisions prior to OEM engagement; they need to be vetted and defined as a value to the company at large.

No other options were evaluated because this PAM has made substantial gains in system integration, which outweigh industry choices.

I am a proponent of the product in many ways but most importantly, I believe a solid, well-thought-out strategy and solid architectural plan for the future needs to be the priority, not buying a product to fit the unknown.

• Ease of use.
• The way in which it can learn about the connectivity to systems, e.g., VMware vCenter Console; it can wrap that into its internal Java-based shell. Therefore, one does not need a terminal server solution.
• The non-Java based client.
• Two integration options with AD using SAML and the AD GC ports.
• The API explorer.

This system comes with a built in Java client which handles the connectivity to remote systems, e.g. the VMware vCenter Console Web Interface.

When you add the system to the CA PAM, you can put the connection into “learn mode” where you map out where the username and the password and submit fields are. You can then configure the system in PAM with the relevant credentials and then based on the information it “learned” about where the username and password and submit fields are and what needs to go where, it presents you with a vCenter Web Interface and logs you onto vCenter automatically based on your PAM permissions. This vCenter Web Console is effectively proxied via this Java Client that CA PAM has available and happens through the PAM system – the end user does not make a direct connection to vCenter.

In other PAM solutions that we tested, one had to setup a Microsoft Remote Desktop Server (TS) and publish the vCenter Web Interface and integrate that published app with the PAM solution so that when a user wants to access the particular vCenter server, PAM initiates the Remote Desktop Server published app – inserts the credentials – to provide you with access to vCenter.

When integrating with Active Directory for authentication purposes – most vendors support LDAP. For larger AD environments, the LDAP integration supports the Microsoft MSFT ports (3268 & 3269) that allows one to look for nested group memberships across multiple child domains. Another way to integrate with AD is to use SAML.

We were able to use both methods with the CA PAM solution. With another vendor we tested, they did not support SAML.

We only did an evaluation of the product, but we do feel that it will improve our security and governance posture and shave time off our engineers having to connect to systems managed by the PAM solution. It also gives us the accountability we are looking for.

• Reporting is very limited.
• Online Help is not detailed enough.
• Canned reports provided results for all targets and cannot simply be run for a particular customer when used in a service provider environment; one has to create some custom filtering.
• Multi-tenancy (reporting, AD users, customer devices, customer credentials).
• Interface and routing configuration (no individual routing tables per interface, cannot see routing table).
• Network connectivity to multiple networks where these networks might have overlapping IP address spaces.
• Session recording not included by default without an additional license.
• Session recording mount point is often disconnected after a system restart.
• Additional configuration required for multi-domain AD forests in order to find groups in child domains and to expand their membership.

We used it over a period of about 2-3 months, up to slightly less than two months ago as part of our proof of concept tests.

I have not encountered any stability issues; it is very stable.

I have not encountered any scalability issues; it scaled easily.

Technical support is very good.

I did not previously use a different solution.

Initial setup was straightforward, but we had some problems initially understanding what needed to be done to get an end device under management and how to set up the networking.

• Take note that Session Recording is not included by default.
• One would likely also have to invest in other infrastructure in a service provider environment when wanting to use the same solution for multiple clients to allow for the necessary networking.
• Additional costs that need to be catered for:
  • Storage space, NAS or SAN for session recording data.
  • A Terminal Server and CALs for more-complex end devices, e.g., Cisco UCS – the client needs to be run from a Terminal Server as a published application by the PAM solution

We ran a PoC with CA and BeyondTrust at the same time.

It reduces the viral attacks on my website. It also allows certain users access to see what happens daily.

The password manager is a valuable feature. It saves time for the user. The users do not have to remember the password or change the password. It is a user-friendly solution.

The stability is very good. 

There is enough power to support our whole organization and the scalability potential is very wide. We currently have between 50-100 users of the solution. 

The tech support is good. They are very helpful.

The setup was complex. It took one month and we needed collaboration between various different departments. We used a consultant to help us. We needed two people to integrate the solution and we currently employ one person for maintenance.

It is reasonably priced.

This solution is our gateway to access other servers. We plan to continue with this product as our company grows. 

• Session Management (Session Control and Recording)
• Very good in reliability
• Deployment Model: Available in both hardware and software appliance with one step installation only

Not applicable. I’m distributor of this product, not an end user.

Live session

GUI command keystroke and filtering

Session limitation

Live Session is a common feature now on PAM technology. By having this feature, an Administrator can monitor on live session about a privileged user activity, same like what we saw in CCTV. CA should add this feature on their PAM product, then they can compete with competitors.

Command keystroke and filtering on GUI session is needed to record and filter which commands allowed or not allowed privileged user work on GUI sessions, i.e., RDP Windows. By having this feature an Administrator can prevent dangerous commands when a privileged user on an RDP Session and open PowerShell or Windows Command or Database Engine CLI (MySQL, Oracle, etc.)

Session limitation is a very critical feature that cannot be addressed by CA PAM. By having this feature, only one username can allowed to login to the PAM dashboard at the same time and prevent another person to login using the same username (sharing password/username).

I have used this solution for two years.

There were no issues with stability.

There were no issues with scalability.

I would give technical support a rating of four out of five.

We did not use a solution before this one.

The initial setup was straightforward and very easy to setup.

There is a combination of user and target devices pricing/licensing. There is no point to charge on target device pricing for 1000+ target devices. I would suggest charging for user percentages.

I’m very satisfied with the product.