Audit query on password policy

Products

• CA Privileged Access Manager (PAM)
• CA Privileged Access Manager - Cloakware Password Authority (PA)
• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

Can we clarify if there are any settings in CA PAM to show evidence of the following for user passwords;

1. Encrypt password before sending over the network such as encrypt passwords at the application layer before transmitting over a secure channel; (CAPAM & AD)

2. Ensure passwords are not displayed in clear

We understand that user passwords are stored only as hashes within CA PAM.

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/privileged-access-manager/3-2-4/implementing/configuring-your-server/configure-security-settings/configure-enhanced-encryption-for-stored-credentials.html

 

 

Environment

Release : 3.4

Component : PRIVILEGED ACCESS MANAGEMENT

Resolution

All communications between client and PAM use https (can require TLS 1.2 if desired), so user passwords are never transmitted in cleartext. We do not process the password on the client-side, PAM is a web application (the client is just a custom web browser with Java support) thus client-side processing is not possible.

All communication with AD is over LDAPs and requires they configure their domain controllers with certificates that will allow secure LDAPs on port 636.