Fiducia IT AG Relies on CyberArk to Manage 20,000+ Privileged Accounts in Support of Security & Compliance Requirements

Fiducia briefly considered developing a solution in-house. However, after a thorough research and evaluation phase that included a cost/benefit analysis, Fiducia selected the CyberArk Privileged Account Security Solution. Stephan Zimmermann, responsible for IT services, compliance and security at Fiducia, said, “With the sophisticated security, rich functionality and excellent scalability of the CyberArk Privileged Account Security Solution, it didn’t take long for us to reach a decision in favor of this product.” CyberArk Enterprise Password Vault (EPV), part of the Privileged Account Security Solution, provides all the functionality required to securely manage shared, generic and privileged accounts across the entire lifecycle. EPV provides secure password storage, automates password management such as scheduled password changes, and policy-driven access control with flexible workflow definition. At the heart of the solution is the patented Digital Vault, a special hardened server with multiple layers of security offering reliable protection from unauthorized access to the privileged identities it holds. Fiducia runs a highly available disaster recovery solution with a master and a backup vault. The integrated authentication and access control features such as OTP tokens, certificates, RADIUS, password and LDAP make sure that only authorized users can access the system and the passwords, which are encrypted and stored in the Vault. A second person’s authorization can be specified as a requirement for access to particularly sensitive information—a standard procedure at Fiducia. CyberArk’s solution meets Fiducia’s stringent requirements regarding comprehensive logical and physical access protection. This aspect was extremely important to Fiducia because they wanted to rule out any risks associated with centralized password storage. Passwords are regularly and automatically changed on the target systems by the CyberArk Central Policy Manager (CPM). The policies which define parameters such as password complexity or the change cycle are centrally managed by the Compliance & Security Department within IT Services. At Fiducia, passwords are verified on a weekly basis and change automatically every month. Depending on the target systems, communication takes place using different protocols. Fiducia uses a total of five Central Policy Managers (CPMs) to enforce the defined policies on the target systems, which are installed in different network segments. This means that protocols do not have to communicate across firewall boundaries, supporting a distributed architecture with a central repository for passwords and single administration interface for managing the multiple network segments.