CyberArk Hardening Health Check

One of the most important recommendations for any application, and especially for security applications is to harden the server. CyberArk provides recommendations and automation scripts to harden its servers to make sure best security.

This tool provides a simple way to report on whether the recommendations were implemented fully or partly. This tool does not replace running the hardening procedures from CyberArk and cannot be taken as a guarantee for making sure the server is fully secured - it is always good to run your own security check up tools. Note that these settings are security best practices and the tool is “AS IS without warranty” for you to use and build on.

General

CyberArk provides automatic hardening to the Vault and component servers (CPM, PVWA and PSM) through automated scripts and procedures. Hardening is not an easy task and it covers a great deal of configurations and settings that one needs to apply in order to be compliant to the hardening best practice.

• How can you verify that you actually did all the required steps?
• How do you know that the hardening script finished successfully and applied all recommendations? (besides inspecting the log files)
• How can an organization verify if they are compliant if they applied their own hardening best practices?

Wouldn't it be nice if we could ask the server - are you hardened?

Well, the answer is here - CyberArk Hardening Health Check.

What is this tool?

This tool is based on the Automated Hardening scripts that are provided by CyberArk and will allow you, as a CyberArk customer, to verify if a server is hardened based on CyberArk best practices. The tool is based on the same hardening XML that comes with the automated hardening scripts and allows to disable some of the checks as well. What this means is that if you disabled a specific hardening step, you can disable the same one in the hardening health check to prevent false positives. The tool also provides links to documentation to most of the hardening checks and relevant information in a report where the hardening is not complete or missing.

Usage

The package ZIP includes a few folders, a Powershell script (Main.ps1) and a HTML template for the report. Download the ZIP and extract it on a CyberArk component server you wish to check Open Powershell (as an Administrator) and run the Main.ps1 script

PS> .\Main.ps1

For troubleshooting or getting more information about the checks done, you can run the script using Verbose logging

PS> .\Main.ps1 -Debug -Verbose

The tool creates a log file by default that contains all steps taken by the script (when using Verbose logging you will get a lot more info in the log file) Other relevant information will be referenced in the log and the report.

Use case examples

Run the tool to get the report on local machine

PS> .\Main.ps1

<B>Result</B>: The HTML report will open and show hardening results

Run the tool on remote machine

# region -------- EXAMPLE: remote execution script block to get the report path --------
$RunRemoteHardeningReport = {
    $ReportPath = .\CYBRHardeningCheck\Main.ps1 -Verbose -Debug -DisableAutoReportOpening
    return $ReportPath
}

# Execute remote script block and return the report file path
$RemoteReportPath = Invoke-Command -Session $mysession -ScriptBlock $RunRemoteHardeningReport

# Copy remote report file to the network path
Copy-Item -Path $RemoteReportPath -Destination $NetworkHardeningReportPath -Force -FromSession $mysession -Verbose

<B>Result</B>: The HTML report will be copied from remote machine to network path

Available Hardening tests

Cross-Component hardening checks

Vault specific hardening checks

CPM specific hardening checks

PVWA specific hardening checks

PSM specific hardening checks

Privilege Cloud Secure Tunnel specific hardening checks

Contributing

Please see our CONTRIBUTING for more details.

Licensing

Copyright (c) 2020 CyberArk Software Ltd. All rights reserved

This repository is licensed under GNU GENERAL PUBLIC LICENSE Version 3 - see LICENSE for more details.