17 Jun CyberArk: 20 Years Of Privileged Access Security Leadership, And Counting

Udi Mokady is the venerable pioneer of the PAM market

– Steven T. Kroll

Northport, N.Y. – Jun. 17, 2019

Cybercrime Magazine brought it’s PAM CAM to the auditorium at New York Institute of Technology (NYIT) to film a special privileged account management roundtable hosted by Paul Caulfield, chief risk officer at Israel Discount Bank.

Back in 1999, Udi Mokady, founder and CEO of CyberArk, saw a gap in the structure of cybersecurity. Information technology specialists had unlimited access to all of an organization’s data because they were the only people administering the infrastructure. The problem was that nobody monitored the IT team.

Mokady founded CyberArk — which became the global leader in Privileged Access Security — to mitigate this dilemma. Since its founding, the company has become a cybersecurity juggernaut with a market cap nearing $5 billion.

“The beauty of the CyberArk story is we pioneered the space, but continue to innovate and market lead it,” says Mokady. “In the early days, we discovered that privileged access is the holy grail of an insider trying to do anything malicious or even negligent.” 

Privileged access management (PAM) works by protecting privileged accounts — the network and database administrators, domain and service operators. The technology allows organizations to develop safeguards within their networks, watch the people who hold the keys to the kingdom (a phrase originally used by CyberArk), and prevent hackers from causing further damage after breaking into a system.

Because CyberArk was one of the first companies in this area, Paul Caulfield, chief risk officer at Israel Discount Bank and guest host for Cybercrime Magazine, calls Mokady the granddaddy of PAM.

Privileged access accounts are attack vectors for many of today’s largest breaches, according to Mokady, such as the ones at Sony Pictures and the U.S. government’s Office of Personnel Management. Once a malicious actor breaks into an organization through a privileged account, he can disable security tools, create fake user accounts, erase audit logs, and plunder confidential databases.

A notable feature of a fully operational PAM program is the use of a password vault, where the keys and credentials are stored and can’t be removed unless there is approval from the appropriate person.

“There’s no credential left behind,” says Mokady. The hacker may end up inside a system but can’t move around because of this password vault. “That gives you an added control in managing the accounts,” adds Ahsan Sheikh, chief information security officer at Israel Discount Bank. 

Developing a password vault does not simply make for strong insider protection, as Sheikh values strong governance within a company’s security operations. An organization must identify the privileged accounts and then run the program efficiently. This in turn creates buy-in from the C-level and board to personal and privileged users, which is a must as advancements evolve.  

Process automation and moving information to the cloud create new challenges in the privileged access management domain. CyberArk Labs is working on innovative solutions to these changes — staying true to its core mission of being at the forefront of development.

“Suddenly there’s a sprawl of credentials that these applications need to use,” says Mokady. “So, it’s all about, how do we not just be a protective layer and help organizations defend against those sophisticated attackers, but also allow the CISO to be the hero to adopt digital transformation technologies that will take the organization forward.”

And adding an extra touch to his approach, Mokady views the relationship with his customers in a healthy way. “You have to be like a doctor and prescribe the right medication. You don’t just say, ‘Hey, choose one of these and start wherever you want.’”

Mokady still has the gusto of startup entrepreneur, and CyberArk remains the one to beat in the PAM space.

– Steven T. Kroll is a public relations specialist and staff writer at Cybercrime Magazine.

CyberArk Archives