Re: Enterprise Password & Session Management Tool

[Jeffrey Walton <noloader () gmail com>]

On Fri, May 18, 2012 at 3:13 AM,  <kartik.netsec () gmail com> wrote:
> Cyberark is a very good tool which can solve your purpose. As far a Xceedium is concerned, we have had a very bad 
> experience with this product. We have a list of cases logged in at Xceedium support and they are still pending 
> resolution since last 4-5 months.I am bashing the product but I feel it is still maturing and needs time till it 
> becomes stable.
Perhaps I'm being too skeptical, but there are some red flags with
this product and their digital vault technology
(http://www.cyber-ark.com/digital-vault-products/patented-digital-vault-technology/index.asp):
* "Cyber-Ark's unique approach makes this information more
accessible-eliminating the traditional tradeoff between accessibility
and security"
* "Additionally, some layers are uniquely crafted for increased
performance and security. This is a patented implementation..."
* "VPN & Data Encryption: As part of the authentication process, the
Digital Vault creates an encrypted session in which every user
transaction and every server response is encrypted. Files are
encrypted when stored inside the Digital Vault as well as when they
are transmitted, using symmetric encryption with internal key
management."

I become very suspiciou when I start seeing things like "unique
approach," buzzwords such as VPN (VPN is a heading and not mentioned
in the literature details), and marketing BS.

Does anyone have comments from an architectural review analysis (ARA)?

Jeff

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------