Overview

This integration guide describes how to store a CyberArk Vault top-level encryption key (server key), which is required to start a CyberArk Vault, on a ProtectServer 3 HSM.

At the core of CyberArk Privileged Access Security is the CyberArk Digital Vault that contains a highly secure database for storing privileged account credentials, access control policies, credential management policies, and audit information. To protect the Vault database and the data stored within the database, CyberArk has designed a multi-layered encryption hierarchy that uses FIPS 140-2 compliant encryption to protect each object in the Vault. Each individual file and safe within the Vault database is encrypted with its own unique encryption key and the Vault has a top-level encryption key, called the server key, which is required to start the Vault.

Using ProtectServer 3 HSMs to secure the server key provides the following benefits:

• Secure generation, storage, and protection of the identity-signing private key on FIPS-validated hardware.

• Full life-cycle management of the keys.

• Significant performance improvements by off-loading cryptographic operations from application servers.