7.3 Platform Policy Overrides, Advanced Settings & Target Tuning

7.3 Platform Policy Overrides, Advanced Settings & Target Tuning

Quick Answer: While the Master Policy defines organization-wide compliance baselines, Platform Policy Overrides allow administrators to tailor operational behaviors to specific technology stacks, risk tiers, and operational requirements. Configured under Automatic Password Management -> General within the platform settings tree, advanced parameters fine-tune Central Policy Manager (CPM) timing and rotation mechanics. Key parameters include MinValidityPeriod (preventing premature password changes during active sessions), ResetImmediately (enforcing zero-delay rotation upon account check-in), ImmediateInterval (CPM polling frequency for on-demand tasks), and HeadStartInterval (proactive rotation buffer before expiration). Password complexity is controlled via GeneratePassword, where PasswordForbiddenChars prevents target command injection or syntax parsing failures on legacy databases and Unix shells.

---

Platform Policy Overrides & Compliance Conflict Resolution

In a large enterprise, a monolithic security policy cannot accommodate every infrastructure component. A single enterprise baseline requiring 90-day password rotation, dual control approvals, and session isolation will inevitably clash with operational realities across different tiers:

• Emergency Break-Glass Scenarios: During severe network outages or cybersecurity incident response, administrators accessing break-glass root or domain accounts cannot wait for dual control approvals or ticketing validation.
• High-Risk Tier-0 Assets: Active Directory domain controllers, enterprise hypervisors, and root cloud accounts represent catastrophic risk. Leaving their credentials unchanged for 90 days introduces excessive dwell-time risk for harvested hashes, requiring daily (1-day) or 7-day rotation.
• Third-Party Contractor Access: External vendors accessing critical databases require One-Time Password (OTP) check-in/check-out exclusive access, whereas internal operations teams managing standard member servers may operate on routine periodic rotation.

CyberArk resolves these tensions through Platform Policy Overrides. By configuring Master Policy exceptions or overriding workflow properties at the platform level, security engineers create targeted policies tailored to specific operational contexts without weakening the global Master Policy baseline.

When a conflict arises between policy layers, CyberArk applies a strict precedence hierarchy:

1. Master Policy Exceptions (Platform Level): Takes highest precedence for compliance rules. If Master Policy mandates dual control globally, but an exception on the Emergency-BreakGlass platform disables it, accounts on that platform do not require dual control.
2. Platform Configuration Parameters: Controls operational CPM and PSM mechanics (such as intervals, timeouts, and password length) that are not explicitly defined in the Master Policy.
3. Safe-Level Settings: Governs access control, permissions, and Safe-level CPM assignment. Safes cannot override Master Policy compliance rules or platform technical parameters.

---

Advanced Automatic Password Management Parameters

Within the platform settings tree under Automatic Password Management -> General, administrators configure critical parameters that govern the operational precision of the Central Policy Manager:

1. MinValidityPeriod

• Definition: The minimum amount of time, specified in minutes, that an account's password remains valid after it is retrieved or checked out before the CPM can execute an automatic change.
• Operational Mechanism: When an account is configured for exclusive check-in/check-out access with automatic change on release, a user may check out an account, perform a 5-minute task, and check the account back in. If MinValidityPeriod is set to 60, the CPM will not change the password immediately. Instead, it waits until the full 60 minutes have elapsed from the time of checkout before executing the rotation.
• Why It Matters: Prevents operational disruption. If a script or batch process was launched during the session, or if the user needs to reconnect briefly, an instantaneous password change would terminate ongoing connections or cause authentication failures.

2. ResetImmediately

• Definition: A boolean parameter (Yes or No) that dictates whether the CPM immediately initiates a password change upon account check-in or release.
• Operational Mechanism: When set to Yes, checking in an exclusive account immediately marks the account in the Vault as pending change. The CPM picks up the task on its next scan cycle (governed by ImmediateInterval), subject to the completion of MinValidityPeriod. When set to No, the CPM waits until the standard periodic expiration interval elapses.
• Exam Distinction: Setting ResetImmediately=Yes is mandatory for true One-Time Password (OTP) implementations.

3. AllowManualChange

• Definition: A boolean setting (Yes or No) controlling whether authorized users can manually initiate on-demand CPM operations (Change, Verify, or Reconcile) from the PVWA user interface.
• Operational Mechanism: When set to Yes, users possessing the Initiate CPM password management operations Safe permission can trigger immediate rotations. Setting this to No locks down credential management, ensuring that rotations occur strictly on automated schedules.

4. ImmediateInterval

• Definition: The interval, in minutes, at which the CPM scans the Digital Vault for immediate, manual, or release-triggered tasks.
• Operational Mechanism: While standard periodic rotations are governed by the CPM's main search interval (often every 1 to 2 hours), immediate tasks (such as manual change requests, account onboarding, or OTP releases) cannot wait hours. The CPM checks for immediate tasks every ImmediateInterval (typically set to 1 to 5 minutes), providing near-real-time responsiveness.

5. HeadStartInterval

• Definition: The number of days prior to scheduled password expiration that the CPM proactively attempts to rotate the password.
• Operational Mechanism: If Interval is set to 90 days and HeadStartInterval is set to 5 days, the CPM initiates rotation attempts on day 85.
• Why It Matters: Provides an essential fault-tolerance buffer. If the target server is temporarily offline, network maintenance is underway, or the target account is temporarily locked, the CPM has a 5-day window to retry the rotation before the credential enters a non-compliant expired state.

6. DaysNotifyPriorExpiration

• Definition: The number of days before password expiration that the Event Notification Engine (ENE) dispatches automated warning emails to account owners or Safe managers.
• Operational Mechanism: Commonly configured on platforms where accounts have manual password management enabled or where dependent applications require advance coordination before credentials change.

---

Password Generation Rules & Character Constraints

Under Automatic Password Management -> GeneratePassword, administrators define the mathematical and typographical rules used by the CPM when generating new random secrets:

• PasswordLength: Total number of characters in the generated secret (e.g., 20, 24, or 32 characters).
• Character Quotas: Ensures cryptographic entropy across specific character classes:
  • MinUpperCase: Minimum number of uppercase alphabetic characters (A-Z).
  • MinLowerCase: Minimum number of lowercase alphabetic characters (a-z).
  • MinDigits: Minimum number of numeric digits (0-9).
  • MinSpecial: Minimum number of non-alphanumeric special characters (e.g., !#%*).
• PasswordForbiddenChars: A critical operational setting containing a string of specific characters that the CPM must never include in generated passwords.
  • Operational Necessity: Certain characters cause catastrophic syntax errors when passed into terminal command lines, SQL strings, or shell scripts. For example, dollar signs ($) trigger variable substitution in Bash; double quotes (") or single quotes (') break SQL DDL statements; backslashes (\) trigger escape sequences; and spaces break parameter parsing. Configuring PasswordForbiddenChars="'"$; prevents CPM rotation failures on sensitive target systems.

---

Target Tuning, Network Latency, and Timeout Management

When managing target endpoints distributed across global enterprise networks, WAN links, cloud virtual networks, or isolated OT/SCADA segments, network latency and target processing delays frequently trigger CPM timeouts and failed rotations.

Administrators tune connection resilience using specialized parameters:

• Process and Prompts File Timeouts: In the Terminal Plugin Controller (TPC) process files (e.g., UnixProcess.ini), each state-machine interaction has a Timeout parameter (in seconds). On slow SSH targets or heavily loaded servers, increasing the prompt timeout from 15 seconds to 60 or 90 seconds prevents premature CPM aborts while waiting for login banners, OS prompts, or command echoes.
• RetriesCount and RetryDelay: Governs how many times the CPM attempts to execute an operation before marking the account as failed, and specifies the delay (in minutes) between attempts. On platforms communicating with Active Directory, setting appropriate delays prevents the CPM from rapidly attempting rotations that could lock out the account due to domain account lockout policies.
• Reconciliation Triggers (AutomaticReconcileWhenUnsynced): When set to Yes, if a periodic verification task fails (indicating that the credential stored in the Vault does not match the target system), the CPM automatically invokes the linked Reconcile Account to reset the target password to a new known value, restoring synchronization without human intervention.

---

Advanced Platform Parameter Matrix