implementing-privileged-session-monitoring

实施特权会话监控

何时使用

• 为对关键服务器和数据库的所有特权访问部署或配置会话录制
• 满足要求监控特权活动的合规要求（PCI-DSS 10.2、SOX、HIPAA、ISO 27001）
• 调查管理员或第三方供应商可能执行了未授权操作的事件
• 为特权会话期间执行的高风险命令实施实时告警
• 建立生产基础设施上所有管理操作的取证审计追踪

不要使用于监控标准用户会话或终端活动；对于一般用户行为监控，请使用 EDR/UBA 解决方案。特权会话监控专门针对提权访问会话。

前提条件

• 已配置 Digital Vault 的 CyberArk PAM Self-Hosted 或 Privilege Cloud 部署
• 在强化的 Windows/Linux 跳板服务器上安装了 CyberArk Privileged Session Manager (PSM) 或 PSM for SSH (PSMP)
• 网络架构将所有特权访问都路由通过 PSM 代理（无直接 RDP/SSH 到目标）
• 已部署且可访问 PVWA (Password Vault Web Access) 以进行会话审查
• 用于认证 PAM 用户的 Active Directory 集成
• 足够的会话录制存储空间（估算：RDP 每分钟 50-250 KB，SSH 每分钟 5-20 KB）
• 或者对于开源方案：Teleport、带会话录制的 Apache Guacamole，或用于 Linux 的 script/ttyrec

工作流

第 1 步：架构 — 将所有特权访问路由通过 PSM

确保没有直接特权访问绕过录制代理：

Architecture Overview:

  Admin User ──> PVWA (Web Portal) ──> PSM (Jump Server) ──> Target Server
       │                                     │                     │
       │         Credentials never           │   Session is        │
       │         exposed to admin            │   recorded and      │
       │                                     │   stored in Vault   │
       └── MFA + AD Auth ──────────────────> │                     │
                                              └── RDP/SSH proxy ──>│

Network Controls:
- Firewall: DENY direct RDP (3389) and SSH (22) to target servers from user networks
- Firewall: ALLOW RDP/SSH to target servers ONLY from PSM server IPs
- Firewall: ALLOW PVWA access (443) from admin user networks
- PSM server: Hardened, no internet access, local admin access restricted

第 2 步：配置 PSM 连接组件

定义 PSM 如何连接到目标系统。在 PVWA 管理控制台中：

PVWA > Administration > Configuration > Connection Components

For Windows RDP targets:
  Connection Component: PSM-RDP
  Protocol: RDP
  Client Application: mstsc.exe
  Recording Settings:
    Record Sessions: Yes
    Recording Format: AVI (video) + Keystrokes (text)
    Record Windows Titles: Yes

For Linux SSH targets:
  Connection Component: PSM-SSH
  Protocol: SSH
  Client Application: PSM-SecureCRT or PSM-Putty
  Recording Settings:
    Record Sessions: Yes
    Recording Format: AVI + Text commands
    Record Unix Commands: Yes

For Database targets (SQL Server Management Studio):
  Connection Component: PSM-SSMS
  Protocol: Custom
  Client Application: SSMS.exe
  Recording Settings:
    Record Sessions: Yes
    Record SQL Queries: Yes (via keystroke logging)

第 3 步：配置会话录制策略

根据风险级别和合规要求定义录制规则：

PVWA > Administration > Platform Management > [Platform] > Session Management

Session Recording Settings:
  Enable Session Recording: Yes
  Recording Type: Record and Save (not just Monitor)

  Keystroke Logging:
    Enable Transcript: Yes
    Enable Window Events: Yes

  Storage:
    Recordings Storage Location: Vault (encrypted, tamper-proof)
    Retention Period: 90 days (adjust per compliance requirement)

    PCI-DSS:  Retain for 1 year, available for 3 months
    SOX:      Retain for 7 years
    HIPAA:    Retain for 6 years

  Compression:
    Enable Recording Compression: Yes
    Compression Level: Medium (balance storage vs. quality)

如需更精细的控制，可按保险箱配置录制策略：

Safe: Production-Servers-Admin
  Record all sessions: Yes

Safe: Development-Servers
  Record all sessions: No (optional for non-production)

Safe: Third-Party-Vendor-Access
  Record all sessions: Yes
  Enable real-time monitoring: Yes
  Require dual authorization: Yes

第 4 步：启用实时会话监控

为 SOC 分析师配置实时会话监控：

PVWA > Monitoring > Privileged Session Monitoring

Live Monitoring Dashboard:
  - Active Sessions: Shows all current privileged sessions in real-time
  - Session Details: User, target, duration, risk score
  - Actions Available:
    - Watch: View the session in real-time (read-only)
    - Suspend: Temporarily freeze the session
    - Terminate: Immediately end the session

Configure monitoring alerts in CyberArk Privileged Threat Analytics (PTA):

PTA > Configuration > Security Events

Rule: High-Risk Command Detected
  Trigger: Unix command matches pattern
  Patterns:
    - rm -rf /
    - chmod 777
    - iptables -F
    - useradd
    - passwd root
    - dd if=/dev/
    - wget http* | sh
    - curl * | bash
    - nc -e /bin/sh
    - python -c 'import socket,subprocess'
  Action: Alert SOC + Flag session as high-risk

Rule: Credential Access Attempt
  Trigger: Windows process matches
  Patterns:
    - mimikatz.exe
    - procdump.exe targeting lsass
    - ntdsutil.exe
    - secretsdump
  Action: Terminate session + Alert SOC + Lock account

Rule: Unusual Session Duration
  Trigger: Session duration exceeds 4 hours
  Action: Alert SOC for review

第 5 步：配置会话审查工作流

为审计员设置会话后审查流程：

PVWA > Recordings > Search and Review

Search Filters:
  - Date range
  - Target server
  - User who initiated the session
  - Safe name
  - Session risk score (from PTA)
  - Session duration

Review Workflow:
  1. Auditor opens recorded session in PVWA HTML5 player
  2. Video playback with timeline scrubbing
  3. Keystroke transcript displayed alongside video
  4. Window title log shows which applications were opened
  5. Risk events are highlighted on the timeline with markers
  6. Auditor marks session as: Reviewed-OK, Reviewed-Suspicious, or Requires-Investigation

Fast-Forward Features:
  - Jump to keystrokes (skip idle time)
  - Jump to risk events (flagged by PTA)
  - Text search within keystroke transcript
  - Filter by window title changes

第 6 步：开源替代方案 — 使用 Teleport 进行会话录制

对于没有 CyberArk 的环境，Teleport 为 SSH、RDP 和 Kubernetes 提供会话录制：

# /etc/teleport.yaml - Session recording configuration
teleport:
  nodename: teleport-proxy.corp.internal
  data_dir: /var/lib/teleport

auth_service:
  enabled: yes
  session_recording: "node-sync"  # Record at the node level, sync to auth server

  # Session recording storage (S3 for production)
  audit_sessions_uri: "s3://teleport-session-recordings/sessions?region=us-east-1"

  # Enhanced session recording (captures commands even in nested shells)
  enhanced_recording:
    enabled: true
    command_events: true
    network_events: true
    disk_events: true

ssh_service:
  enabled: yes
  enhanced_recording:
    enabled: true

proxy_service:
  enabled: yes
  web_listen_addr: 0.0.0.0:443

使用 tsh 查询录制的会话：

# List recorded sessions
tsh recordings ls --from=2026-03-15 --to=2026-03-19

# Play back a specific session
tsh play <session-id>

# Export session events as JSON (for SIEM ingestion)
tsh recordings export <session-id> --format=json > session_events.json

# Search for sessions containing specific commands
tsh recordings ls --query='command == "rm -rf"'

第 7 步：将会话元数据转发到 SIEM

将会话事件和告警发送到 SIEM，以便与其他安全数据进行关联：

CyberArk PTA Integration:
  SIEM Connector: Syslog (CEF format) or REST API
  Target: Splunk, Microsoft Sentinel, QRadar, or Elastic

Events Forwarded:
  - Session start/stop with user, target, and duration
  - High-risk command detection alerts
  - Session termination events
  - Failed connection attempts
  - Dual-authorization requests and approvals/denials

Syslog Configuration (PTA):
  PTA > Configuration > SIEM Integration
  Protocol: TCP + TLS
  Destination: siem.corp.internal:6514
  Format: CEF (Common Event Format)

Example CEF Event:
  CEF:0|CyberArk|PTA|12.6|HighRiskCommand|High Risk Command Detected|8|
  src=10.1.5.42 suser=admin1 dhost=prod-db-01 cs1=rm -rf /var/log
  cs2=PSM-SSH cs3=Production-Servers-Admin

关键概念

术语	定义
PSM (Privileged Session Manager)	CyberArk 组件，充当代理/跳板服务器，以视频和文本格式录制所有特权会话
PSMP (PSM for SSH Proxy)	基于 Linux 的 PSM 代理，专门用于 SSH、SCP 和 SFTP 会话
连接组件	CyberArk 配置，定义 PSM 如何启动客户端应用程序（RDP、SSH、SSMS）以连接到目标系统
Privileged Threat Analytics (PTA)	CyberArk 模块，对录制的会话应用行为分析和风险评分以检测异常活动
双重授权	安全控制，要求两名授权用户在特权会话建立之前批准该会话
会话隔离	架构原则，管理员从不直接连接到目标；所有访问都通过 PAM 系统代理
击键记录	录制会话期间键入的所有击键的文本日志，可用于审计和取证搜索
保险库存储	将特权凭据存储在加密的数字保险库中，使其永远不会暴露给最终用户

验证

• 所有对生产目标的高权限访问都通过 PSM 路由（直接 RDP/SSH 已被防火墙阻止）
• 会话录制内容正存储到 Vault 中，并启用了加密与防篡改保护
• SSH 和 RDP 会话的击键记录已被捕获并可供搜索
• PTA 规则会针对高风险命令触发警报（使用无害的触发模式进行测试）
• 实时监控仪表板显示活动会话及其正确的元数据
• 会话录制内容可在 PVWA HTML5 播放器中正确回放，并带有时间线和记录文本
• 存储估算已得到验证，保留策略符合合规要求
• 对供应商和高风险目标的访问强制执行双人授权
• 会话元数据和警报正在转发到 SIEM，并正确进行关联
• 审计人员可以通过 PVWA 界面搜索、审查和注释会话
• 已终止的会话会留下截至终止时点的完整录制内容