Manage application policies

This topic describes how administrators can view and manage application security policies.

Overview

The Secure Web Sessions portal displays all the SSO applications that you can apply policies to. For each application, you can apply specific protections and security layers. For CyberArk Identity applications, you can also apply security layers either by group membership, or to individual users.

You can apply three types of security layers:

Security layer	Description
Step Recording	Allows SWS to monitor and record all actions and events and use of the application. The recording is not a video, but a step-by-step log with screenshots, and is fully searchable. User events are captured locally in the browser via the Secure Web Sessions browser extension. For more information, see What is Step Recording?
Session Protection	Allows SWS to protect the users web session in the browser, and the specific tab. This protects high-risk web sessions from malicious processes originating on the endpoint. The following protections can be applied: Block file downloads, context menu and clipboard actions Enforce EPM protection For more information, see What is Session Protection?
Continuous Authentication	Allows SWS to validate and verify the user throughout their web session, based on certain conditions. For more information, see What is Continuous Authentication?

Edit security layers for application members

Use this procedure to change security layers for members of an application.

Applies to CyberArk Identity SSO applications only.

1. From the Secure Web Sessions portal, go the Application policies page, and select a CyberArk Identity application.

2. To change the security layers for all members of the application:

   1. In the table heading, select the security layer/s you want applied to all members.

      

   2. In the pop-up message, click Add.

3. To change the security layers for individual users or groups:

   1. Click the Edit button in the row of the group or user.

      

   2. In the pop-up message, select the security layers you want to apply, and click Save.

Edit security layers per application

1. From the Secure Web Sessions portal, go the Application policies page and select an application.

2. Click the Edit button. In the pop-up message, select the security layers you want to apply for this application, and click Save.

Define security layer configurations per application policy

From the Secure Web Sessions portal, go the Application policies page, select an application, and click the Configuration tab.

Details	Description
Identity app key	The application key received from CyberArk Identity.
Step recording	Dynamic URLs - When the toggle is set to ON, recordings are triggered based on the root URLs of the configured app. For example, for AWS dynamic URLs, some of the URLs that would be included are aws.com/users and aws.com/services. Manual mode - When enabled, Secure Web Sessions monitors only the domains determined by the Admin. At least one domain needs to be entered.
Session protection	Set the level of session protection you want applied to application sessions: Block file downloads, context menu and clipboard actions - Blocks the following actions in an application session: Cut/copy text from a protected session Paste text to a protected session Drag and drop action on text in a protected session File downloads, including drag and drop of files from a protected session to a local repository Open the context menu in a protected session This option is enabled by default. Enforce EPM protection - Enforces EPM protections in an application session. To enforce EPM protection for a specific application, you need to first configure and enable integration from Settings > Security layers. For more information, see Configure EPM integration with Session Protection .
Continuous authentication	Apply the Enforce pedometer lock to lock a sensitive web session when the end user has taken the maximum configured number of footsteps. This is to monitor if a session might have been left unattended. When the maximum number of steps is reached, the end user is required to re-authenticate to their session with a QR code using the CyberArk Mobile app. This feature is enabled in Settings > Security layers.

Set default security layers for new application members

Use this procedure to set the default security layers that will be applied to new members of an application.

Applies to CyberArk Identity SSO applications only.

New applications enabled for SWS have step recording enabled by default.

1. From the Secure Web Sessions portal, go the Application policies page, and select a CyberArk Identity application.

2. From the right side of the window, click Edit default.

3. In the pop-up message, select the security layers you want to apply, and click Save default.

   The saved default security layers will be applied to all new members added for this application.

Deactivate application policies

When new applications are configured with SWS, by default they are in active mode. This means that SWS security layers are applied when users access the application.

You can deactivate application policies so that users are no longer routed through SWS security layers. Deactivating application policies does not delete any configurations, and can be activated again at any time.

1. From the Secure Web Sessions portal, go the Application policies page, and select an application.

2. Change the toggle from Active to Inactive.

Delete application policies

Step recording limitations

• Keyboard shortcut user action doesn't trigger a recorded step.

• Drag-and-drop isn't recorded as a user action.

• Web applications based on WebGL might not capture all user actions when using step recording. Some of Microsoft Office applications use this technology. Therefore, while recordings of Office 365 web apps include the name and type of files, users actions done inside the file won't be captured.