What's New
New Secure Web Sessions versions are released and announced on a varying cadence. Occasionally, new versions that include only performance, stability and bug fixes, and do not require customer actions, are released without an announcement.
2022.07.31
What's new in this release?
Administrators can now enforce an additional layer of protection for sensitive web applications by monitoring footsteps taken by the end user during their sensitive web session. The feature protects against unauthorized access if the authenticated user leaves their computer unattended while the sensitive web session is left open on the endpoint and exposed.
The current release supports Android (in addition to the already supported iOS).
For more details about this solution, see Continuous Authentication with the CyberArk Mobile app
For details on how to enforce Continuous Authentication with the pedometer lock, see Configure Continuous Authentication with the CyberArk Mobile app
Released components
Component |
Version |
---|---|
SWS browser extension |
1.71.9602 |
SWS SaaS |
2022.07.31 |
CyberArk Mobile app on Android |
8.1 |
CyberArk Mobile app on iOS |
8.2 |
Upgrade notes
Component |
Details |
---|---|
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
SWS SaaS |
Customers do not have to take any steps to apply the Secure Web Sessions SaaS upgrade as it is applied by CyberArk during the maintenance window. |
CyberArk Mobile app |
Upgrade the CyberArk Mobile app according to your device and app store settings. |
Bug fixes
Area |
Description |
---|---|
SWS browser extension |
Improved communication logic between a users mobile device and the SWS SaaS during sessions protected by Continuous Authentication. |
2022.06.26
Administrators can now enforce an additional layer of protection for sensitive web applications by monitoring footsteps taken by the end user during their sensitive web session. The feature protects against unauthorized access if the authenticated user leaves their computer unattended while the sensitive web session is left open on the endpoint and exposed.
The current release is available with CyberArk Mobile on iOS only.
For more details about this solution, see Continuous Authentication with the CyberArk Mobile app
For details on how to enforce continuous authentication with the pedometer lock, see Configure Continuous Authentication with the CyberArk Mobile app
New users of the CyberArk Mobile app, who are assigned an application that is protected by Continuous Authentication, can now have their trusted mobile device joined to SWS during the first application access QR, requiring no separate onboarding steps or invitations.
SWS now supports EPM integration with EPM tenants that use the new policies management UI.
For details, see Configure EPM integration with Session Protection
Additional actions are now included in the Session Recording details when triggered during protected sessions. The new events are:
-
Session locked by - Pedometer lock
-
Session locked by - Idle Timeout
-
Session resumed by - CyberArk Identity MFA
-
Session resumed by - CyberArk Mobile App
Component |
Version |
---|---|
SWS browser extension |
1.70.9202 |
SWS SaaS |
2022.06.26 |
CyberArk Mobile app on iOS |
8.1 |
Component |
Details |
---|---|
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
SWS SaaS |
Customers do not have to take any steps to apply the Secure Web Sessions SaaS upgrade as it is applied by CyberArk during the maintenance window. |
CyberArk Mobile app |
Upgrade the CyberArk Mobile app according to your device and app store settings. |
Area |
Description |
---|---|
Continuous authentication with pedometer lock |
Web sessions opened in incognito mode might be unstable. Issues with locking/unlocking web sessions. |
Continuous authentication with pedometer lock |
The continuous authentication lock message might still appear in background, even after session is unlocked by end user. |
Area |
Description |
---|---|
Settings > Session Protection |
Session Protection with EPM integration settings now include two different download policy files; one for VFP (existing) and the other for EPMP (used with the new EPM policies management UI). For details, see Configure EPM integration with Session Protection |
SWS APIs |
Swagger page now opens to the latest API version. |
SWS tenant link |
SWS now fully supports linking with *.id.cyberark.cloud tenants from CyberArk Identity Security Platform. |
Area |
Description |
---|---|
SWS APIs |
Fixed getPolicyByID API 404 and incorrect layer display names. |
Step recording |
Improvements made to recording actions made in some in-app calendar widgets. |
Session recordings |
Fix made to full screen view navigation when handling 'no screenshot' events. |
Activities |
Fix made for Activity Types select field on Activities page not properly showing longer activity names. |
Continuous authentication |
Fix made for scenario where Reauthenticate button became non-responsive after window timed-out. |
2022.05.22
CyberArk Identity Secure Web Sessions can now enter into Business Associate Agreements (BAA) with US based healthcare customers requiring adherence to the Health Insurance Portability and Accountability Act (HIPAA). This confirms that CyberArk meets or exceeds all regulations and US legal requirements regarding the use, disclosure, and safeguarding of individually identifiable health information – that may be recorded, captured or otherwise saved in the Secure Web Sessions service. For more information, see https://www.cyberark.com/trust/hipaa-compliance/
Secure Web Sessions now exposes REST API's, which enables management and visibility of SWS users, application policies, and activities. This allows for integration with external systems for reporting of policies and management console activities. Additional API's are on the way soon. For more information, see Using the Secure Web Sessions APIs.
Added recommendation to add CyberArk Identity custom application domains to step recording exclude list. For more information, see Configure step recording settings
Component |
Version |
---|---|
SWS browser extension |
1.60.7201 |
SWS SaaS |
2022.05.22 |
CyberArk Mobile app on android |
7.1 |
CyberArk Mobile app on iOS |
7.1 |
Component |
Details |
---|---|
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
SWS SaaS |
Customers do not have to take any steps to apply the Secure Web Sessions SaaS upgrade as it is applied by CyberArk during the maintenance window. |
CyberArk Mobile app |
Upgrade the CyberArk Mobile app according to your device and app store settings. |
Area |
Description |
---|---|
Step recordings |
Improvements were made to better define when and how the search field is used. |
SWS extension |
Fixed an issue with applying different protection layers between multiple open tabs. |
2022.04.17
Administrators and Auditors now have the ability to flag events or sessions that are of interest to them, and afterward filter their view based on these flags. This allows customers to refer back to interesting or reviewed suspicious events at a later date without needing to search again.
For more information, see Flag session recordings and steps.
Our team is constantly reviewing and taking feedback to improve Secure Web Sessions. This release includes the following minor improvements:
-
Ability to sort recorded sessions by number of steps
-
Timeframe and filters remain visible while scrolling through activities
-
When viewing session details, the username now appears before the start-time in the header
Component |
Version |
---|---|
SWS SaaS |
2022.04.17 |
Component |
Details |
---|---|
SWS SaaS |
Customers do not have to take any steps to apply the Secure Web Sessions SaaS upgrade as it is applied by CyberArk during the maintenance window. |
Area |
Description |
---|---|
Recording details |
Fixed an issue where the tabID no longer appeared after the user had scrolled past it. |
Recording details |
Fixed an issue where sometimes the recording details page crashed when filtered by tabID. |
Recordings list |
Fixed an issue affecting the visibility of certain recording list icons. |
Recordings list |
Fixed an issue affecting search abilities when viewing the session list in 'tabular' view. |
Application configuration |
Fixed an issue where selection of the Session Protection security layer sometimes resulted in unnecessary tooltips showing. |
Application configuration |
Fixed an issue where users not assigned with 'Automatically Deploy' permission for an app would not show up in the members list for assignment of a SWS security layer. |
Continuous authentication |
Fixed an issue where a Access Denied message showed when a new tab of the same application was opened. |
2022.04.03
Each week we aim to release new improvements and bug fixes during our set maintenance window (3:30 EST - 6:00 EST (8:30 UTC - 11:00 UTC). When new features are announced, they will be included here.
This weeks release includes bug fixes and minor improvements.
Component |
Version |
---|---|
SWS browser extension |
1.59.7001 |
Component |
Details |
---|---|
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
Area |
Description |
---|---|
Continuous authentication |
Better handling of orchestration of multiple application launches. |
2022.03.27
Administrators can now configure and enforce additional protections on their user's web-applications. This release provides the ability to enforce protection against unauthorized application access, allowing organizations to re-authenticate users under special circumstances when using high-risk applications. Continuous Authentication offers protections via integration with CyberArk Identity multi-factor authentication (MFA) or via CyberArk Mobile QR code.
For more information about Continuous Authentication, see What is Continuous Authentication?
For information about configuring Continuous Authentication, see Configure Continuous Authentication with MFA.
Component |
Version |
---|---|
SWS browser extension |
1.57.6702 |
SWS SaaS |
2022.03.27 |
CyberArk Mobile app on android |
7.0.1 |
CyberArk Mobile app on iOS |
7.0 |
Component |
Details |
---|---|
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
SWS SaaS |
Customers do not have to take any steps to apply the Secure Web Sessions SaaS upgrade as it is applied by CyberArk during the maintenance window. |
CyberArk Mobile app |
Upgrade the CyberArk Mobile app according to your device and app store settings. |
2022.02.06
We have improved the auditor experience for viewing specific session recordings. Higher resolution screenshots, mouse and keyboard directional commands for moving between steps, and better navigation to find and go-to specific steps, all help improve the experience and effectiveness for the SWS Auditor.
Component |
Version |
---|---|
SWS browser extension |
1.51.6101 |
SWS SaaS |
2022.02.06 |
Component |
Details |
---|---|
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
SWS SaaS |
Customers do not have to take any steps to apply the Secure Web Sessions SaaS upgrade as it is applied by CyberArk during the maintenance window. |
Area |
Description |
---|---|
SWS browser extension |
The SWS browser extension now only captures higher resolution screenshots. This behavior change is effective from the latest version of the browser extension and will only affect new recordings. |
Area |
Description |
---|---|
Step Recordings |
Fixed an issue where in some cases a 'key press' event was shown in the step recording without explicitly mentioning which Tab/Enter key was used. |
Step Recordings |
Fixed an issue where in some cases scrolling up and down in the Step Recordings screen caused unwanted refreshes and wrong count. |
Step Recordings |
Fixed an issue where in some cases, with large recordings, the user would be returned to step 1 before reaching the end. |
Session Recordings |
Fixed an issue where new Session Recordings weren't showing in the Session Recordings page until a new time frame was selected. |
General settings |
Fixed an issue where an error message wouldn't always be displayed in case a logo file was uploaded with an unsupported image file type. |
Application configuration |
Fixed an issue with the SWS-EPM enforcement in an application not accurately reflecting the configuration from tenant settings. |
2022.01.09
Each week we aim to release new improvements and bug fixes during our set maintenance window (3:30 EST - 6:00 EST (8:30 UTC - 11:00 UTC). When new features are announced, they will be included here.
This weeks release includes bug fixes and minor improvements.
Component |
Version |
---|---|
SWS browser extension |
1.49.5901 |
Component |
Details |
---|---|
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
Area |
Description |
---|---|
Supportability |
Fixed an issue where 'Enable Verbose Logging' would not keep its configured state. |
Session Protection |
Fixed an issue where 'drag and drop' restrictions were not enforced correctly despite user notification. |
Step Recording |
Fixed an issue where a screenshot was taken while the active tab had changed/closed. |
2022.01.02
SWS administrators can view a history of activities that have been performed in the Secure Web Sessions management portal. For more information, see Monitor activities.
Browser restrictions were optimized with the addition of preventing access to the right-click context menu, as well as multiple improvements.
Component |
Version |
---|---|
SWS SaaS |
2022.01.02 |
SWS browser extension |
1.47.5601 |
Component |
Details |
---|---|
SWS SaaS |
Customers do not have to take any steps to apply the Secure Web Sessions SaaS upgrade as it is applied by CyberArk during the maintenance window. |
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
Area |
Description |
---|---|
Session protection |
The Session Protection browser restrictions were unified into one check box controlling browser level protections together. For more information, see Set security layer configurations per application policy |
Browser extension |
Implemented visual feedback for Clear log operation with 5 second fade out. |
Area |
Description |
---|---|
Step Recording |
Fixed an issue for value changes on searchable drop-down fields. |
Step Recording |
Fixed an issue for step recording screenshot flow to improve issues related to events without screenshots. |
2021.12.23
Each week we aim to release new improvements and bug fixes during our set maintenance window (3:30 EST - 6:00 EST (8:30 UTC - 11:00 UTC). When new features are announced, they will be included here.
This weeks release includes bug fixes and minor improvements.
Component |
Version |
---|---|
SWS browser extension |
1.43.5201 |
Component |
Details |
---|---|
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
Area |
Description |
---|---|
Step Recording |
Fixed an issue affecting radio button selection and other user functionality in certain applications. |
Step Recording |
Improved recording details. |
Session Protection |
Fixed issue where Session Protection with 'block downloads' prevented download of SWS extension logs |
2021.12.12
Administrators can now configure and enforce additional protections on their users web-applications. This release provides the ability to enforce restrictions on clipboard / drag&drop as well as restrictions on performing downloads from protected applications. As with SWS Step Recording layer - these protections are only implemented on the protected application tabs for the user leaving clipboard / drag&drop or downloads still fully functional for users in other non-protected applications. Lastly, the user will see an OS notification whenever a user action is prevented by SWS protections letting them know that the block was intended by their Administrator. For more information, see Session Protection with SWS browser extension
Integration with CyberArk EPM via SWS Session Protection is now available for client level protections. Customers can now integrate SWS and CyberArk's Endpoint Privilege Manager (EPM). With this integration we are providing a set of chrome browser protection policies which can be imported into EPM and enabled on your client devices. These protection policies also include the ability for the SWS extension and EPM agent to communicate and thereby validate EPM protection during the SWS Security Layer Validation stage of a user login to a protected web-application from CyberArk Identity SSO. For more information, see Session Protection with CyberArk EPM integration.
This release of the SWS extension provides the ability to export logs via the SWS extension for better supportability and troubleshooting of both SWS extension browser level actions as well as SWS-EPM integration actions. For more information, see Deploy the browser extension.
Component |
Version |
||
---|---|---|---|
SWS SaaS |
2021.12.12 |
||
SWS browser extension |
1.40.4901 |
||
CyberArk Mobile app on android |
6.5
|
||
CyberArk Mobile app on iOS |
6.5
|
Component |
Details |
---|---|
SWS SaaS |
Customers do not have to take any steps to apply the Secure Web Sessions SaaS upgrade as it is applied by CyberArk during the maintenance window. |
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
2021.11.14
Improvements were made to the performance of search suggestions and filter functionality in the SWS portal.
Component |
Version |
||
---|---|---|---|
SWS SaaS |
2021.11.14 |
||
SWS browser extension |
1.32.4101 |
||
CyberArk Mobile app on android |
6.3
|
||
CyberArk Mobile app on iOS |
6.3 |
Component |
Details |
---|---|
SWS SaaS |
Customers do not have to take any steps to apply the Secure Web Sessions SaaS upgrade as it is applied by CyberArk during the maintenance window. |
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
Area |
Description |
---|---|
CyberArk Mobile app on iOS |
Fixed a issue that caused the app to crash for iOS version 12 and below. |
2021.11.07
Each week we aim to release new improvements and bug fixes during our set maintenance window (3:30 EST - 6:00 EST (8:30 UTC - 11:00 UTC). When new features are announced, they will be included here.
This weeks release includes bug fixes and minor improvements.
Component |
Version |
---|---|
SWS SaaS |
2021.11.07 |
SWS browser extension |
1.30.3901 |
Component |
Details |
---|---|
SWS SaaS |
Customers do not have to take any steps to apply the Secure Web Sessions SaaS upgrade as it is applied by CyberArk during the maintenance window. |
SWS browser extension |
Customers may receive the latest update to the Secure Web Sessions Chrome extension automatically if their browser is configured for this, or can update to the latest version from the Secure Web Sessions Extension page in the Chrome Extension Store. |
Area |
Description |
---|---|
Step recording |
Fixed an issue preventing the OS notification from alerting the user on the start/stop of SWS step recording. (User notification via the SWS loader page and extension icon change were unaffected and function correctly.) |
Step recording |
Fixed an issue where when some of the recordings were viewed, the page title would show in place of the user URL. |
Step recording |
Fixed an issue affecting the display of the domains excluded from step recording. |
2021.10.31
CyberArk IdentitySecure Web Sessions, the newest addition to our Software-as-a-Service (SaaS) portfolio, helps security and compliance teams unmask and address threats quickly by adding extra layers of security to web application sessions.
CyberArk IdentitySecure Web Sessions is a SaaS service that records, monitors and protects end-user activity within designated web applications. The solution uses a browser extension on an end-user’s endpoint to monitor and segregate web apps that are accessed through CyberArk Identity Single Sign-On (SSO) and deemed sensitive by business application owners, enterprise IT and security administrators. Security and compliance professionals can use Secure Web Sessions to efficiently identify anomalous activity, investigate issues and support audits.
Secure Web Sessions can record and monitor screenshots of all actions taken by specific end users within protected web applications. The solution uses a browser extension, installed on the user's endpoint, to monitor and segregate web apps that are accessed through CyberArk Identity Single Sign-On (SSO).
Secure Web Sessions captures only SWS enabled applications, and ignores other tabs opened in the users browser window. End users are notified when a session begins recording, and when it ends. Secure Web Sessions captures all end user actions using a “stepper” approach. Specific actions, like mouse-clicks and “enter” or “tab” keystrokes, trigger a screenshot of the end users’ browser along with relevant metadata.
Screenshots are captured and encrypted at the endpoint by the Secure Web Sessions extension and are then only accessible by authorized Secure Web Sessions administrators and auditors with a customer-controlled encryption key. Encrypted recordings are streamed up to CyberArk SaaS for search and retrieval access by auditor or administrator.
-
Secure Web Sessions is an add-on to CyberArk Identity Single Sign-On. For more information about activation and integration of SWS with your CyberArk Identity SSO tenant, see Activate Secure Web Sessions.
-
Secure Web Sessions Administrators and Auditors will need to install the CyberArk Mobile app. For more information, see Download the CyberArk Mobile app.
-
Users will also need tthe CyberArk Secure Web Sessions browser extension installed in their browsers. For more information, see Deploy the browser extension.
Component |
Version |
---|---|
SWS SaaS |
2021.10.31 |
SWS browser extension |
1.26.3501 |
CyberArk Mobile app on android |
6.2 |
CyberArk Mobile app on iOS |
6.2 |
Area |
Description |
---|---|
Step recording |
Keyboard shortcut user action doesn't trigger a recorded step. For more information on limitations for the Step Recording feature, see Step recording limitations. |
Step recording |
Drag-and-drop isn't recorded as a user action. For more information on limitations for the Step Recording feature, see Step recording limitations. |