CyberArk Secure Infrastructure Access
SIA Architecture Overview
Beyond the VPN
Traditional infrastructure access often relies on VPNs and long-lived credentials. This model creates a large attack surface; once inside the network, a malicious actor might have broad access. CyberArk's Secure Cloud Access (SIA), part of the Identity Security Platform (ISPSS), offers a different approach. It's an agentless, SaaS-based solution built on the principle of (ZSP).
Instead of issuing permanent keys, SIA grants temporary, just-in-time access. This eliminates the risk of stolen credentials being used indefinitely. It secures access to servers, databases, and Kubernetes clusters without requiring you to install agents on your target systems or open inbound ports into your environment.
Native Access vs. Jump Boxes
If you're familiar with CyberArk, you might think of the Privileged Session Manager (PSM). While both SIA and PSM secure access, they do so differently. PSM typically functions as a proxy or "jump box." You log into the PSM, which then initiates and records a session to the target system on your behalf. Your entire interaction happens within the PSM's proxied window.
SIA, on the other hand, enables a native access experience. You use your own preferred client, like Microsoft Remote Desktop, an SSH terminal, or a database management tool like DBeaver. SIA works in the background to authenticate you and establish the secure connection, making the process seamless for developers and administrators who prefer their own tools.
| Feature | Secure Cloud Access (SIA) | Privileged Session Manager (PSM) |
|---|---|---|
| User Experience | Native client (RDP, SSH, etc.) | Proxied session via web portal |
| Architecture | Agentless SaaS | Deployed as a server (jump box) |
| Credentials | Just-in-time, short-lived | Vaulted, rotated credentials |
| Connectivity | Outbound-only from connector | Inbound connection to PSM required |
Anatomy of an SIA Session
The magic of SIA lies in its architecture, which orchestrates secure access without exposing your environment. The process begins when a user requests access to a target system. This request is first routed to the for authentication.
Here, the platform leverages Single Sign-On (SSO) and enforces Multi-Factor Authentication (MFA) policies to verify the user's identity. Once the user is authenticated and authorized, SIA's control plane generates a short-lived certificate or credential. This temporary credential is what the user's native client uses to connect to the target resource. Crucially, this connection doesn't go directly to the resource.
Instead, it's proxied through a lightweight SIA Connector running in your environment. This connector maintains an outbound-only connection to the SIA service, meaning you never have to open inbound firewall ports. The connector receives the connection request from the user's client, verifies the short-lived certificate with the SIA service, and then forwards the traffic to the final target resource.
The entire flow is designed around a core security principle: never trust, always verify, and never leave credentials lying around.
For resilience and logical separation, these connectors are organized into connector pools. You can create different pools for different environments (e.g., development, production), cloud providers, or geographical regions. This allows you to group resources logically and ensure that access is managed by a dedicated, high-availability set of connectors. If one connector in a pool goes down, traffic is automatically routed to another healthy connector, ensuring uninterrupted access.
This architecture provides the best of both worlds: robust, zero-trust security for the organization and a smooth, native workflow for the end-user.