Skip to main content
Veteran
January 6, 2025
Question

Rotating Challenge Response 'key' on a daily basis - EPMfW/M

  • January 6, 2025
  • 3 replies
  • 97 views

Has anyone implemented a solution that changes the Challenge Response “key” on a frequent basis (Ideally daily).   We have CyberArk, so theoretically could store in their vault but looking to see what options might be available. 

3 replies

MikeK
Veteran
January 7, 2025

I haven’t implemented it yet, but essentially what you're asking for is more in line with MFA, which was released into EPM Policies not that long ago if I remember correctly. 

Going the MFA route would be your rotational key generation and can be setup with OIDC or RADIUS

 

Documentation reference:

Challenge/Response 

Multifactor Authentication

James Allan
BeyondTrust Employee
BeyondTrust Employee
January 7, 2025

If you are using PM Cloud it may be worth checking out our JIT Application Access feature.

Paul
BeyondTrust Employee
BeyondTrust Employee
January 8, 2025

Has anyone implemented a solution that changes the Challenge Response “key” on a frequent basis (Ideally daily).   We have CyberArk, so theoretically could store in their vault but looking to see what options might be available. 

What’s the problem you are actually trying to solve here Michael? 

As Mike and James have noted, there may be some other product features which may offer alternatives, although introduce considerations such as needing internet connectivity.

At the same time, daily C&R key rotations is not without it’s own challenges, as depending upon your management platform and connectivity of your devices, not all machine may receive the updated policy - meaning the ‘latest’ key will not generate a valid responses for every machine.