IPAM (DDI)

• Simplify IP Address, DHCP, and DNS Management

Inventory, manage, and maintain accurate IP subnets and DHCP scopes
Track, assign, provision, and decommission IP addresses
Delegate and coordinate work across multiple admin teams
Monitor and improve IP performance 
http://go.solarwinds.com/en/ipam/sem/IPAM-Software?&CMP=KNC-TAD-GGL-IPAM_EMEA_X_P-IPAM-DL&gclid=CJnLp_nS1scCFcSRGwoduscDyA

• As a central control point, IPAM provides an authoritative source for information about the network, providing valuable insight to enable informed management and security decisions for the enterprise.

https://www.bluecatnetworks.com/products/ip-address-management/

• IP Address Management (IPAM) in Windows Server® 2012 and Windows Server® 2012 R2 is an integrated suite of tools to enable end-to-end planning, deploying, managing and monitoring of your IP address infrastructure, with a rich user experience. IPAM automatically discovers IP address infrastructure servers on your network and enables you to manage them from a central interface.

https://technet.microsoft.com/en-us/library/hh831353.aspx

• Network Services DNS, DHCP & IPAM (DDI)

Infoblox’s industry leading integrated, centrally managed approach to delivering enterprise-grade DNS, DHCP, and IP address management (DDI) supports current and evolving IT needs while providing the highest standards for security, service uptime, and operational efficiencies
https://www.infoblox.com/products/network-services-dns-dhcp-ipam-ddi

• EfficientIP's IP Address Management (IPAM) solution adapts to business and IT goals and objectives by allowing the creation of specific IPAM and VLANs deployment processes. SOLIDserver™ IPAM is a unified solution that allows you to design, deploy, and manage the IP addressing plan automatically applying allocation rules and simplifying deployments

http://www.efficientip.com/ip-address-management/

• VitalQIP IP Address Management

The VitalQIP Appliance addresses the shift in the IP Address Management (IPAM) market towards appliances for increased reliability, manageability, scalability and security, and is the only appliance solution on the market that seamlessly integrates with VitalQIP DNS/DHCP & IP Address Management Software. - See more at: https://www.alcatel-lucent.com/products/vitalqip-ip-address-management#sthash.NinNdTx6.dpuf

• An Overview of the DDI – DNS, DHCP and IP Address Management appliances:

First, the DDI appliances can themselves provide DNS, DHCP, IP Address Management functionalities as well as provide centralized management for third party services like Microsoft Server 2003/2008 and Unix based DNS/DHCP servers across multiple locations.
http://www.excitingip.com/909/why-ddi-dns-dhcp-and-ip-address-management-is-critical-for-distributed-organizations/

• nipap is a sleek, intuitive and powerful IP address management system built to handle large amounts of IP addresses

https://spritelink.github.io/NIPAP/

• IPplan is a free (GPL), web based, multilingual, TCP IP address management (IPAM) software and tracking tool written in php 4, simplifying the administration of your IP address space. IPplan goes beyond TCPIP address management including DNS administration, configuration file management, circuit management (customizable via templates) and storing of hardware information (customizable via templates).

http://iptrack.sourceforge.net/

• GestióIP is an automated, Web based IPv4/IPv6 address management (IPAM) software. It features powerful network discovery functions and offers search and filter functions for both networks and host, permitting Internet Search Engine equivalent expressions.

http://www.gestioip.net/

• NOC is an mature open-source IP Address Management (IPAM) solution, organizing the process of IP address space tracking

https://kb.nocproject.org/pages/viewpage.action?pageId=1507406

• OpenNetAdmin provides a database managed inventory of your IP network. Each subnet, host, and IP can be tracked via a centralized AJAX enabled web interface that can help reduce tracking errors. A full CLI interface is available as well to use for scripting and bulk work.

http://opennetadmin.com/

• openIPAM is a scalable IP address management solution developed and used by Utah State University's Department of Information Technology.

https://code.google.com/p/openipam/

Web Application Firewall

• Web Application Firewall (WAF)

WAFs are designed to protect web applications/servers from web-based attacks that IPSs cannot prevent.
WAFs can be network or host based.
They sit in-line and monitor traffic to and from web applications/servers
Basically, the difference is in the level of ability to analyze the Layer 7 web application logic.

• The world's most advanced Open Source vulnerability scanner and manager

http://www.openvas.org/ 

• Runtime application self-protection (RASP) is a security technology that uses runtime instrumentation to detect and block computer attacks by taking advantage of information from inside the running software.[1][2] The technology differs from perimeter-based protections such as firewalls, that can only detect and block attacks by using network information without contextual awareness.[3][4] RASP technology is said to improve the security of software by monitoring its inputs, and blocking those that could allow attacks, while protecting the runtime environment from unwanted changes and tampering.[5] RASP-protected applications rely less on external devices like firewalls to provide runtime security protection. When a threat is detected RASP can prevent exploitation and possibly take other actions, including terminating a user's session, shutting the application down, alerting security personnel and sending a warning to the user.[6][7] RASP aims to close the gap left by application security testing and network perimeter controls, neither of which have enough insight into real-time data and event flows to either prevent vulnerabilities slipping through the review process or block new threats that were unforeseen during development.[8]

https://en.wikipedia.org/wiki/Runtime_application_self-protection

• Runtime Application Self-Protection (RASP).

It shifts the focus from finding all vulnerabilities and remediating fast, to reducing the likelihood of breaches occurring in the first place by blocking the exploitation. It fills significant app security gaps left by earlier technologies such as WAFs
https://www.immun.io/use-case-runtime-application-self-protection-rasp

While, there may be some use cases where RASP can fully replace a WAF, the reality is both technologies have their own strengths and weaknesses and should be looked at as important layers for defense-in-depth.
WAFs provide broad perimeter defenses (generally at the data center level) and mitigate threats at the edge of your network. At face value, this is an attractive value proposition, but the deficiencies of WAF are generally only seen during the post-implementation phase when it comes to operating and maintaining the solutio
https://www.veracode.com/blog/2016/02/pragmatic-approach-leveraging-waf-and-rasp

• IAST or Interactive Application Security Testing.

For example, SAST has a difficult time dealing with libraries and frameworks found in modern apps. That’s because static tools only see the code they can follow. What’s more, libraries and third­party components often cause static tools to choke, producing “lost sources” and “lost sinks” messages. The same is true for frameworks. Run a static tool on an API, web service or REST endpoint, and it won’t find anything wrong in them because it can’t understand the framework.
IAST is designed to address the shortcomings of SAST and DAST by combining elements of both approaches. IAST places an agent within an application and performs all its analysis in the app in real-time and anywhere in the development process IDE, continuous integrated environment, QA or even in production.

Because the IAST agent is working inside the app, it can apply its analysis to the entire app ­­ all its code; its runtime control and data flow information; its configuration information; HTTP requests and responses; libraries, frameworks and other components; and backend connection information. Access to all that information allows the IAST engine to cover more code, produce more accurate results and verify a broader range of security rules than either SAST or DAST.

RASP, or Run-time Application Security Protection As with IAST, RASP, or Run­time Application Security Protection, works inside the application, but it is less a testing tool and more a security tool. It’s plugged into an application or its run­time environment and can control application execution. That allows RASP to protect the app even if a network’s perimeter defenses are breached and the apps contain vulnerabilities missed by the development team. RASP lets an app run continuous security checks on itself and respond to live attacks by terminating an attacker’s session and alerting defenders to the attack




https://www.softwaresecured.com/what-do-sast-dast-iast-and-rasp-mean-to-developers/

• Homograph attack has been known since 2001, but browser vendors have struggled to fix the problem. It’s a kind of spoofing attack where a website address looks legitimate but is not because a character or characters have been replaced deceptively with Unicode characters.

https://thehackernews.com/2017/04/unicode-Punycode-phishing-attack.html

• OWASP top 10 vulnerabilities

the top 10 web application security risks worldwide as determined by the Open Web Application Security Project.
https://www.ibm.com/developerworks/library/se-owasptop10/

• Broken Access Control

Description

Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits. Common access control vulnerabilities include:

https://owasp.org/Top10/A01_2021-Broken_Access_Control/

• How to mitigate the risk of Sensitive Data Exposure?

Prepare a threat model to secure data both in transit and at rest from both types of the attacker( e.g., insider attack, external user)

Encrypt data to protect it from any cyber attack.

Never store sensitive data unnecessarily. Discard it as soon as possible.

https://allabouttesting.org/top-10-interview-questions-owasp-top-10-application-security/

• Insecure deserialization

demonstrate some widely applicable techniques using concrete examples of PHP, Ruby, and Java deserialization

What is serialization?

Serialization is the process of converting complex data structures, such as objects and their fields, into a "flatter" format that can be sent and received as a sequential stream of bytes. Serializing data makes it much simpler to:

    Write complex data to inter-process memory, a file, or a database

    Send complex data, for example, over a network, between different components of an application, or in an API call

Serialization vs deserialization

Deserialization is the process of restoring this byte stream to a fully functional replica of the original object, in the exact state as when it was serialized. 

What is insecure deserialization?

Insecure deserialization is when user-controllable data is deserialized by a website. This potentially enables an attacker to manipulate serialized objects in order to pass harmful data into the application code.

It is even possible to replace a serialized object with an object of an entirely different class. Alarmingly, objects of any class that is available to the website will be deserialized and instantiated, regardless of which class was expected. For this reason, insecure deserialization is sometimes known as an "object injection" vulnerability.

An object of an unexpected class might cause an exception. By this time, however, the damage may already be done. Many deserialization-based attacks are completed before deserialization is finished. This means that the deserialization process itself can initiate an attack, even if the website's own functionality does not directly interact with the malicious object. For this reason, websites whose logic is based on strongly typed languages can also be vulnerable to these techniques. 

How do insecure deserialization vulnerabilities arise?

Ideally, user input should never be deserialized at all. 

However, sometimes website owners think they are safe because they implement some form of additional check on the deserialized data. This approach is often ineffective because it is virtually impossible to implement validation or sanitization to account for every eventuality.These checks are also fundamentally flawed as they rely on checking the data after it has been deserialized, which in many cases will be too late to prevent the attack. 

In short, it can be argued that it is not possible to securely deserialize untrusted input. 

What is the impact of insecure deserialization?

It allows an attacker to reuse existing application code in harmful ways, resulting in numerous other vulnerabilities, often remote code execution. 

Even in cases where remote code execution is not possible, insecure deserialization can lead to privilege escalation, arbitrary file access, and denial-of-service attacks. 

How to prevent insecure deserialization vulnerabilities

Generally speaking, deserialization of user input should be avoided unless absolutely necessary.

If you do need to deserialize data from untrusted sources, incorporate robust measures to make sure that the data has not been tampered with. For example, you could implement a digital signature to check the integrity of the data. However, remember that any checks must take place before beginning the deserialization process. Otherwise, they are of little use. 

If possible, you should avoid using generic deserialization features altogether. Serialized data from these methods contains all attributes of the original object, including private fields that potentially contain sensitive information. Instead, you could create your own class-specific serialization methods so that you can at least control which fields are exposed. 

https://portswigger.net/web-security/deserialization

• Understanding IDOR Vulnerability

A Direct Object Reference is a web application design method in which entity names are used to identify application-controlled resources that are passed in URLs or request parameters.

Insecure Direct Object Reference represents a vulnerable Direct Object Reference. It involves replacing the entity name with a different value without the user’s authorization. As a result, users will be directed to links, pages, or sites other than the ones they intended to visit,

Generally, IDOR attacks are of two types:

    Body Manipulation. Attackers modify the value of a checkbox, radio buttons, and form fields. This lets them access information from other users with ease.

    URL Tampering. The URL is modified at the client’s end by tweaking the parameters in the HTTP request. HTTP verbs GET and POST are typically vulnerable to a URL tampering IDOR attack.

Preventing IDOR Vulnerability

An Indirect Reference Map is an alternative design method to ‘Direct Object Reference’ that helps businesses avoid IDOR vulnerabilities. It replaces the actual references (such as user IDs, names, keys, etc.) with alternate IDs that map to the original values. The mapping between the alternate IDs and actual references are maintained safely on the servers.

Validate User Access

Servers fail to identify tampered URLs because there are no access checks in place at the data-object level. Data layer access controls should be enforced only when the server verifies whether the current user owns or has access permissions to the requested data.

The application should establish criteria for incoming input, and if it doesn’t meet expectations, reject the value.

https://spanning.com/blog/insecure-direct-object-reference-web-based-application-security-part-6/

• A10:2021 – Server-Side Request Forgery (SSRF)

Description

SSRF flaws occur whenever a web application is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall, VPN, or another type of network access control list (ACL)

https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/

• OWASP Benchmark Project

The OWASP Benchmark for Security Automation (OWASP Benchmark) is a free and open test suite designed to evaluate the speed, coverage, and accuracy of automated software vulnerability detection tools and services (henceforth simply referred to as 'tools'). 
You can use the OWASP Benchmark with Static Application Security Testing (SAST) tools, Dynamic Application Security Testing (DAST) tools like OWASP ZAP and Interactive Application Security Testing (IAST) tools.


https://www.owasp.org/index.php/Benchmark#tab=Mains

A WAF is an appliance or software that Monitors HTTP/HTTPS traffic and can Block malicious

traffic to and from a web application. It differs from a traditional edge firewall in that it Targets

the content from specific web applications and at the application level, while edge firewalls

fashion secure gateways between the local area network and outside servers at the network

level. Specifically, by inspecting HTTP traffic, a WAF can stop attacks originating from web

application security flaws, such as SQL injection, cross-site scripting, file inclusion, and security

misconfiguration

WAF

couldn’t rely on traditional edge firewall methods that based decisions on a blocklist of network

addresses, and blocked certain protocols and port numbers. As all web applications used HTTP

and either port 80 or 443, this approach wasn’t very useful.

The First generation of WAFs used Blocklists and

Signature-based HTTP attributes to alert the firewall of an attack, so a SQL injection attack, like

this, was no longer successfu

In the next generation, WAFs became more

intelligent—there was an Element of learning by the firewall. The WAF would learn the

behavior of the application to create a baseline it could use to evaluate whether attempts to

access the applications were normal or irregular, and therefore suspect. It also introduced

Session monitoring and heuristics, which permitted the firewall to detect variants of known

signatures.

The logical turn in WAF development was Machine-learning unencumbered by human

supervision. Now Behaviour analysis could be done at machine speed and could adapt to the

ever changing attributes of the threat. Other security features were augmented to the firewall.

Among these assets were:

Distributed Denial of Service DDoS defense

IP reputation

Antivirus

Data Loss Prevention DLP

The firewall could Monitor HTTP and stop any action that violated acceptable behavior. It could

Identify the user and correlate the action they were attempting to do with their permissions,

and Stop any action that went Beyond the scope of their role

The WAF was also designed to

Share information and collaborate with other security devices in the network, such as other

firewalls and sandboxes.

sandboxing allowed suspicious material to

be tested safely in isolation from the network. Zero-day attacks could be exposed and

quarantined in these sandbox environments, and their signatures could be shared with other

devices in the network. In addition, these new discoveries could be uploaded to a threat

intelligence center on the internet, where they could be communicated to other networks.

https://training.fortinet.com/pluginfile.php/1625623/mod_scorm/content/1/story_content/external_files/NSE%202_WAF%20Script_EN.pdf

storage vendors

• The EMC®  CLARiiON®  CX4 series delivers industry-leading innovation in midrange storage with the fourth-generation CLARiiON CX™

storage platform. The unique combination of flexible,scalable hardware design and Advanced Storage Efficiency products enables the CX4 series
systems, powered by Intel Xeon processors, to meet the growing, diverse needs of today’s midsize and large enterprises.
http://www.emc.com/collateral/hardware/data-sheet/h5527-emc-clariion-cx4-ds.pdf

• EMC VNX

    Provides unified block, file, and object support
    Delivers high performance and low latency with MCx multicore optimization
    Supports 1 PB max raw capacity
    Reduces capacity needs with block-based and file-based deduplication and compression
    Offers industry-leading integration with VMware and Microsoft Hyper-V virtualization
    Pairs with FAST Suite to optimize performance and cost
    Simplifies administration with EMC Unisphere Management Suite

https://store.emc.com/us/Solve-For/STORAGE-PRODUCTS/VNX5400/p/VNX-VNX5400-storage-platform

• EMC Atmos

Object-based cloud storage platform to store, archive and access unstructured content at scale. Atmos provides the essential building blocks for enterprises and service providers to transform to private, hybrid, and public cloud storage.
http://turkey.emc.com/storage/atmos/atmos.htm

• VCE Vblock Systems

Seamlessly integrating best-in-class compute, network, and storage technologies from industry leaders Cisco, EMC, and VMware
http://www.vce.com/products/converged/vblock/overview

• EMC Unisphere is the next generation unified storage management platform that provides intuitive user interfaces for the newest range of unified platforms including the EMC VNX and EMC VNXe series

EMC Unisphere presents a new approach to unified storage management through a simple, flexible, and integrated user experience. Information is consolidated and visible through a single lens and managing storage is simplified by providing an intuitive, context-based approach. Users can customize their view and easily reallocate data. Unisphere also provides users with an extensive network of support and collaboration with other users.
http://turkey.emc.com/corporate/glossary/unisphere.htm

• Cisco UCS

Cisco UCS Integrated Infrastructure Solutions speed up IT operations today and create the modern technology foundation you need for initiatives like private cloud, big data, and desktop virtualization. Cisco UCS Director provides centralized automation of your physical and virtual resources, helping you take full advantage of our open ecosystem approach.
http://www.cisco.com/c/en/us/products/servers-unified-computing/index.html

• EMC NetWorker backup and recovery software centralizes, automates, and accelerates data backup and recovery across your IT environment. NetWorker delivers record-breaking performance and a wide range of data protection options to safeguard your critical business data.

http://www.emc.com/data-protection/networker.htm

• ESRS version 3

the ESRS Virtual Edition
EMC Secure Remote Services
Some additional benefits you can expect with ESRS v3:

    Simplified installation and implementation process
    No more dedicated servers, physical hardware, and OS licensing fees
    Real-time audit of remote support activities through an intuitive user interface
    Improved reliability with built-in optional failover to alternate connectivity methods such as email-home and FTPS
    https://community.emc.com/servlet/JiveServlet/downloadImage/38-10383-93764/670-313/ESRS+v3+architecture.png

• ESRS stands for EMC Secure Remote Support. The main benefit of ESRS is to enable EMC to deliver proactive customer service by identyfying and addressing potential problems before there is an impact to the customer’s business.

http://www.storagefreak.net/2014/07/emc-esrs-basic-overview

• EMC Storage Performance Monitoring

SolarWinds® Storage Resource Monitor enables comprehensive EMC® SAN and NAS performance and capacity monitoring to help avoid downtime. With an easy-to-use Web-based UI, go deeper to retrieve performance and capacity information for your entire EMC storage ecosystem
http://www.solarwinds.com/solutions/emc-storage-performance.aspx

• EMC STORAGE ANALYTICS

SINGLE TOOL FOR MANAGING VMWARE AND  EMC ENVIRONMENTS
http://www.emc.com/collateral/hardware/data-sheet/h11853-storage-analytics-vnx-ds.pdf

• RecoverPoint 4.0 introduces the virtual RecoverPoint Appliance (vRPA) option for EMC VNX unified storage.

Now a growing number of mid-sized organizations can benefit from RecoverPoint’s DVR-like rollback capability and realize any point-in-time recovery for their most mission-critical applications. With EMC RecoverPoint, one solution protects any host, any application, on any array, physical or virtual.
packaged to run on a virtual machine.

EMC RecoverPoint Continuous Data Protection (CDP) technology provides a selectable Recovery Point Objective (RPO) so you can roll-back to that moment in time just before your data became corrupted or lost.

RecoverPoint 4.0 is the industry’s first replication product to recover a virtual machine to ANY point-in-time in a VMware SRM Test or Failover vs. having to settle for the last point in time.  Perfect for rapidly recovering from major issues like viruses or data corruption.
http://pulseblog.emc.com/2013/04/30/recoverpoint-4-0-changes-the-replication-economics-for-vnx/

• EMC RecoverPoint replication provides the continuous data protection you need to recover any application, on any storage array, in any location, to any point in time.

Optimize your RTO and RPO targets by ensuring instant access to data for disaster recovery, operational recovery, and testing. Use RecoverPoint to extend VMware Site Recovery Manager (SRM) beyond snapshots.
Choose the RecoverPoint Appliance (RPA) for highest performance, or install RecoverPoint Virtual Edition for VNX with the virtual RPA (vRPA) for up to 33% lower cost.
https://store.emc.com/us/Solve-For/STORAGE-PRODUCTS/EMC-RecoverPoint/p/EMC-RecoverPoint

• Brocade SAN

Brocade DCX 8510 Backbones are the industry’s most powerful Fibre Channel switching infrastructure, providing the most reliable, scalable, high-performance foundation for private cloud storage and highly virtualized environments. They are designed to increase business agility while providing non-stop access to information and reducing infrastructure and administrative costs.
http://www.brocade.com/products/all/san-backbones/product-details/dcx8510-backbone/index.page

• IBM SAN

http://www-03.ibm.com/systems/networking/switches/san/

• EMC SAN

http://www.emc.com/products/family/celerra-family.htm

• NetApp SAN

http://www.netapp.com/us/products/protocols/san/san.html

• HP SAN

http://h18006.www1.hp.com/products/storage/software/sanvr/index.html

• HP NAS

http://h18006.www1.hp.com/storage/nas/index.html

• The Unified Computing System (UCS) fabric interconnect is a networking switch or head unit where the UCS chassis, essentially a rack where server components are attached, connects to. 

https://www.techopedia.com/definition/30473/ucs-fabric-interconnect

• Cisco HyperFlex Distributed Storage

Each node includes a Cisco HyperFlex HX Data Platform controller that implements the distributed file system using internal flash-based SSD drives and high-capacity HDDs to store data. The controllers communicate with each other over 10 Gigabit Ethernet to present a single pool of storage that spans the nodes in the cluster
https://gblogs.cisco.com/ch-tech/hyperflex-architecture-and-how-it-works/

• HP Virtual Connect FlexFabric

HP Virtual Connect FlexFabric 10Gb/24-port Modules are the simplest, most converged and flexible way to connect virtualized server blades to any data or storage network. VC FlexFabric modules eliminate up to 95% of network sprawl at the server edge with one device that converges traffic inside enclosures and directly connects to LANs and SANs.
http://www8.hp.com/us/en/products/virtual-connects/product-detail.html?oid=4144088

• HP EML E-Series Tape Libraries

The HP Enterprise Modular Library (EML) E-Series Tape Libraries provide reliability, scalability and manageability with robust data
protection and investment protection in heterogeneous Storage Area Network (SAN) environments. The EML delivers superior data
availability with protection against SAN event disruptions using the built in HP Extended Tape Library Architecture (ETLA)
http://www8.hp.com/h20195/v2/GetPDF.aspx/c04140830.pdf

• HP Continuous Access EVA Software

Protects valuable data by replicating from one HP Enterprise Virtual Array (EVA) to another - providing advanced disaster recovery with ease of management
http://h18006.www1.hp.com/products/storage/software/conaccesseva/index.html

• HP Storage Mirroring Software

Proactive replication reduces risks and keeps a business running when the unforeseen occurs.
http://h18006.www1.hp.com/products/storage/software/sm/index.html

• HyperScale X is the latest generation of Commvault’s fully integrated scale-out data management solution, and is the first product in the portfolio to integrate technology from the recent Hedvig acquisition. 

Commvault Hyperscale X is an intuitive and easy to deploy scale-out appliance that is fully integrated with Commvault’s intelligent data management platform. Integrated with the power of Commvault Hedvig, Hyperscale X provides unmatched scalability, security and resiliency to accelerate an organization’s digital transformation journey as they move to hybrid cloud, container and virtualized environments. Its flexible architecture allows customers to get up and running quickly and grow as their needs demand.

https://www.commvault.com/news/commvault-launches-hyperscale-x-marking-first-portfolio-integration-of-hedvig-technology

windows 8.x screen flips laptop

ctrl+ arrow keys
https://superuser.com/questions/592684/disable-screen-orientation-hot-keys-in-windows-8-ctrl-alt-arrow

terms

Open Virtualization Format (OVF)
Open Virtualization Format (OVF) is an open standard for packaging and distributing virtual appliances or, more generally, software to be run in virtual machines.
https://en.wikipedia.org/wiki/Open_Virtualization_Format

OVA and OVF: The Differences
OVF is not only the name of the packaging format standard, but it also refers to the package when distributed as a group of files. An OVA (open virtual appliance or application) is merely a single file distribution of the same file package, stored in the TAR format.
https://damiankarlson.com/2010/11/01/ovas-and-ovfs-what-are-they-and-whats-the-difference/

Privileged password management

• Privileged password management is a type of password management used to secure the passwords for login IDs that have elevated security privileges. This is most often done by periodically changing every such password to a new, random value

https://en.wikipedia.org/wiki/Password_management#Privileged_password_management

• Secure Privileged Password Management and Privileged Session Management

PowerBroker Password Safe is an automated password and privileged session management solution offering secure access control, auditing, alerting and recording for any privileged account – from local or domain shared administrator, to a user’s personal admin account (in the case of dual accounts), to service, operating system, network device, database (A2DB) and application (A2A) accounts – even to SSH keys.
http://www.beyondtrust.com/Products/PowerBrokerPasswordSafe/

• when someone from your team changes a password, the product goes through all of your servers and updates automatically discovered services. You may even remove administrative permissions from your normal accounts to prevent inadvertent changes and let Netwrix Privileged Account Manager take care of your service accounts.

http://www.netwrix.com/privileged_password_management.html

• Privileged access control increases security and compliance

Privileged Password Management for IT Admins
Secure the core of your business with password management software. Manage, change, and monitor privileged passwords in a centralized, web-based vault
http://thycotic.com/products/secret-server

• cyberark

Privileged accounts represent the largest security vulnerability an organization faces today. In the hands of an external attacker or malicious insider, privileged accounts allow attackers to take full control of an organization’s IT infrastructure, disable security controls, steal confidential information, commit financial fraud and disrupt operations
http://www.cyberark.com/products/privileged-account-security-solution

• powerbroker 

Unified Privileged Access Management Solutions that Reduce Insider Threats with Visibility and Control
https://www.beyondtrust.com/products/powerbroker

• Shell Control Box is a user monitoring appliance that controls privileged access to remote IT systems, records activities in searchable, movie-like audit trails, and prevents malicious actions.

What can you use SCB for?
    Monitor your IT administrators
    Control your IT outsourcing and cloud partners
    Audit your Citrix and VMware View users
    Meet local laws and international standards
    Improve IT incident management
https://www.balabit.com/network-security/scb

• Privileged Access Management (PAM) is a solution that helps organizations restrict privileged access within an existing Active Directory environment.

Privileged Access Management accomplishes two goals:
    Re-establish control over a compromised Active Directory environment by maintaining a separate bastion environment that is known to be unaffected by malicious attacks.
    Isolate the use of privileged accounts to reduce the risk of those credentials being stolen.

What problems does PAM help solve?
Vulnerabilities.
Unauthorized privilege escalations.
Pass-the-hash.
Pass-the-ticket.
spear phishing.
Kerberos compromises.
Other attacks.


PAM makes it harder for attackers to penetrate a network and obtain privileged account access. PAM adds protection to privileged groups that control access across a range of domain-joined computers and applications on those computers. It also adds more monitoring, more visibility, and more fine-grained controls. This allows organizations to see who their privileged administrators are and what are they doing. PAM gives organizations more insight into how administrative accounts are used in the environment.

How does PAM work?
PAM separates privileged accounts from an existing Active Directory environment. When a privileged account needs to be used, it first needs to be requested, and then approved. After approval, the privileged account is given permission via a foreign principal group in a new bastion forest rather than in the current forest of the user or application. The use of a bastion forest gives the organization greater control, such as when a user can be a member of a privileged group, and how the user needs to authenticate.
https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/privileged-identity-management-for-active-directory-domain-services