UKRSIBBANK and Idira (formerly CyberArk):
How centralized privileged access management became the foundation of the bank's cyber resilience
In today’s banking environment, cybersecurity has become an integral part of business strategy. For financial institutions, protecting privileged access is not just a matter of safeguarding IT assets and services, but also a key factor in building customer trust, ensuring business continuity, and achieving regulatory compliance.
In this case study, we share the experience of implementing the Idira (formerly CyberArk) platform to centralize privileged account management, automate access control, and enhance the overall cyber resilience of UKRSIBBANK.
Company profile
UKRSIBBANK is one of the largest banks in Ukraine, actively developing digital services and modern IT infrastructure to support banking services, online service channels, and internal business processes.
Amid the ongoing digital transformation of the financial sector, the bank pays special attention to protecting critical systems, controlling access to infrastructure, and managing cyber risks. For UKRSIBBANK, cybersecurity is not merely a technical function, but one of the key elements ensuring business stability, regulatory compliance, and customer trust.
Challenges
Before the Idira (formerly CyberArk) implementation, privileged access management was accompanied by several organizational, technical, and security challenges typical of large financial organizations with complex IT infrastructure.
One of the main issues was the lack of centralized privileged account management. Administrative and service accounts existed across disparate systems, making regular manual reviews and audits difficult to conduct.
Manual password management processes created additional risks: irregular rotation, password reuse across accounts, a lack of centralized control over complexity and secure storage, and the absence of two-factor authentication, which is now mandatory to strengthen the cybersecurity posture of IT assets.
A separate challenge was the limited visibility into privileged user activities. The security team lacked complete transparency regarding who used elevated privileges in critical systems, when, and for what purpose. This complicated auditing, information security compliance monitoring, and potential incident investigations.
The bank also faced risks associated with shared accounts, which eliminated individual accountability for administrators and created additional hurdles for access control.
Taken together, these factors increased operational and cyber risks and complicated compliance with regulatory and audit requirements for critical infrastructure access control.
Choosing the solution
When selecting a PAM platform, the bank established several key requirements for the future solution. These included centralized privileged account management, full user activity auditing, automatic password rotation, multi-factor authentication (MFA) support, scalability, and integration with the existing IT infrastructure.
Compliance with regulatory requirements and international information security best practices, specifically the principles of least-privilege access, audit trails, and segregation of duties, was also a crucial prerequisite.
After evaluating available market options, UKRSIBBANK selected the Idira (formerly CyberArk) platform.
“Idira aligns well with the requirements of the National Bank of Ukraine (NBU), international standards, and best practices regarding least privilege, accountability, logging, and segregation of roles and duties—all of which were critically important for the bank,” noted Maksym Yashchenko, Chief Information Security Officer.
A decisive factor was the platform's maturity and its long-standing track record in the financial sector. It was also important for the bank to obtain a comprehensive PAM solution within a single platform—without needing to integrate numerous standalone tools.
Idira (formerly CyberArk) provided:
● Centralized privileged account management ● Automatic password rotation ● Privileged session management ● Comprehensive administrator activity auditing ● MFA support ● On-demand access with precise user identification
Beyond its technical capabilities, the bank viewed Idira (formerly CyberArk) not just as an access control system, but as a tool for managing cyber risk and supporting overall business resilience.
Implementation
Given the scale of the IT landscape and the number of critical systems, the full-scale deployment of Idira (formerly CyberArk) took nearly two years and was carried out in phases.
In the initial stage, the team conducted an inventory of privileged accounts, critical systems, and current access processes. This allowed them to identify the highest-risk areas and design the target PAM model.
Next, a pilot project was executed to test the solution's architecture, access scenarios, and security policies without impacting business operations. Following the successful pilot, the bank gradually onboarded critical systems and privileged accounts.
In the first phase, Idira (formerly CyberArk) was integrated with Active Directory, Windows, Unix, and Linux environments, network infrastructure, virtualization systems, databases, and middleware systems.
The team placed special emphasis on minimizing business disruption. All changes were tested in non-production environments, while production deployments were executed within controlled maintenance windows using strict rollback procedures.
Another important focus area was working directly with IT teams. Training sessions and demonstrations were organized for administrators to highlight the platform's practical benefits, including automatic password rotation, simplified access to multiple servers, and reduced manual workload.
Results
Following the Idira (formerly CyberArk) deployment, the bank achieved centralized control over privileged access and significantly enhanced the transparency of administrative activities.
Future plans
UKRSIBBANK continues to evolve its credential protection strategy and expand the adoption of PAM and Zero Trust principles.
The next step will be extending protection beyond traditional privileged accounts to service, API, and machine-to-machine accounts, as well as secrets in DevOps and CI/CD environments.
The bank also plans to deepen Idira’s (formerly CyberArk) integration with IAM, SIEM, and SOC processes to further automate access management and reduce manual operations.
Special focus will be placed on advancing the Zero Trust model, where every access request to critical systems is verified in real time based on role, context, and risk level.
If you are interested in the Idira solution and would like to test it personally,please click the button below: