Privileged Access Workstation (PAW) User Guide

Cardinal Protect Notes:

• No new Ring 1 PAWS will be provisioned.
  • Your department is responisble for providing a physical device for Cardinal Protect and must be under Warranty.  No old systems are accepted.  
  • Cardinal Protect for macOS is available now on Physical Hardware
  • Cardinal Protect for Windows on VDI is available now
  • If you are in Enterprise Technology (ET)  a Cardinal Protect VDI will be provided free of charge.
  • Windows Cardinal Protect VDI free of charge till the end Dec 2022 for anyone that qualifies for a PAW.
  • Starting Jan 2023 the Cardinal Protect VDI Fees:
    • CP VDI Base: $34.50/month (Secondary System - Lower CPU and RAM allocation)
    • CP VDI Pro: $55/month (Primary Systems - Higher CPU RAM allocation. - Ideal for Zoom calls )
  • Cardinal Protect for Windows on physical hardware will be available Spring 2022
    • A Cardinal Protect Systems installation requires a full wipe and rebuild to ensure a clean system start. 
    • Cardinal Protect Physical Hardware Fees:
      • Windows and macOS w/ CRC support - free*
        • Attesting "Yes" to: "Are you required to use a Cardinal Protect System to comply with Stanford's Minimum Security Standards (minsec.stanford.edu)?"
      • If you want a Cardinal Protect System not for minsec requirements there is a $99/year CRC Support fees + $17 licensing fee (Licensing Fees to start 2023).

The following teams are still required to use a PAW for managing critical infrastructure

• [ISO] Information Security Office
• [UIT] Central Windows Active Directory Team
• [UIT] Enterprise Technology Teams that provide support for the Central Windows Active Directory Infrastructure
• [UIT] BigFix Master Operators (Not Department Console Operators)
• [UIT] Endpoint Engineering Team
• [UIT] LAN Engineering and Backbone Teams

Ring 0 PAW Users

• Current Ring 0 PAW users will continue to be supported through CRC
• Ring 0 PAW support will continue via SNow requests.