Safe names look like a small detail, but a good convention saves you a ton of headaches down the road. Here are the four rules you should build every naming standard around.
CyberArk gives you 28 characters for a safe name. Build the name from short (2 or 3 character) delimiters so you get the most meaning out of the space you have.
NY01WD_priv-username
18 of 28 characters, room to spare
NY01WD_priv-username
P-PRD-WD-username
Same things, same order, every time
Build names from a few defined parts. One option is Site, CPM number (this is the Central Policy Manager that changes and verifies passwords; you should have one per firewalled environment), Platform, and a free-form section. The name tells you where it lives, what it holds, and who it's for.
Pick one structure and hold to it, so a name always tells you the same things in the same order.
This one isn't just about being tidy. When each safe holds a single platform, the CPM only needs to query the safes that are relevant to it during an interval (or the time each CPM waits in between scanning for more work). By default, it checks about every five minutes, so across a big environment this helps to keep its load down.
You shouldn't rename hundreds of safes in a panic. When you're ready to rename your existing safes with the new naming convention, follow these steps for a smooth rollout.
For new safes going forward, train the PAM team and anyone who creates safes, so the convention sticks.
Build a comms list
Everyone affected by the rename
Document the convention
Publish in a wiki article
Send the comms out
Notify everyone before you start
Rename in an organized pass
Private and team safes, methodically
If your safe names have drifted over the years, please reach out. This is one of our favorite problems to solve.