BeyondTrust Password Safe Reviews

I am working on both BeyondTrust Password Safe and the PRA (Privileged Remote Access).

I have three years plus experience working with BeyondTrust Password Safe solution, and I have hands-on, good experience, and project experience on this Password Safe tool.

For BeyondTrust Password Safe, we have banking sector customers such as FAB, AIB, some Faisal Islamic Bank customers, and government customers.

In BeyondTrust Password Safe, the most effective features are Smart Rules and Smart Groups. Using these features, we can consume more time onboarding systems and accounts. This type of automation is the best in the Password Safe module.

Automation in BeyondTrust Password Safe uses Smart Rules. The Smart Rules we have in Password Safe eliminate the need for manual onboarding. When we properly mention action and selection criteria, it becomes time-saving and effectively handles multiple bulk tasks, such as onboarding and mapping.

BeyondTrust JIT (Just-in-Time) Access helps minimize risks in the organization by allowing privileged accounts to be provisioned temporarily, granting users elevated access only for the required duration. It is related to a schedule and grants users specific access for a limited time only. For example, if someone joins a session at a specific time, that session will automatically close or end after the time expires.

I have worked with the automatic password rotation tool. The benefit of automatic password rotation in BeyondTrust Password Safe is that PAM manages the password rotation for particular privileged accounts. The password is stored securely in a vault by PAM without being shared with anyone. From PAM, the session occurs, and it is managed exclusively through PAM only. From a security perspective, it is a good feature and very secure.

I have faced stability issues when upgrading BeyondTrust Password Safe solution. The upgrade process can be lengthy compared to other modules. For example, upgrading the appliance and reconfiguring HA is easier in PRA. However, in BeyondTrust Password Safe, the upgrade activity can take longer, and I have occasionally experienced being stuck during appliance version upgrades, sometimes duplicating the upgrade.

Regarding additional features, we have good features in BeyondTrust Password Safe compared to other modules, such as Secret Safe to secure secrets and the check-in, check-out functionality. We already have the main features, but I think it would be helpful if BeyondTrust implemented a heartbeat check feature on the privileged account level. This feature would allow PAM to check the credentials of privileged accounts, indicating if they are correct or not, showing if the heartbeat has failed if they are wrong.

I have three years plus experience working with BeyondTrust Password Safe solution, and I have hands-on, good experience, and project experience on this Password Safe tool.

I have faced stability issues when upgrading BeyondTrust Password Safe solution. The upgrade process can be lengthy compared to other modules. For example, upgrading the appliance and reconfiguring HA is easier in PRA. However, in BeyondTrust Password Safe, the upgrade activity can take longer, and I have occasionally experienced being stuck during appliance version upgrades, sometimes duplicating the upgrade.

BeyondTrust Password Safe is easy to scale.

I sometimes face issues with BeyondTrust Password Safe, particularly with the automation scripting for PS Automate. It is specifically with some thick client applications that I noticed problems. Other than that, the tool is quite good feature-wise and the support and maintenance from BeyondTrust are commendable. If we raise an issue, it gets handled by capable engineers.

The support rating is 8.5 out of 10.

Positive

The initial setup for BeyondTrust Password Safe is user-friendly and straightforward.

The session monitoring feature helps detect suspicious activity by recording the session and the keystrokes from within the session. Session management records and stores whatever the end user is doing inside the session, which is a good feature from the PAM.

Currently, the upgrades and features we are getting with BeyondTrust Password Safe are good for me. I do not have any suggestions to implement in Password Safe.

We recommend using BeyondTrust Password Safe module to secure privileged systems and privileged accounts, especially since we have good support response for BeyondTrust in the Middle East.

I rate BeyondTrust Password Safe nine out of ten.

Currently, we have one customer using BeyondTrust Password Safe.

BeyondTrust Password Safe is usually used for two things: compliance and audit.

The most effective features of BeyondTrust Password Safe are password management and session recording.

The reporting feature of BeyondTrust Password Safe is very much explainable and good.

We do not utilize the dynamic privilege elevation and delegation feature yet, because the customer is not planning to use this feature. They want to control the manner of user creation processes in their system with an approval flow, so they are not going to use dynamic user creation and deletion. Tracking those users apart from admin is very tough.

The effectiveness of BeyondTrust Password Safe's session management capabilities for SSH and RDP is pretty much robust, but it needs more improvement for other applications and web-based applications.

In terms of analytics, there needs to be more improvement, particularly from a connectivity point of view, so it's a bundle. SaaS-based applications and other things should be included, along with their password management options for web applications.

This is the second year we have renewed our usage of BeyondTrust Password Safe.

BeyondTrust Password Safe is scalable and stable from my perspective, as if you increase your CPU and RAM, you can use as many user licenses as you want on a single platform. It is available in high availability as well. If there is a large infrastructure, high availability can be configured, but here we are using a single infrastructure and taking a snapshot backup of VMware.

We provide ticket-based support for BeyondTrust Password Safe to our customers. They only reach out to us during upgrades and other things, while the rest of the operational tasks they handle themselves.

One person gets aligned for troubleshooting and maintenance activities during their downtime, and within an hour, they complete these tasks.

As a partner and implementer, I can tell you that the deployment process for BeyondTrust Password Safe is straightforward. It's pre-installed. A virtual machine is available. You just need to import it into ESXi and start, and do the basic configuration like IP address and other things as per your network. Then it's ready to onboard your device.

One person, one engineer, is sufficient to deploy BeyondTrust Password Safe.

I don't think BeyondTrust Password Safe is an expensive solution. I have checked with other competitors as well, and I think it is similar or sometimes lower in price.

BeyondTrust Password Safe is on-premises as a virtual appliance. We work with the latest version of BeyondTrust Password Safe, and it is updated.

It takes a week to onboard other devices such as network devices and servers on BeyondTrust Password Safe. We need to create the password policy and create a separate admin account as they use a legacy approach for email, where admin and normal users both have the same ID. We segregate those things. A normal user is different, and admin user is created for password management and other tasks. This takes time because there is also internal approval needed from the customer's side in their change management.

In every breach and cybersecurity incident, one privileged account definitely gets involved. If we manage all privileged accounts in one place and manage their passwords timely, no one can reveal a password from there. We are improving our attack surface to protect against identity theft.

It is important that BeyondTrust Password Safe supports both on-premises and cloud deployment; however, we have only done on-premises deployment.

Currently, we have integrated BeyondTrust Password Safe with Active Directory and ServiceNow ticketing tool. The third integration is SIEM integration, which allows all the authentication logs to get privileged authentication and be forwarded to SIEM for further correlation with other security tools' logs.

The time-saving benefits come from no longer having to remember multiple device passwords. For compliance, passwords have to be reset timely within 30 days, and it was difficult to remember many complex passwords. The solution improves time saving and productivity.

There is a financial benefit for companies using BeyondTrust Password Safe. We also work with VMware. On a scale of one to ten, I would give BeyondTrust Password Safe a rating of nine.

The main purpose of BeyondTrust Password Safe is for Privileged Access Management, with session monitoring being very effective for risk mitigation. It ensures we adhere to the control standards set for financial institutions.

Yes, it has significantly improved our Privilege access control

The session management works well overall, even with occasional issues capturing keystrokes on enhanced graphical screens. Its Linux functionality is very good.

We find the reporting and analytics features highly valuable, consistently using them for comprehensive and up-to-date reports. We can easily customize these reports as needed.

While generally a strong product, BeyondTrust Password Safe has a few areas that could use some polish. From an administrator's viewpoint, we sometimes see keystroke capturing fail.

More significantly, RDP sessions occasionally disconnect without any error messages on the client side. This leaves us administrators in the dark, unable to identify the cause of the problem

I have experience with BeyondTrust Password Safe for the last two and a half years.

We have been using BeyondTrust Password Safe for almost two and a half years, and it is stable. Sometimes issues occur, but they are routine for us.

BeyondTrust Password Safe is a scalable solution.

I rate technical support from BeyondTrust at around eight or nine because it is very good and helpful. It is always available and quick, 

Positive

Before choosing BeyondTrust Password Safe, we evaluated other PAM products too, but we preferred BeyondTrust because the product is good by all means

BeyondTrust's initial setup is quite easy if you're involved from the start. Deploying it as a virtual machine (VM) is straightforward. While someone new to VM creation might find it a bit tricky, I don't believe an experienced administrator would face any difficulties

I deployed BeyondTrust in-house with a consultant.

CISO is key to determining the ROI of this solution. They focus on the application's performance and behavior.

My experience with BeyondTrust Password Safe's pricing, setup cost, and licensing has been positive, primarily due to its asset-based licensing model. This is a significant advantage for us because it means we're not limited by the number of users with privileged access; instead, we're focused on the number of assets (like servers) we're managing.

Yes, but sorry did not want to disclose the name

It's user-friendly, and I rate BeyondTrust Password Safe as an overall 10 out of 10.

I find that BeyondTrust Password Safe is a very effective application for password management. I find it very easy to use and update.

The most valuable features of BeyondTrust Password Safe, in my opinion, are its ease of use and robust security management. The application is designed in such a way that if I do not have written privileges, I cannot use it. It ensures that only authorized systems can access the password, adding an extra layer of security.

I believe one improvement could be having the last used passwords appear more automatically whenever I check for passwords associated with a frequently used system.

When I was at Investec as an employee, I worked with BeyondTrust Password Safe for about two to three years.

In my opinion, the stability of BeyondTrust Password Safe is close to ten, so I would rate it a nine.

In my experience, the scalability of BeyondTrust Password Safe is also a nine. I find it simple to manage with more than one hundred users.

Based on my experience from at least two years ago, I found the technical support from BeyondTrust to be very good.

Positive

I find that BeyondTrust Password Safe is a lot simpler and easier to use than CyberArk.

I evaluated CyberArk.

I recommend BeyondTrust Password Safe for more than two hundred users as I find it helps manage passwords efficiently and prevents a big mess. My final rating for BeyondTrust Password Safe is eight out of ten.

For BeyondTrust Remote Support, I am onboarding accounts. I create special connectors through the RDS server into one server broker to run various applications. I establish browser connections and perform onboarding, uploading accounts, and applying remote rules. 

I also create smart groups for access. I also use Password Safe to allow users to connect through a target machine through the appliance with built-in databases.

The features I find valuable in Password Safe include password retention and management, session privilege monitoring, live monitoring and recording, and the use of PS automation scripts for creating connections. 

The smart tooling and smart group features are also important as, after finalizing discovery, they auto-collect accounts in the environment and organize them in Smart Groups for easy access.

If they can create a single platform to create a connector, it would be better than using the RBS server. There are limitations when accessing or creating connectors for each application. From PVW, I can create any connector, which provides ease compared to Password Safe.

For BeyondTrust Remote Support, I've been working with it for less than one year. Regarding Password Safe, I've been using it for around one year.

The solution is very stable, and I'd rate it as eight out of ten.

The scalability is around seven out of ten. The scalability depends on the database used. If using the built-in database, it requires good knowledge in Microsoft SQL, which could complicate scalability.

The technical support is very cooperative. Although I haven't faced any critical situations, the tickets for minor issues have been resolved efficiently.

Neutral

We were previously working with CyberArk, and now we are willing to start working with BeyondTrust solutions.

The setup is very easy, especially in a high-availability mode. It requires minimal effort in terms of Windows application installation.

Pricing is managed by a different team, however, I know it's less expensive than CyberArk Privilege Access. BeyondTrust's pricing for the cloud platform is affordable.

As advice to new users of Password Safe, you should connect through a native application. Improving this area is a work in progress, but no one has a success story yet. 

Overall, I rate BeyondTrust Password Safe as nine out of ten.

Our customers are looking for a product that offers provisioning in their network, and for that reason, they choose BeyondTrust Password Safe.

The pricing model being lower for unlimited devices and unlimited users has proven more cost-effective.

The flexibility of the licensing model is significantly better as it offers both unlimited users and unlimited devices, unlike Delinea, which is based on the number of users. 

The interface is satisfactory, and the deployment architecture is flexible and easier to use than Delinea, making scalability and integration simpler.

As of today, I haven't found any issues. Adding user behavior analysis to the server or messaging would be beneficial. This would help in identifying suspicious activities immediately when users log in.

I have hands-on experience with BeyondTrust Password Safe.

I would rate the stability as nine out of ten.

For the scalability perspective, I would rate it nine out of ten.

The technical support from BeyondTrust responds very shortly whenever a ticket is created.

The initial setup is more flexible for on-premises than on the cloud.

It is a cost-efficient solution as customers benefit from the licensing model offering unlimited devices and users.

The pricing model is more affordable with the option of going for either unlimited devices or users. It is cost-effective compared to other solutions.

Based on my experience, I would recommend BeyondTrust Password Safe to others because their technical support is responsive and efficient in addressing queries. 

Overall, I rate the solution ten out of ten.

It is used primarily to adhere to SOC compliance and to provide what we call user/administrator segregation.

We are an MSP. We do manage services, but we also do a lot of other things. We implement as well as do ongoing managed services. We don't use it in our organization. We have it in our lab set up as a running service so that I can go there and test something just to see what'll happen because I can do a snapshot of my system and then revert if things go wrong. That's something that I don't want to experiment with in a client environment, even in a test or a dev environment. I just want to test something. I can do that in our lab, but our organization does not use Password Safe.

BeyondTrust's discovery is off the charts. It doesn't just discover servers and user accounts, it also discovers the services, such as Microsoft services, and scheduled tasks. For example, if you want to change a password on a Windows service, which is also linked to other scheduled tasks or IIS app pools, just changing the password on the service is going to break the scheduled task and break the IIS app pool. BeyondTrust is able to dynamically discover and manage all three tasks of synchronizing, stopping, and starting the services as the passwords are being rotated. It is quite intuitive.

When we have services and devices that are in a red zone, which includes the internet-facing devices or the devices in the direct internet compartment, the password vulnerability is what we are trying to handle. The primary factor that makes a lot of security officers feel better is that passwords can be made long and complex, but even a very long and complex password over a period of time can be cracked. BeyondTrust allows you to not only do long and complex passwords but also regularly schedule rotations that are well within the timeframes of being able to crack a password. A password with 26 characters, 8 to 10 special characters, and an uppercase/lowercase combination will take IBM Big Blue six months to crack. In those six months, we would have changed that password 10 times or more. So, the password that IBM Big Blue is crunching on to crack has already been changed, rendering the previous password that might have been compromised inert.

It is useful for segregating user accounts. A common scenario is that a user receives an email and even though the email comes from somebody the user doesn't know, the user opens a Word document. The user gets a macro virus and is compromised. If it is just a regular user in the environment, it is only a disaster, but if it turns out that in that client environment, that user also happens to be a domain administrator or a local server administrator, it is armageddon. So, we use BeyondTrust to segregate user accounts where the domain admin connects to BeyondTrust with his user account, which also has a counterpart matching ID in BeyondTrust. When he connects to the endpoint devices to perform his job, the account that he is connecting to in BeyondTrust has the privilege. So, when he connects to BeyondTrust, he authenticates with his user account and connects to what I refer to as a dedicated admin account. That dedicated admin account is session recorded and keystroke logged. You have all the tracking records and Windows logs. Everything is captured, and then when the user is done, he logs off and continues on his workstation as a regular user again. The session is completely segregated.

So, we're able to provide user/administrator segregation. The reason I do the dedicated admin account is that, with multi-user shared accounts, it is a little bit more difficult to quantify who did what. It can be done, but it is just more difficult. With a dedicated admin account, it is one-to-one rather than one-to-many or many-to-one. BeyondTrust Password Safe provides the ability to do all of this with rules. They have template capabilities built into the product. All you have to do is customize Smart Rules to perform your action. That's the beauty of BeyondTrust. I don't know what I would do if I had to go back to another solution that did not have them. I've worked with other privileged management solutions. For me, not having BeyondTrust Smart Rules would be taking a step backward.

It is important that Password Safe provides integrated password and session management in one solution. When you have it in one solution, you don't have two devices to manage because at a certain point, if you need a secondary component to perform something that the original solution does not perform, that's another managed system that you have in your network, which adds on a transparent cost. Having password and session management in one solution keeps all of your administration within one application.

Its customization features help us to manage most assets, databases, and applications, which is critical. We are able to work and visually connect with various platforms, such as Linux, Unix, Linux, Ubuntu, etc. Ubuntu is being used a lot for small edge solutions because it is inexpensive. It is also easy to manage because it is a Nix platform. People put a lot of Ubuntu-based solutions on their edge devices, such as secure remote access or an HTML5 gateway. We're able to manage all of that within one interface in BeyondTrust.

Team Passwords feature has been hugely helpful for securely storing credentials owned by small groups outside of traditional privileged user roles. When you go into an organization, you've got people who are storing passwords in KeePass, or they've got PW Safe, which are free downloadables. The next thing you know, you have got 200 or 300 developers and administrators with all these individual solutions, and sometimes, some of them need to share them with each other. Team Passwords is your one-stop shop for all IDs and passwords that are not necessarily dedicated to a specific device. Just the IDs and passwords can be stored and allowed access by groups. We're doing a huge migration to Team Passwords, and we've developed APIs for creating the environment and importing the passwords. Tens of thousands of IDs and passwords are going into it. It is amazing. I remember 20 years ago, somebody was bragging about a password safe solution they did in Lotus Notes. I still giggle about that because Lotus Notes is fat, and it was very complex. Team Passwords is visually intuitive. My teenage daughter could sit down and do it.

So, this client had multiple password storage solutions. They first ended up installing Thycotic Secret Server because they also had certificates and a couple of other different types of authentication solutions, but they were veering away from certificate-based and needed an ID and password solution. The Thycotic solution was also out of date. The SQL database was falling apart. It was used to its maximum extreme. Considering they were already using BeyondTrust Password Safe, Team Passwords was a natural blend. 

In one of the cases, an engineer had a fairly large key pass solution, and when he left the company, his workstation was re-imaged. They ended up losing information for a significant number of devices. They happened to be network-oriented devices such as routers and switches. To this day, they are gathering all those previous IDs and passwords. Now, with BeyondTrust Team Passwords, all they have to do is to add a user to a group, and they now have access to all those IDs and passwords rather than somebody walking out the door with them or them getting wiped in a system re-image. They are in one location where they could be backed up and secured.

It starts with discovery. Its number one feature is discovery. The discovery engine in BeyondTrust is off the charts. When they perform a discovery, you know everything there is about a server, including what software is installed. For example, if you want to group all of your database servers together, you can do that by using discovery and Smart Rules. If a server has Microsoft SQL installed, it gets put into a group based on a Smart Rule. It makes it very easy to determine what is what in your environment. As organizations grow or acquire other companies and merge, they lose track of what they have. BeyondTrust can help you throw a rope around it very rapidly.

Its user interface is really nice. It is very visual. When you first log in, based on your job role, you see what you have access to when you look at the screen. As an administrator, I see the configuration screen where I can go in and modify Active Directory and authentication connections. I can set up SAML, or I also have access to create Smart Rules. The access is based on the role that you have when you log in. I have six boxes or six categories of administration items, whereas when an admin user connects, he would only have one or two. So, based on your role, you see what you have access to. It is not like you click something and then it fails because you're not an administrator at that level. You actually see what you have access to, and BeyondTrust is very good at that.

BeyondTrust provides the ability to connect by using not just the web interface but also the admin tools such as MobaXterm, PuTTY, or a lengthy list of other types of tools. You can use the connection string and connect through BeyondTrust, and it will be session recorded, keystroke logged, and highly available. When you bring up MobaXterm, you probably bring up one of the most complex ones because MobaXterm has the ability to have two, three, or four concurrent connections, which makes BeyondTrust Password Safe ideal.

It is very easy to integrate session management into existing business processes. To make it easy for the engineers, we created templates of the connection strings and then used, believe it or not, Microsoft Excel to create custom strings for each of the engineers. We exported them to a text file that they could then import. In the case of PuTTY, because PuTTY stores the connections and the credentials in the registry, we had to do something different there, but the connection string is customizable enough to make the job fast and easily repeatable for all the other engineers. You don't have 20 or 30 engineers spending two or three days creating all these connection strings. I can create them in a matter of minutes with a Microsoft Excel spreadsheet and then save them to a text file or a CSV file. It is awesome.

We are able to integrate session management without disrupting business processes. One of the niceties about BeyondTrust is the ability to integrate it with ticketing systems. For example, as per Sarbanes-Oxley, we have to have a reason for why an administrator is performing something. The integration with a ticketing system is ideal rather than manually typing the reason in the reason field through the GUI where most engineers, after a while, end up just typing in Work. They don't put in enough data to make it clearly visible why they connected. The integration with the ticketing system is ideal for that. Ticket-driven access makes the work very quantifiable.

If there was one thing, it would be having the documentation standardized. They should keep the documentation consistent. For example, when BeyondTrust updated one of their admin guides, they left out the information on the discovery account requirements, and then over a period of time, we ended up having to search multiple different documents to put together a string of information for a specific topic, which was problematic. It was minor, but it was problematic. Standardized documentation would be the one thing I would suggest.

I have been using this solution for two years, but I also have previous experience with BeyondTrust. There were other BeyondTrust products that I was intimately familiar with that gave me the confidence to move forward with the BeyondTrust Password Safe. I previously worked with PowerBroker for Unix Linux, but it was not in the password space.

It is awesome. It is very good.

It is very good. The scalability is dependent on how much CPU, memory, and space you want to put at it. There is a certain point of diminishing returns where it might prove better to have a high availability solution where it is active-active, and you have one part of the organization that is going to be primarily hitting one server, and one will hit the other for a load balance, but I haven't yet gotten to that requirement.

I have interacted with them intimately and regularly. I would rate them a 10 out of 10 because they have not just one; they have staff to bounce things off with each other. They're very quick and very responsive and very good. You're not treated like a number. Once we were setting up a special configuration, and one of their engineers said, "Hey, send me your MeetMe, and I'll join your call." Wow, that was nice.

Positive

We manage other solutions, such as CyberArk. A lot of our clients are at various stages. Some of them were uncertain about their existing privilege management solution, and they weren't updating it. They didn't continue the support packages with the provider, and they were in a state where they were unsure about what they wanted to do. We've had both experiences where we've gone in and based on their organization, we recommended upgrading or continuing the support of their existing, CyberArk or Centrify, solution. In some organizations, we've recommended switching to BeyondTrust.

When I went in, it was already set up, but I'm installing additional BeyondTrust Password Safe solutions. I manage services, and I'm also implementing Password Safe for new environments. 

It is a little bit of a blend of straightforward and complex. If there is something you leave out or you miss, you're going to feel it later. For example, you missed a step for configuring Windows component services because you went to lunch and forgot to click OK. Your screen went into the screen save mode, and you lost the information that you had put in, and you left that out. You're going to feel it later. However, luckily, they've got incredible logging built into the product, and you can look at the logs and be able to diagnose what went wrong. If you follow the installation uninterrupted, you can implement BeyondTrust Password Safe in a day. That would include integration with Active Directory and setting up the basic features like discovery. 

BeyondTrust can provide you with an appliance, which is a hardware device, or you can install an appliance-type image onto a Windows server and have your own appliance. It just won't be a dedicated appliance. Many organizations would like to have easily managed systems, and the BeyondTrust appliance methodology, even though superior, can make it more difficult to manage in an environment because it has to be handled as a specialty appliance. It is not a positive, but it is not a negative either. It is an organizational decision that needs to be made on how they want to manage the device, but either way, it can be done.

I will be implementing hybrid cloud environments as well. We are doing a blend with 80% full on-prem and the other 20% of the development is towards a cloud-based solution, primarily for a segregated environment. We are working with a lot of edge services with our clients. For example, they'll have a secure compartment for a specific application, where Windows, Linux databases are being run within this compartment, but they are managed by an external team. Most of the security has been focused on just preventing who has the access, but it doesn't answer the problem of what they are doing when they are in the compartment, and we're using BeyondTrust for that. So, we are having two layers of security. We not only have access control where getting into the compartment is taken care of, but once they're in, we can also granularly control what they have access to and what they can do. We have session recording and keystroke logging for audit records. So, we're blending. Currently, we're developing such a secure compartment, and we're going to have one BeyondTrust Password Safe server in the cloud. It is going to be an active high availability solution that'll have a paired server, but it is going to be on the local network. We will possibly be doing one complete cloud solution in the Amazon compartment.

In terms of duration, the longest part of my job is waiting for account provisioning. I'm usually waiting on Active Directory or Linux or database account provisioning. I spend more time waiting than implementing, but then I just move on to another organization or another environment and continue. I keep a rapid rotation, but account provisioning is the lead time.

You pretty much do it yourself, but BeyondTrust has an incredible case system where you can submit requests. You can do it for information where you're just asking a question about something, which I did for discovery accounts, or you can submit that your server is having an error and something is not working properly. You can create a higher priority ticket and submit it. BeyondTrust has a way to export a package that will provide them with the files that they need from the system to perform a diagnostic, and then they can tell you what you need to do. It is pretty cool.

For migrating end users to Password Safe, an organization needs to make several decisions. They first have to decide whether they're going to use multi-user shared accounts, where they will have one account that six or eight people can use, or they're going to have dedicated admin accounts, which is my preference. It is slightly more complex, but it makes it much more secure. So, that would vary from organization to organization.

For upgrades, they have an incredible updater. That's what it is called. It automatically detects and is connected to BeyondTrust, and you'll be notified that upgrades are available. You can set them to be automatic or not. There are some updates that you don't want to be automatic because you might want to do a snapshot of the appliance before the update because some updates can cause problems. I haven't experienced that yet, but you have the option of automatic or manual provisioning of the updates. You can schedule them based on off hours, for example.

It is very robust in the area of maintenance. Part of the problem is when things are going so well for so long, you forget about it. That's why we schedule all of our activities so that all of a sudden or six months later, we don't discover that a server is having severe issues. We just manage by the clock, but BeyondTrust Password Safe is very robust in the area of keep running. It runs, and it also has other types of capabilities that are built into it. For example, if the session recording and keystroke logs are stored on the actual appliance or server, they eventually will take up a lot of disk space. In my lab, I experienced a crash because I ran out of disk space. BeyondTrust has the ability to very easily redirect the storage of session recordings and keystroke logging to a network drive and off the appliance. I'm glad I was able to experience that in my lab rather than getting a call from the client that their server is crashing. If you have a high volume and a lengthy time frame for which you want to save the session recordings, being able to save them to a network drive is incredible.

The time to value, or the amount of time it takes to see benefits, varies by the organization because some organizations have a different plan right up front, but the time to value with BeyondTrust is fast. It is a very rapid return on a visual inspection of whether you are meeting your goals and objectives. You'll see it very fast.

When you buy Password Safe and perform your initial Discovery, you have all these servers that are added to your assets in BeyondTrust, but you're not using a license until you actually start managing the systems. BeyondTrust's licensing is based on the systems when they're managed, which means when an administrator is able to connect to the server through BeyondTrust with a managed account. There would be a privileged account on the endpoint when the licensing starts. A significant advantage to that is that there are many organizations that want to evaluate their environment prior to automatic management. For example, they are going to be upgrading to a larger router instead of having two routers. They are going to have one so that would be one managed license rather than two. It gives them a chance of seeing their environment before they commit to managed systems and licenses.

I would recommend this solution. My advice to others looking into implementing BeyondTrust Password Safe is to follow the instructions, scan broadly, and manage specifically. That's what BeyondTrust allows you to do. You can scan everything, but then select what you want to manage. With some applications, the licensing starts right at discovery, but BeyondTrust licensing is by managed systems. So, I recommend scanning broadly, finding everything you've got, and making your decisions based on the actual numbers. That's one of the advantages of BeyondTrust. So, use it.

One organization I went into was primarily concerned with 50 specific servers. They had thousands. When all was said and done and we asked them what about the other servers, they did not specify what they wanted to do with those. They were only concerned about getting those 50, whereas BeyondTrust allows you to handle 10,000 as easily as 50. It is crazy not to leverage that. What you want to do is scan broadly and then manage according to plan. If you've got 1,500 servers and you're only looking at 50, that's like looking through a toilet paper tube. You will have a very narrow view. So, what you do is scan and discover broadly, find out what you have, and then come up with the administration model that'll work for them all. Start with 50, and then roll out the other 950 automatically. If you design it right, the minute a new administrator is added during that night's discovery, that user is ready to start working the next morning, or that server gets discovered and added based on the Smart Rules. So, a new Linux server or a new Windows server becomes available the next morning. A newly hired administrator's account is discovered, and as a member of the administrator group, he is automatically ready to start work first thing in the morning. No intervention is required.

We have not used the solution's software development kit to create a plugin to support new systems or applications, but they do have them that you can modify. We're looking at making a modification to an existing platform connector. Their platform connectors are very visual, and you have the ability to compare. We're looking at the original Linux connector, and we want to connect to an SCO server. We have a template to work from. We will speak to the experts regarding SCO and make modifications to another connector to create a new connector. It is pretty dynamic.

At this time, my opinion is that it is a 10 out of 10. Based on having experience with three or four other competing solutions, I would give BeyondTrust a 10 out of 10. I normally don't give this sort of a rating, but I do give BeyondTrust a 10. If you read two or three of their advertising and website blurbs and that's what you need, you're going to get it. When they talk about the ease of administration and the ease of implementation, it is all for real.

Typically, we would allow users to connect with their regular user ID, a non-privileged user account, and automatically connect to a designated privileged account managed by BeyondTrust. This account would be onboarded to target systems or databases, preventing users from using their user account as a privileged account. Instead, it would act as a surrogate, using only a managed, dedicated account the user could access.

The platform's most valuable feature is its architecture capabilities, which allow for creating and supporting high availability and failover through designated server components.

The initial server implementation tasks could be easier to process. 

I have been working with BeyondTrust Password Safe for four years.

While some initial server implementation tasks may appear to hang, they are simply processes communicating with each other. 

Overall, the solution is very stable and intuitive.

Thousands of users were utilizing the product across our sites. I rate the scalability a nine and a half out of ten. 

The technical support and customer services are phenomenal. There were instances when we experienced outages during scheduled updates in the middle of the night. On one occasion, an update hung, and we couldn't resolve it. We got technical support that night, which was extremely impressive.

Positive

The initial setup is very straightforward if you understand network architecture. 

Once all the documentation was created, the deployment took about two to three days per site. As the security architect, I was responsible for the documentation, while another team member typically handled the actual implementation. I did step in to handle some implementations myself when one team member had an emergency.

It requires maintenance, typically a weekly manual process or monitoring updates. While most updates can be done automatically, some require manual triggering. One person per site handles the weekly updates, though one person could manage all five sites.

The task of managing the updates is relatively low-level and is often assigned to newer team members. I created very detailed documentation, so they needed to log in, follow the instructions, and let the processes occur. The most time-consuming aspect is waiting for the update processes to complete, which occurs only once a month or every two weeks.

Four team members were involved in the deployment because we managed five separate international locations.

I rate BeyondTrust Password Safe a nine out of ten. 

We use Password Safe to protect privileged identities and privileged access. The difference between any PAM and IM is that IM is basically for all the identities and the users in the organization. PAM mainly focuses on privileged access. For example, it can be to any database, or a Windows machine where someone is an administrator, or on a Linux machine where someone is root or equivalent to root, or any other web-based application where someone is an administrator. The focus was that any user should log into the infrastructure using PAM.

Every user, administrator, and developer who logged into IT infrastructure used BeyondTrust Password Safe.

I used BeyondTrust in my previous organization. We used version 22. They recently changed their version number so it matches the year. For instance, in 2022, the version number is 2022.

BeyondTrust Password Safe is used so that all the activities can be recorded and logged. Sessions can be monitored, and all of that data can be audited later if needed. Generally in organizations, IT departments, or teams, people find it difficult to rotate passwords. If it's an administrator account, the passwords are generally not rotated. They're either shared between teammates, or the passwords are written down somewhere. With BeyondTrust, you can automatically rotate the password, and set the complexity of the password, the letters, the characters, special characters, upper case, lower case, etc. You can choose when the password should be rotated, and if the password should be rotated every day, every month, or after every use.

You can enforce your password policies on these privileged accounts, which previously were not rotated that much. There are so many breaches. Recently, there was a SolarWinds attack where the password was solarwinds123. The privileged accounts were not safeguarded, and the passwords weren't rotated. People knew the password. But with this solution, no one needs to know the passwords. If it is implemented in the perfect sense, the passwords will be rotated regularly. Administrators who are logging onto the system's servers and databases don't need to know the password because the session is proxied by Password Safe's solution directly. You will see the applications, and it helps enforce least privilege, which is one of the main principles.

With least privilege, if you are allowed to have access to only two servers out of ten, then you will only be given access to those two servers. You click on the machine you want to log into, and you will get the link. If you want to do RDP or SSH, click on that and the session will be launched. You don't need to know the password, and passwords are automatically rotated.

The solution is deployed on-premises.

In my organization, there were hundreds of users. There were different teams. In other organizations, I have seen 1,000 users at different points. At any given time, there might be 400 or 500 users.

They are mainly admins and end users. End users can vary a lot and have different roles. They are the people who log onto the servers, databases, network devices, and web applications. There are a few admins, developers, and network administrators. Administrators are also end users in any particular instance because they're also the users and consumers of that particular service.

It's a security product that gives users flexibility. They can open an RDP system and then go into it. When you introduce a layer into a security system, users are forced to do things that they weren't doing before. If you ask any operational team, they will say that they used to do a task in five minutes, but now it takes them ten minutes. They aren't happy with having any solution in between. That's always a security versus operations issue. 

It definitely improves security, and audit compliance is also well taken care of when you include software like that.

The best aspect of the product is the ability to onboard devices. You can scan the IP subnets and onboard all the devices. You can then segregate them if it's a network device or a firewall. If it's a Windows server or a UNIX, you can basically scan your IT infrastructure and onboard the efforts, which should be managed. Once they have been onboarded, then the session management and password management are easy and nicely configurable. 

The session recording features are part of session management, and you can search for any keystrokes or mouse clicks. The analytics and reporting provide a very comprehensive view that shows all of the users who are using Password Safe, what servers they're using, with what access, what time, and for what reason. The analytics and reporting provide good auditing data.

Password Safe provides integrated password and session management in one solution. The session recording is quite important when you're safeguarding your privileged accounts. If the user knows the password, then you have to do some other actions like network changes, or else users will open the sessions directly. They will not use the session recording, or the session management part. They won't go to the PAM solution to access any servers. They'll directly open a Linux session or RDP session without being monitored if they have the password. If the password is compromised, then that's a problem. If the password is being rotated but there's no session recording, then it's like a password vault where you take out the password and use it.

For the duration of time that the password is not rotated, that password remains vulnerable. If you have a rotation policy of one week or one month, and then someone has taken out that password from the vault, that password remains vulnerable for one month. That's why session management and password management go hand-in-hand because the passwords are rotated regularly, nobody knows the password except the system itself, and the system opens up the sessions without telling you the password. It will just note down the entry that you have opened this session. Depending on the configuration, it will rotate the password in the back end, and it should be seamless. Nobody needs to know that there was a password, what the password was, and if it has been changed or not.

The Smart Rules feature is very helpful for management. If I have to do something manually, it will take me loads of time. There are chances that I make mistakes. It's a very painful task to onboard a managed system one by one. If you have 1,000 Linux servers that follow the same policy, you can manage them under one smart tool, which is a five-minute job. 

If there are 1,000 systems, I can onboard them in one day with smart tools. Without smart tools, it will take weeks.

I have used the solution's software development kit to create a plugin to support new applications. They have recently made some changes. It was a bit tricky when they were using AutoIt to do this, but recently they have made some changes. Now, it's quite easy to create new applications which you can use to open sessions.

The intuitiveness of the solution's user interface is much better. Before, it was using Flash content, which has been removed. Now, it's using HTML5, and the user experience has improved. There are two perspectives. One is administrator, for people like me who are managing the system, and one is for end users. For end users, it's quite simple and easy to use. The UI is very clean, so you don't have to go to multiple pages back and forth to reach the end goal, which is opening up your session. 

We use the team password feature to securely store credentials owned by small groups outside of traditional privileged users. The entire team can easily share passwords, and it provides an audit trail that shows who has added, deleted, viewed, or copied the passwords.

We use the solution to integrate Password Safe session management into existing business processes using existing tools, like Putty. With Putty, it's simple. There are some changes that need to be made in the registry, so the system knows what SSH tool you are going to open. For MobaXterm or WinSCP, it provides a link URL. You can use a connection string to open sessions like that if there are any thick or thin clients. Thick clients are applications that are downloaded on your machine. Thin clients are web applications.

When a PAM administrator creates an application and maps it to the smart groups, the users will see that there is a link and will open the session. There's an intermediary solution in between called a terminal server or Remote Desktop Server, RDS. That terminal server can be hardened, and that opens the application. It could be a web application like Splunk or a thick client, like Putty, Oracle, or MSSQL. It can open that user interface for you. It basically gives you a restricted user interface where you only see that application opening up for you, and you can do the tasks you need to do.

Some integrations are easy, and some are complex. It depends on the business application. If the application is simple and straightforward, then it is easy. If they need manual intervention, it's more difficult. In Password Safe, we see how someone is logging onto any business application, manually. Then we try to automate those things using SDKs, the AWS app, or AutoIt. It depends on how simple the login process is without the PAM solution.

We're able to integrate session management without disrupting business processes. We don't touch business processes in most cases. Usually, we try to replicate what the users are doing. Otherwise, the only thing we add is a layer in between.

The database instance onboarding should be simplified. The problem is that you can scan the assets and databases inside a server, but you cannot onboard them or manage them with the smart tools. It has to be done manually. I think they should try to include more custom platforms.

With the databases, there were some issues. The databases are inside the servers, and it was a bit difficult to scan the databases. Apart from that, the rest of the assets were easy to scan and integrate. It's difficult to onboard the database. You can scan and find them, but you have to onboard the databases manually. You cannot onboard databases using Smart Rules databases. Database instances are difficult to onboard and must be done manually.

The applications should be more like in the SDK. They have good API support now.

I have used this solution for five years.

The solution is stable. There haven't been any challenges with stability.

If you have active-passive infrastructure, then you cannot scale. Active-passive means there are only two servers and the databases are internal. If the infrastructure is active, you can scale it as much as you want. You can increase the number of password servers, databases, and terminal servers. Everything can be increased if it's active.

I would rate support as nine out of ten. Technical support is good and has improved over time. At one point, most of their support was in the USA  and Canada. Now, they have support in Singapore, the UK, and the Gulf region. Technical support has increased, the number of people has increased, and the services have also increased. I haven't had any problems with the technical support. They are as helpful as possible.

I deducted one point because sometimes they'll say, "This is a development task or a professional services task, so we don't touch it," but it's good overall.

Positive

The initial setup is okay. If you're doing active configuration, you need an external database. That external database part can be tricky at times, but everything else was straightforward.

If you have everything ready, like the traffic, then deployment generally doesn't take long. It can be completed within two days. The problems happen in IT infrastructure if the servers, network ports, or accounts aren't ready or created. The terminal servers need admin accounts. IT infrastructure causes the delay. Most of the time, the teams don't have that prerequisite list, so it isn't clear-cut. Even if they have that, opening up network ports is always a challenge during the initial deployment and onboarding.

Organizations have to understand what could cause delays, but deploying it was not that difficult. The reporting and analytics part is a single point of failure. Generally, you cannot deploy A&R in high availability.

The amount of staff needed for deployment and maintenance depends on the size of the system. If you have active-passive, a couple of people can do the job. If you have four UVMs, external databases, and terminal servers, then you need three to four people. If you have a very big infrastructure and a huge development team with 10 or 12 appliances and thousands of users, you would need a team of seven or eight people for development, administration, and business analysis.

The pricing structure is better than the competitors. It's much cheaper than CyberArk. They do the licensing on the basis of assets, not on the number of users. For CyberArk, they base the licensing on the number of users, and they have an expensive model of pricing. BeyondTrust has a cheaper model.

I would rate this solution a nine out of ten.

There are multiple ways to go through an upgrade process, but generally there is an easier way for the enterprise update server. With the UX, the upgrades are quick. The web UI allows you to configure the upgrades. You have a different URL for upgrading your pre-production or test environment first, and then you can start using it. It only takes a few clicks. You should know how to configure it in the beginning.

The time to value is six months to one year. The timing depends on your internal IT infrastructure. There are struggles with these implementations and deployments because of network changes, user awareness, and user readiness. It's tricky to make a solution perfect in comparison to a real world solution. When you go into the world of security and start going down the rabbit holes, that's where you start consuming a lot of time. 

If you have a clear-cut vision, an efficient IT infrastructure, a good networking team, and full support from the management, it should be top-down. It should never be bottom-up. If there is a push from management, management cascades to its team leads and the team leads provide support, then the time to value can be six or eight months, depending on how big the infrastructure or setup is. Generally, it takes six months to a year. I have seen projects that have lingered for three years and still haven't produced value. They didn't have experts to carry on the project. There are many variables, but if you have the right people, attitude, management, and plan, you can deliver in six to twelve months.

The solution was implemented to secure privileged access management in a large-scale corporate environment.

Privilege access management protects the accounts that have administrative privileges and secures those in a secure and encrypted vault so that they are secured and protected. Not having the credentials "on the wire" is only one part of what the solution offers. If the credentials are exposed on the network, they can be exposed to various vulnerabilities and increase the attack surface areas.

Protecting privileged accounts reduces the attack surface area. It is estimated that around 70% to 80% of all compromises in cybersecurity are due to unauthorized privileged credential exposure, either by lateral movements or phishing attempts. By securing those accounts, we tackle a significant part of the problem. 

Additionally, knowing who, when, and how the privileged credential is being used via the reporting and analytics module allows visibility into a previously unknown area.  

The actual innovations offered by the vendor stand out to me. They are quick to respond to market demands and the changing environment of privileged access management. I see BeyondTrust Password Safe as an innovation leader compared to some of the other vendors in the market.

Documentation is the primary area of improvement. Their documentation has improved over the last three to five years, but there's still room for improvement. A more intuitive search and not having disparate documentation categories would be helpful.  

While they are quick to market for improved features, there are still additional features that other vendors have that they don't have like a credential injection for the users' web browser extension.  

I have been using this solution since 2013. 

The solution is very stable. Part of my role is to design and implement disaster recovery and business continuity planning. Although planning is important, these are rarely put to use.

The solution is very adaptable. The solution can be deployed in environments with a single domain and then scaled up to handle multiple domains positioned globally as well as adding cloud security. 

Customer service and support are great! 

Positive

I worked with Delinea, which used to be called Thycotic and CyberArk.

The decision that clients typically make to choose BeyondTrust is often from a proof of concept (PoC) or through an extensive advisory engagement. One differentiator is shown between a user-centric environment versus an asset-centric environment. The two clear differences between BeyondTrust and CyberArk are that BeyondTrust is more asset-driven, while CyberArk is more user-driven. Both have their advantages, but it depends on the workflow and architecture that suits the client.  

As a person that has been involved in multiple deployments of BeyondTrust Password Safe for various companies, I can say the initial setup is fairly straightforward. 

In-house deployments can be challenging and so leveraging a delivery provider that specializes in PAM deployments provides numerous benefits. PAM/IGA/IAM are unlike many other security solutions as it has their own language and unique demands that are often not as intuitive. Knowing how to overcome project crawl, analysis paralysis, adoption challenges, and executive buy-in can be helpful.  

The ROI can be quickly realized for BeyondTrust vs. some of their competitors. The ease of implementation and the speed to get that initial return on investment is impressive.  

With the BeyondTrust solution, you have the capability to deploy the more secured layered solutions such as Secure Remote Access (SRA), Endpoint Privilege Management (EPM), and Identity Security Insights (recently released this month) that are all designed to protect the entire enterprise.

BeyondTrust has migrated towards subscription-based licensing/annual renewals. They remain competitive and on par with their pricing, often coming in under other competitors. Pricing is one of the reasons clients choose BeyondTrust, but it's not the only reason.

Overall, I would rate the solution an eight out of ten. 

One of the more important areas to focus on is knowing your environment pertaining to the assets and accounts before deployment is attempted. Not knowing what needs to be protected will make the deployment more challenging. Although BeyondTrust excels in the discovery of assets and accounts, knowing WHERE to look can be challenging. 

Deploying the product using only a percentage of its capabilities can lead to frustrations and reduced ROI. Not managing service accounts, networking, and database teams that are typically more challenging can lead to vulnerabilities as well.

You can't just focus on privileged access management. Privileged Remote Access, as well as solutions such as endpoint privilege management, are all part of a complete identity and access management solution that must be designed and deployed correctly. If not designed and deployed correctly, it will have the opposite of making the environment secure. 

Least privilege, zero trust, and cloud security awareness are all buzzwords we see often. Privileged Access Management (PAM) is a part of the layered security approach that will keep your company out of the cyber news headlines.