It is used primarily to adhere to SOC compliance and to provide what we call user/administrator segregation.
We are an MSP. We do manage services, but we also do a lot of other things. We implement as well as do ongoing managed services. We don't use it in our organization. We have it in our lab set up as a running service so that I can go there and test something just to see what'll happen because I can do a snapshot of my system and then revert if things go wrong. That's something that I don't want to experiment with in a client environment, even in a test or a dev environment. I just want to test something. I can do that in our lab, but our organization does not use Password Safe.
BeyondTrust's discovery is off the charts. It doesn't just discover servers and user accounts, it also discovers the services, such as Microsoft services, and scheduled tasks. For example, if you want to change a password on a Windows service, which is also linked to other scheduled tasks or IIS app pools, just changing the password on the service is going to break the scheduled task and break the IIS app pool. BeyondTrust is able to dynamically discover and manage all three tasks of synchronizing, stopping, and starting the services as the passwords are being rotated. It is quite intuitive.
When we have services and devices that are in a red zone, which includes the internet-facing devices or the devices in the direct internet compartment, the password vulnerability is what we are trying to handle. The primary factor that makes a lot of security officers feel better is that passwords can be made long and complex, but even a very long and complex password over a period of time can be cracked. BeyondTrust allows you to not only do long and complex passwords but also regularly schedule rotations that are well within the timeframes of being able to crack a password. A password with 26 characters, 8 to 10 special characters, and an uppercase/lowercase combination will take IBM Big Blue six months to crack. In those six months, we would have changed that password 10 times or more. So, the password that IBM Big Blue is crunching on to crack has already been changed, rendering the previous password that might have been compromised inert.
It is useful for segregating user accounts. A common scenario is that a user receives an email and even though the email comes from somebody the user doesn't know, the user opens a Word document. The user gets a macro virus and is compromised. If it is just a regular user in the environment, it is only a disaster, but if it turns out that in that client environment, that user also happens to be a domain administrator or a local server administrator, it is armageddon. So, we use BeyondTrust to segregate user accounts where the domain admin connects to BeyondTrust with his user account, which also has a counterpart matching ID in BeyondTrust. When he connects to the endpoint devices to perform his job, the account that he is connecting to in BeyondTrust has the privilege. So, when he connects to BeyondTrust, he authenticates with his user account and connects to what I refer to as a dedicated admin account. That dedicated admin account is session recorded and keystroke logged. You have all the tracking records and Windows logs. Everything is captured, and then when the user is done, he logs off and continues on his workstation as a regular user again. The session is completely segregated.
So, we're able to provide user/administrator segregation. The reason I do the dedicated admin account is that, with multi-user shared accounts, it is a little bit more difficult to quantify who did what. It can be done, but it is just more difficult. With a dedicated admin account, it is one-to-one rather than one-to-many or many-to-one. BeyondTrust Password Safe provides the ability to do all of this with rules. They have template capabilities built into the product. All you have to do is customize Smart Rules to perform your action. That's the beauty of BeyondTrust. I don't know what I would do if I had to go back to another solution that did not have them. I've worked with other privileged management solutions. For me, not having BeyondTrust Smart Rules would be taking a step backward.
It is important that Password Safe provides integrated password and session management in one solution. When you have it in one solution, you don't have two devices to manage because at a certain point, if you need a secondary component to perform something that the original solution does not perform, that's another managed system that you have in your network, which adds on a transparent cost. Having password and session management in one solution keeps all of your administration within one application.
Its customization features help us to manage most assets, databases, and applications, which is critical. We are able to work and visually connect with various platforms, such as Linux, Unix, Linux, Ubuntu, etc. Ubuntu is being used a lot for small edge solutions because it is inexpensive. It is also easy to manage because it is a Nix platform. People put a lot of Ubuntu-based solutions on their edge devices, such as secure remote access or an HTML5 gateway. We're able to manage all of that within one interface in BeyondTrust.
Team Passwords feature has been hugely helpful for securely storing credentials owned by small groups outside of traditional privileged user roles. When you go into an organization, you've got people who are storing passwords in KeePass, or they've got PW Safe, which are free downloadables. The next thing you know, you have got 200 or 300 developers and administrators with all these individual solutions, and sometimes, some of them need to share them with each other. Team Passwords is your one-stop shop for all IDs and passwords that are not necessarily dedicated to a specific device. Just the IDs and passwords can be stored and allowed access by groups. We're doing a huge migration to Team Passwords, and we've developed APIs for creating the environment and importing the passwords. Tens of thousands of IDs and passwords are going into it. It is amazing. I remember 20 years ago, somebody was bragging about a password safe solution they did in Lotus Notes. I still giggle about that because Lotus Notes is fat, and it was very complex. Team Passwords is visually intuitive. My teenage daughter could sit down and do it.
So, this client had multiple password storage solutions. They first ended up installing Thycotic Secret Server because they also had certificates and a couple of other different types of authentication solutions, but they were veering away from certificate-based and needed an ID and password solution. The Thycotic solution was also out of date. The SQL database was falling apart. It was used to its maximum extreme. Considering they were already using BeyondTrust Password Safe, Team Passwords was a natural blend.
In one of the cases, an engineer had a fairly large key pass solution, and when he left the company, his workstation was re-imaged. They ended up losing information for a significant number of devices. They happened to be network-oriented devices such as routers and switches. To this day, they are gathering all those previous IDs and passwords. Now, with BeyondTrust Team Passwords, all they have to do is to add a user to a group, and they now have access to all those IDs and passwords rather than somebody walking out the door with them or them getting wiped in a system re-image. They are in one location where they could be backed up and secured.
