One Identity Safeguard Reviews

There are two parts to Safeguard: the sessions recording part and the password management appliance. With the password management appliance, we have been using version 2.10. For the sessions recording, we started off with version 6.2. It has new additions and updates which have come out, thus we've upgraded. Currently, we are up to version 6.5.

We are doing a sessions recording for all of our UAT and production servers. Therefore, if something breaks/happens or there's a change during the day without the proper change control mechanisms, we can determine the session by pulling the last session on the box and finding out who did what. Then, for the password part, it is used to consolidate enterprise-wide all our passwords for our 2000-plus server accounts.

We have five physical alliances for the password part. Then, for the sessions recording, there are three virtual appliances. We went with these particular versions because they were the latest and greatest. I like to keep things updated instead of dragging stuff out, which is how people get stuck with legacy devices unable to upgrade or with no upgrade path available.

It has greatly helped improve our security posture. Safeguard has an option where it will reset passwords on service accounts, then go out to those servers where that service account is running as a service and update the password on it. That makes password changes very easy. We can regularly change passwords now and are planning on making it an annual activity, where all the people who own service accounts will go in and make sure all their passwords get changed, updated, and reset. That's a huge scary stance right there because people leave the company and memorize all their passwords. Now, they're null and void, and we're in a far more secure place.

We are still building out the Safeguard behavioral analytics feature, but so far, it's pretty good about being able to detect nonhuman input. This has increased our security posture as well. It's really easy to use. Security guys are able to identify, "Why is this person logging into spots on the weekend when historically they've never accessed it on the weekend whatsoever?" We're able to keep watch as there is a lot better visibility of our environment.

The password part is the most valuable because we were going to start vaulting certain accounts to get a lot of passwords changed. Historically, we have had really stale passwords on non-human and service accounts. E.g., on one of our service accounts, the password hasn't changed for 17 years. It was not even that complicated or good of a password in the first place. 

This solution has definitely helped us consolidate. It replicates to other appliances, so we're replicating to our DR site. Thus, if anything were to happen to our data center or personnel, whomever was trying to pick up the pieces and try to put the business back together would at least have all the passwords available to them.

The physical appliance form factors are pretty nice. They are definitely Dell inspired and easy to set up with accurate instructions. We have had no problems.

Regarding usability and functionality:

• It has a nice, clean interface. 
• It's pretty direct and easy to personalize. 
• Users can set up favorites on certain things that they request. Very often, they shortcut it. So, it reduces the clicks down to three clicks. 
• You can have a password for any account. 
• It's auditable, which makes the security guys' happy.

We tried the solution's “transparent mode” feature for privileged sessions. It ended up making a lot of Cisco Layer 2 configurations hard and was using a lot of ACLs to control the traffic, which we identified as type of a risk. In order for it to do production that would put an unnecessary burden on our network guys to configure it because that's thousands and thousands of lines of code that they'd have to update and change. We did use this feature for the PoC and that worked out well. However, for production, we are using the Remote Desktop Gateway feature.

Transparent mode was too cumbersome, so I don't foresee us being able to use it. On paper when we were initially talking about it, it was definitely going to be the preferred method until we realized the burden it would be on our network guys. Then, we had to step back and reevaluate what we wanted to do. That's when we changed our approach to use the RD Gateway feature.

I would like their transparent mode to have an easier implementation. If there was a way that we could do transparent mode without having to use ACLs that would be incredibly beneficial. 

They could do a better discovery to find out where service accounts are being used on non-Windows Boxes, such as Linux. That would be a good benefit.

Six months.

The stability is very good. There have been no problems at all so far.

We have four administrators who do maintenance. One of them is the security guy. He will go in and through the audits, looking at session recordings. We also have it locked down so that only he view these things. There are three other admins, including me, are responsible for maintaining the product. We keep things up, making sure the Gateway works, and helping users troubleshoot if they have problems with the Gateway.

It is very scalable. If we want to add another site or stand up another data center, we just buy a couple more appliances. Then, we set up a couple more session boxes and everything is covered.

So far, we are just using it for passwords, then passive session monitoring. Therefore, our usage is pretty minimal:

• Trying to track down people's accounts.
• Getting locked out because of user password changes.
• Not closing out of RDP session right. This is sort of a pain. However, people are getting better about logging off appropriately instead of just closing out the window.

We have about 140 end users because it is really just for our IT people. So far, businesses or anybody outside the IT organization doesn't even know the solution exists.

I love the tech support guys. Anytime that I have a problem, I can always put in a ticket. They get back to me right away. We have access to the product team and their Level 3 engineers. I've suggested a couple of feature requests and improvements on the product, then within six months, they were able to put those into an update which was rolled out. So, they are very efficient and quick.

I was surprised because I have dealt with Microsoft support, and we all know how it is: It's pretty terrible. I've dealt with other support companies where you will get somebody with a thick Indian accent and spend 70 percent of the conversation making sure he said what you thought he said. However, with the One Identity folks, it was easy and quick. They're a great group of guys.

PAM is totally new to our enterprise. Safeguard was definitely a cultural shift.

The initial setup was very straightforward and only got complex as we added use cases. We added the complexity on ourselves, but the product itself is very straightforward. The deployment took five months.

The implementation strategy was:

1. Setting up the sessions box. 
2. Ensuring it was set up once we received the Gateway configurations. 
3. Setting up policies and notifying people on how to change their Remote Desktop Client configurations. 
4. Shifting gears and switching over to trying to input all the service accounts and getting all the passwords loaded up into Safeguard. 

After that, it was a done deal.

Our privileged users did complain and grip a bit due to the deployment. At first, they made it seem like the solution was disruptive to them. However, as time went on, complaints went down. Therefore, I think they're used to it by now. They just needed to understand the new technology and get comfortable with it.

We really did have old passwords. People hung onto their processes and certain ways of things. When you asked them to change, they got grumpy. I knew that they were going to get a little grumpy, but I didn't know they were going to be that grumpy. They are over themselves now, especially since the director stepped in, and said, "This is how it's going to be. Get used to it."

We used One Identity Professional Services. They were great. We got the same guy who helped us roll out our Identity Manager. It was really good to work with the same guy. He was a familiar face, already very knowledgeable about the product, and very quick to get answers.

For the deployment, it took about five total people: a security guy, a network guy and a couple of infrastructure guys.

We were able to get rid of a couple products, e.g., Identity Manager replaced FIM. Safeguard was totally new. Two-factor authentication has saved us from a couple of brute force attacks on a couple of our C-level executives. That was a pretty good return on investment. We have been able to protect ourselves against a couple of major compromises.

There have been at least three instances where 2fA protected us from compromises, and probably a whole lot more. It seems like people are constantly trying to hit, attack, and penetrate a lot of the things that we have on the perimeter and are Internet exposed.

It is a bit on the pricey side, but you get what you pay for. You don't want to get anything too cheap because then you get cheap stuff and cheap support. That really never helps anybody.

There are other additional costs for some training on their other products because Identity manager can get very involved. Once we got the products and licensing setup, everything else since then has been cake. I don't think we have been spending a whole bunch of money.

We didn't want to use a whole bunch of vendors. We had already picked One Identity for their two-factor authentication, Identity Manager, Cloud Access Manager, and Password Manager (self-service) solutions. We just sort of drank all the Kool-Aid.

We tried to look for a comprehensive product offering and One Identity was the only one who checked off all the boxes and things that we were looking at to roll down for the next five years. They are a great partner and always willing to work with us. They are awesome.

We did evaluate other vendors: Centrify, Okta, Azure AD, Azure 2FA, and Ping Identity. We were able to quickly rule them out, but these were the main competitors. 

Azure AD is a lot of hype. It sort of sucks. The One Identity product works a lot better, as it's a lot easier to use and GUI-driven with a lot of wizards in it. Azure AD is a bit more complex and doesn't seem like it works all the time. That's why we didn't choose it. It seemed pretty unreliable compared to One Identity.

Take your time. Talk to as many different aspects of the business in the company as you can. Get a lot of input from many people. Know how to sift through good and bad input. Use Professional Services, if you can. The tech on-demand services was much cheaper than their full-blown professional services. For the tech on demand services, we never had to wait more than a few days for some type of response.

The training was pretty easy. There was a one-day training class for the admin. Then, for the users, there were a couple of Word docs that we circulated around which were good enough.

We have not integrated it with other parts of our business. It is standalone and independent.

More time is being spent because there are more steps to check out a password or if you get a password.

We have just starting to really use the product. There is a lot of design, building, and configuring involved, so we have just started to truly take advantage of some of the features it has.

We haven't set up any type of approvals. We're pretty tight on who can see and request passwords in the first place. I would imagine at some point in time we'll probably end up utilizing the Approval Anywhere feature, just not right now.

As far as privilege access management goes, I'd rate it a nine (out of 10). So far, the product has been really easy to use and set up. I'd just make the rollout and implementation of the transparent mode better.

We use it primarily for our IT team, so they can access our production and pre-production environments, to have better accountability. They have to create a ticket, check it out, and then they have to get approval from our approvers group. So there's accountability from beginning to end, and we also record the sessions.

The time frame to get sessions rolling has been cut to a third. From a productivity standpoint that's tremendous.

In addition to that, the ease of use is fantastic because our IT team is able to check out sessions very quickly because it's so intuitive and easy to work with. They're pleased with it and it allows them to do their jobs much faster. That's probably the largest way it has improved things for us.

Finally, because of the intuitiveness and ease of use for end-users it has been really simple to train on. This product has worked flawlessly for us.

There are a lot of features, so it's going to sound funny, but one of the most simplistic features, the Favorites feature, is the one we like the best. You do a full run-through of configuration to check out a server and then you can save that whole configuration as a favorite. So the next time you go in, you click on the favorite that you configured and it automatically takes you to the end so you can check the server out that much faster. It saves a lot of time, resulting in an increase in productivity and a decrease in issues and errors and interface problems. It increases redundancy and gives us a much easier interface to use.

We're using virtual appliances for Safeguard because of the flexibility of virtual appliances. We can snapshot them, we can restore them quickly. There's a lot more flexibility with virtual.

We use the solution’s Approval Anywhere feature, and it allows a group of five individuals to receive notifications on their phones, through Starling, and review a request and approve it with one click.

We also use the solution’s “transparent mode” feature for privileged sessions. We record them and we also review them. That way, if there are problems with any configurations they did, we can go back and review them. Also, for mentoring, teams utilize it to help individuals deploy code better or to make changes to configurations. There are a lot of positives with that feature. It was very easy to start using this feature. The entire platform is very intuitive, very easy to work with, easy to set up. I can't think of anything that we have really had huge issues with. The rollout of "transparent mode" was seamless for our users. We sent out picture instructions on how to do it and offered to get on a call with people to discuss it with us, but nobody had any questions. In terms of the monitoring itself, it doesn't affect things any differently than the previous solution. It's pretty much the same. Obviously, using the tools is easier, but we were monitoring the same type of information as before.

There is room for improvement in the launch module. They built in a launch button but they don't have effective instructions for configuring it to allow it to launch an RDP session. They're working on that, but the button is in the live product. If they were going to install something that wasn't useful, they should have just disabled it and not rolled it out with the product. Because we don't tie it to an RDP session, you actually have to click the download button and then open the RDP session from there, versus just clicking the launch button and it automatically opening RDP.

Before Safeguard we used TPAM, which is one identity's product as well. We upgraded but we've been using the overall product since 2016.

Overall the solution is very stable. We have not had any major issues on it. It's a nice system.

The only issue I have run into was with our failover two our redundant. There was a pointer to the One Identity platform, it's called an SPP, and it wasn't pointing correctly. But we were able to resolve it. There have really been no issues besides that. Otherwise, everything is very seamless when doing failover and full redundancy.

We can continue to add more VMs to support thresholds. We can certainly scale up with it. It's being used on about 300 servers right now and we have plans to expand to about 200 more.

We have 50-plus people using safeguard right now and they're all in IT. For deployment and maintenance we have one to two people.

We haven't had to use technical support. It's been a solid platform so far.

Previous to this, we were using TPAM and, while it worked, it was horrible to work with. When we saw and got a demo of Safeguard and saw that we would be able to approve things from our phones, saw the user interface which was so much nicer — more intuitive, a lot easier to configure — we went from our teams complaining about the old product every day to not hearing one complaint at all. As a matter of fact, I hear compliments about how much they love Safeguard.

The feedback I have had from users has been a lot of compliments about how much they enjoy working in the interface. It's so much easier to use. It's quick. They can get to the point of checking out a server and of being compliant with security requirements, while at the same time being able to troubleshoot an issue much faster than they used to be able to.

The initial setup was a little complex.

We worked with an integrator, Rallypoint Solutions, to accomplish it because we hadn't accomplished it before with Safeguard specifically. The integrator was tremendous. I have nothing but good things to say about Rallypoint. They helped integrate the whole thing. They really had a great understanding of it. We worked with them throughout the entire setup. We were the hands and they were guiding us. Overall, it was very easy to get up and running.

It did take about a week, eight hours a day — so 40 hours — to get fully up and running and everything imported from the old system into the new one, and to make sure all testing and redundancy were done.

The deployment was not disruptive to our privileged users at all. We ran both the old system and the new system in parallel and allowed them to migrate over after a period of two weeks. However, we had most people on it the first week and they loved it. They were eager to get off the old system.

It required no training. I provided step-by-step picture instructions that we had written out and that was it. They were good to go. We did have a strategy in place, if we needed to work with our teams from a training standpoint. We had sessions set up and ready to go where a live person could walk them through it. But none of our IT users seemed to need that. It was very intuitive.

We have seen ROI using Safeguard. For example, configuring a session in the old version used to take them 10 or 15 minutes, or more. Not only that, but the live person who was the approver had to be logged into the system. So the requester could actually wait a couple of hours before somebody would be able to log in and approve the session. With Safeguard, it's approved within less than a minute because approvers get the notifications on their phones and are able to review the tickets effectively. They understand what's being accomplished and know that it has a ticket number with more detailed information that they can verify, and they can approve the session right there. The individual gets that approval immediately. We went from an average of from anywhere between 15 minutes and two hours down to less than a minute or two. That's tremendous.

They offer a fair price for a robust solution.

In addition to the standard licensing fees there are costs for Starling, but they're very minimal annually. You need Starling to use the mobile Approval Anywhere feature that is so convenient. So it's worth every dime. That extra cost is so small that it's not really even noticeable.

There are integration costs if you aren't looking to do it yourself. I highly recommend their integrators. They are a little expensive but certainly worth the money.

We did evaluate other solutions, but this is the best choice. We went with Safeguard because of the flexibility, the interface, and a more seamless migration from the old system to the new system. And costs were a consideration, obviously.

If you're looking for something that is easy to use with a very intuitive interface — even the administrator interface is very intuitive — I would highly recommend Safeguard. The entire platform is very intuitive, very easy to work with, easy to set up. I can't think of anything that we have really had huge issues with.

The biggest lesson I have learned from using Safeguard is to make sure you have enough accounts available for individuals' sessions so that they can check out. The way Safeguard works, an account is created just for Safeguard. Individuals go in as themselves and then they have to check out this account in order for that account to be able to remote to the server. That account would be the only one allowed to remote to the server. But if multiple people have the account checked out for multiple hours, that presents an issue. So keep your session times as minimal as possible. Even for timeout, allow them to change it if they think they're going to use it longer. But the important thing is to make sure that you either have enough accounts or have your session timeouts limited.

We do use the solution's behavior analytics feature, but I wouldn't say that it's too useful at this point for us because we know what their usage is because it has to be done through tickets. For how long they're using it, what kind of configurations they're doing, and what they're doing, the analytics piece of it is more expected for us, as a result. It does help us to identify risky actions without having to create a set of rules or policies, and without any effort on our part. But in our environment, if users don't put in a ticket and provide effective comments, then our approvals group doesn't approve it. There's no automatic approval set up. An individual reviews every request, so malicious use would not be possible.

We started with administrative use cases and we were able to take control of all the local administrator accounts for endpoints and servers. We then started controlling privileged accounts for our domain administrators as well as for any kind of privileged account that had access to our switches, routers, and the like. 

This year we're looking at taking control of all of the servers and application accounts. But that's going to be a longer journey for us because there are a lot more of those accounts, and there is a lot more testing that needs to be done because of the nature of the accounts.

Another use case this year is integrating Safeguard into the SQL database, so we can start taking control of the SA accounts within SQL. 

Furthermore, we have a use case where we are using Safeguard to manage the account for our IIGA solution, which is our identity governance solution. When it creates new users or transfers or terminates users, it's using a privileged account that is being handled by Safeguard.

We have a lot more use cases but these are enough to give you an idea of how we use it.

We went from a state where privileged accounts were being used and not being monitored or even audited to our situation now where we are starting to monitor these privileged accounts more closely. That's where we show value in the product. Whenever a change is happening, we know because we find it in the logs. Our reporting and monitoring team is looking at it, and they are now starting to question changes that are associated with some kind of ticket or some kind CAB (change advisory board) request. It has improved our visibility for privileged access.

We have physical appliances for this solution. We went with that version of it because it was easier for us to deploy it and not have the IT engineers involved with our deployment. We wanted to control everything, from the deployment to the supportability to the usability of the product. I really enjoy the form factor of the appliance because it's definitely a change from the previous version, which was a bigger box. This one is a lot easier. It doesn't take up room on the rack, and it's very efficient as far as resources go.

The ease of use of the GUI is a really nice feature. It has a nice look and feel to it.

The actual checkout process is simple. You log into the portal and you're presented with accounts. That makes that so much easier because you don't have to go searching for stuff. It identifies what accounts you have, you click on it, and you go through the checkout process.

It's one of the best products we've seen. When you start looking at the functionality and use cases and usability of the product, it's straightforward. They designed this product with the end-user in mind, and they also had the sysadmin who is supporting the product in mind. They really did a nice job. Overall, it's a nice product to work with.

We use the Approval Anywhere feature and, through an app, it allows us to approve or deny requests. We don't have that turned on across the board, but we are turning it on slowly but surely. It adds an extra layer of security for critical passwords without adding time-consuming approval processes. That extra layer of security is our "belt and suspender" approach. It's making sure that you are approved to make a change, especially during production hours; it's approved by the person's manager.

From a usability perspective, what we are finding out is that our privileged domain admin users, in particular, want functionality for extending a checkout session. So we are working with One Identity support to see if there's an enhancement that can be made to the product. 

There is another area for improvement that I have sent over to One Identity. I said, "Whenever you check out a password, there should be a radio code associated with the password." That's something that we're trying to work on with them. It was submitted as a request for enhancement. Sometimes, you can't tell if an "O" is an "O" or a zero is a zero. If we had a radio code, the person could correctly read that password and make sure that they're not fat-fingering it.

We've been using One Identity Safeguard since the end of 2017, so it's a little over two years. I was also a user of the previous version, which was TPAM, for many more years in my previous role.

We have never had an issue with the software or even with the appliances.

It's very scalable. It doesn't matter what size of organization you have. If you have an organization of 1,000 or 100,000, the product is going to be scalable to your needs.

In our company, we have sporadic roles and we have about 55 users who are tuned into Safeguard. We're managing over 3,000 privileged accounts. Some of the users' roles are network administrators, IT administrators, help desk administrators, and InfoSec administrators. Our marketing team has users of the product, as they have applications whose passwords are being managed through Safeguard. We have a nice blend of users who are using the product daily. It has really done a good job of keeping up with the demand.

We definitely have plans to expand the usage of the product. Any area that's going to require some kind of privileged account, especially as we go through a digital transformation in deploying cloud services, Safeguard is going to be right there with us and will give us that flexibility to manage those kinds of accounts.

For deployment and maintenance of the solution we have a staff of one who reports directly to me. He's a senior cybersecurity engineer.

Safeguard's technical support is one of the better ones that I have worked with. There's always room for improvement, but every time that I do pick up the phone it's been fine. 

In my previous role I used Dell Quest TPAM, which was the previous version of Safeguard.

The initial setup was very straightforward because my team had the expertise in deploying a PAM solution, which was TPAM, in the past. This wasn't really that much different. We were able to deploy the full infrastructure, including DR redundancy, without Professional Services.

Because of scheduling conflicts, it took a few weeks to deploy. The main boxes were up within a week, but the full circle of deployment of the product was about a month or so because of those scheduling issues.

Standing up the appliance, plugging it in, and getting started was very straightforward. So kudos to One Identity for really listening to what the user population had to say about TPAM, because it is definitely reflected in the Safeguard product.

In terms of the effect on our privileged users, it's always going to be disruptive when you change something. People don't like change. We introduced this slowly but surely. We took a real "crawl, walk, run" type of methodology. We took the most basic use cases, and then we would update our support documentation to support the product. As we deployed it, we kept finding areas that we needed to document. It wasn't so easy to deploy something that was going to change somebody's workday process flow. But a year later, we're in a different state. It's been adopted and people are drinking from the same water hose.

We had in mind that we needed to handle the local administrator accounts and the privileged accounts, and we moved on from there. We knew that doing the local administrator account, which is really a non-human account, was going to give us the biggest bang for the buck. We knew that was something that we would achieve fairly quickly, and we did.

The training for end-users wasn't that bad. The product is straightforward. When you start working on a product with a lot of the features that you had suggested, in a previous version, be implemented, it's really nice to see that the company is listening to clients and the user population. That helped us in training our employees who use the product. The training was extremely straightforward, and people really caught onto it fairly quickly.

We absolutely see return on our investment. We're minimizing the risk of potential insider and external threats. We're managing all the privileged accounts, and we have minimized the risks of an account being hijacked and being used to compromise domains.

We are already seeing the return because we conduct annual penetration tests to see if we're able to compromise the network.

We evaluated CyberArk and BeyondTrust in addition to Safeguard. We went through a bake-off and Safeguard had one of the best sets of functionalities. It even had simple stuff for integration of a checkout proxy ID. You could check out the password and then it would just proxy to the endpoint. An example would an SSH session you needed for an account that was checked out.

CyberArk was going to require a lot of resources, both human and infrastructure resources, that we didn't have the bandwidth to take on. BeyondTrust fell short of some of the use cases that we had. One of the use cases was relationship. We had a core team that decided on the product and when the core team did its scoring, Safeguard came out just a little bit ahead of BeyondTrust and well ahead of CyberArk.

Start with your current state. That's what we did. Then, create a roadmap of where you are, where you need to be over the next five years. Once you're able to assess the current state and you have a plan in place, you can pick the product that's going to help you get to that future state.

The biggest lesson I have learned from using this product is to be open-minded in trying to figure out where we could use some enhancements. Just because you choose a product you don't have to be 100 percent, all-in on the product. There is always room for opportunities. Whenever there is feedback or challenges, take them and then see what you can do better. My focus is the end-user who is using the product. We have to make sure that using this product doesn't affect users' day-to-day operations.

We started using the solution's behavior analytics feature but it never really took off because we got overwhelmed with other areas that we needed to address. It's something that is on the roadmap for us to eventually take a look at, or at least refresh the project plan and commit some time and some resources to it.

We are looking to integrate Safeguard with RSA. RSA has a component and we're looking to streamline the metrics around that component. When a product is brought online, there's a way for us to go in and do a scan of that machine or that endpoint. Ideally what should happen is that we'll go to Safeguard, check out a password, push that password to the vulnerability management scanner, and scan it. When that scan is done, it actually checks in the password and rotates it. It's our vulnerability management solution that we're looking to integrate. We're doing a PoC on that right now.

Safeguard is a next-generation tool when it comes to privileged access management. They have done a nice job figuring out all the features that need to be available out-of-the-box. I do have high expectations for Safeguard. I continue to look forward to future releases because I know it's going to get even better.