Skip to content

What can we help you with?

Contact Us Chat with Sales Get Support

Password Safe Features

Automated Discovery & Onboarding

Scan, identify, and profile applications and assets with auto-onboarding of privileged accounts.

Privileged Credential Management

Control access to privileged passwords, SSH keys, & DevOps secrets. Automate rotation to reduce risk of compromise.

Secrets Management

Securely store DevOps secrets needed for application development and credentials owned by small groups in a fully auditable, controlled environment.

Secure Application Credentials

Control scripts, files, code, and embedded keys to close back doors to critical systems.

Secure SSH Key Management

Secure the use of SSH keys for better control, accountability, and security over Unix and Linux systems.

Just-in-Time Access Control

Evaluate context, such as date, time, location, and other factors, to determine the proper amount and duration of privileged access

Extensible API

Integrate with an extensive set of tools and systems and orchestrate enterprise-wide PAM.

Privileged Session Management

Monitor and manage privileged sessions for compliance and forensics

Team Passwords

Securely store credentials owned by small groups in a fully auditable controlled environment.

"This is the first time we have ever implemented a security product that made the end user’s job so much easier. Our building managers previously managed dozens of different credentials for staff and vendors. Password Safe centrally manages every credential, so they now have only one password for them, one password for vendors and one password for their staff."

Curtis Jack, Manager of Technical Engineering - Oxford Properties Group
Learn More

Automated Discovery and Onboarding

BeyondTrust Password Safe features a distributed network discovery engine to scan, identify, and profile all assets. Dynamic categorization of all assets and accounts enables auto-onboarding, and the ability for access policies to self-adjust according to environmental changes.

  • Discover all privileged accounts & assets: Scan and profile all known and unknown assets (web, cloud, virtual), privileged user accounts, shared accounts, service accounts, DevOps secrets, and SSH keys.
  • Auto-magically group like assets: Create Smart Groups to automatically categorize, group, assess, and report on assets. Sort by IP range, naming convention, OS, domain, applications, business function, Active Directory, and more. Continuously identity new assets and automatically apply Smart Rules when onboarding.

Privileged Credential Management

BeyondTrust Password Safe securely stores, rotates, and controls access to privileged account passwords, DevOps secrets, SSH keys, and other credentials. This protects sensitive assets and satisfies modern compliance requirements. Password Safe credential management capabilities include:

  • Keep Passwords Fresh: Rotate passwords on a scheduled basis or upon check-in to mitigate the risk of abuse or misuse. Implement dynamic secrets for DevOps and CI/CD pipeline tools.
  • Rotate SSH Keys: Automatically rotate keys according to a defined schedule and enforce granular access control and workflow.
  • Eliminate Application Credentials: Get control over scripts, files, code, and embedded keys.
  • Ensure Password Strength: Define and enforce password policy to meet any complexity requirement.
  • Eliminate Old Passwords: Analyze password ages and proactively report policy violations.
  • Manage Remote Users: Use BeyondTrust Privilege Management for Windows and Mac as an agent to update passwords on remote devices.
  • Active Password Change: Selectively process password change, password test, and account notification queue items for designated workgroups.

Secrets Safe

Today's cloud-based development environments require essential security to secure these mission-critical applications. Often, these teams need to share credentials to support their rapid prototyping through deployment. Secrets Safe manages these credentials locally within each team in a secure and auditable way. Secrets Safe is fully integrated within Password Safe — no additional tooling required.

BeyondTrust Secrets Safe is designed to secure store credentials owned by cloud developers in a fully controlled environment. Any sensitive credentials required to make applications run can now be safely shared, stored, and locally managed. These include, and are not limited to:

  • API keys
  • Tokens
  • Certificates
  • JSON files
  • XML files

Secrets are managed through a graphical user interface. Secrets can be uploaded and retrieved using the GUI or by using the supplied API. Non-human or service tasks can make full use of the API to retrieve secrets they require to access resources.

Teams desiring to use Kubernetes will benefit from BeyondTrust's unique secrets management using Kubernetes Sidecar, which simplifies the logic for connecting to and retrieving secrets from Secrets Safe. Using the Kubernetes Sidecar enables rapid development without requiring deep Kubernetes experience, sidestepping complex secrets management configurations within container code.

Privileged Session Management

Privileged session monitoring and management is essential to achieve compliance and security requirements.

BeyondTrust Password Safe privileged session management uses standard desktop tools such as PuTTY and Microsoft Terminal Services Client, ensuring administrators can leverage commonly used tools. Password Safe session management features include:

  • Control Access: Request RDP/SSH access to authorized systems only.
  • Leverage Flexible Execution: Start sessions instantly, or via workflow.
  • Enable True Dual Control: View any active privileged session, and if required, pause or terminate the session.
  • Enforce Accountability: Record privileged sessions in real time via a proxy session monitoring service for SSH and RDP.
  • Capture Everything: Use keystroke indexing and full text search to pinpoint data, and then log an acknowledgement of the review for audit purposes.
  • Communicate & Comply: Build reports for usage, audit, forensics, and regulatory compliance purposes.
  • Audit and Log Privileged Sessions: Access and watch a session, then log an acknowledgement of the review to meet audit compliance requirements.
  • Quickly Search Session Logs: Index and text search using keystroke to pinpoint data, and then log an acknowledgement of the review for audit purposes.
  • RDP Enhanced Session Audit: Every click within the Windows interface, along with any keystrokes, is audited and recorded in a searchable session replay index.
  • Real-Time Activity Alerting: Defined user activity can generate real-time email alerts, as well as block commands, lock, and terminate SSH sessions.
  • Use Command Blacklisting: Connection profiles define keyword groups that can determine a specific course of action. Block commands, lock sessions, terminate sessions, or all three.
  • Auto Logoff & Disconnect: Utilize ‘log off on disconnect’ feature to ensure sensitive data is not exposed in subsequent RDP sessions.
  • Integrate with SailPoint Predictive Identity Platform (IdentityIQ & IdentityNow): Manage access for privileged and non-privileged accounts with privileged access management and identity and access management (IAM).

Secure Application Credentials

BeyondTrust Password Safe eliminates hardcoded and embedded application credentials automatically, simplifying management for IT and better securing the organization from exploitation of those credentials.

Password Safe features enable:

  • The removal of hard-coded passwords from applications and scripts.
  • Extensible REST interface that supports many languages, including C/C++, Perl .NET, and Java.
  • Passwords that can be automatically reset upon release.
  • Extensive security controls to lock down access to only authorized applications.

Secure SSH Key Management Improves Control, Accountability, and Security for Unix and Linux Systems

Traditional methods of SSH key management are very labor intensive, with many organizations not properly rotating their keys. It is also common practice for administrators to share keys. Between the lack of rotation and the sharing of keys, organizations lose accountability over their systems and expose vulnerabilities.

BeyondTrust Password Safe improves security and simplifies management of SSH keys by:

  • Onboarding and storing private keys like any other privileged credential.
  • Automatically rotating SSH keys according to a defined schedule.
  • Allowing designated 'secondary' accounts and SSH keys to be grouped to a 'primary' account to manage rotation interval, complexity, and duration of SSH keys.
  • Enforcing granular access control and workflow.
  • Alerting when a key is released.
  • Automatically logging users onto Unix or Linux systems through the proxy, with no user exposure.
  • Recording every privileged session with full playback and key usage auditing.
  • Offering failover to a managed password for complete redundancy.
  • Allowing SSH sessions to be easily established via your existing desktop tools--without having to initiate with a web interface.

Just-in-Time Access Control

In traditional PAM workflows, permissions are granted globally to individuals based upon job role. This does not take into account real-time risk factors such as location, day, or time. BeyondTrust Password Safe enables the dynamic assignment of just-in-time privileges via the Advanced Workflow Control engine.

Policies can be extended to block password access to designated resources. Exceptions can be defined to allow requests that originate from the corporate network, another approved source, or from approved vendors.

Having this capability ensures that users have the right access according to the context of their request, thereby minimizing opportunities for exploiting privileged credentials.

Extensible API for Security and Scalability

The Password Safe API is designed to address single sign-on shortcomings, simplify developer access, and to provide secure credential management.

Credentials retrieved automatically and securely from the Password Safe API allow application developers to gain access, without entering credential information each time. In this case, end users, like database administrators, never need administrator rights to access a database. This capability improves system security, while enabling greater business agility.

Benefits of using the Password Safe API include:

  • Secure Credential Management: Instead of entering static credentials, developers call on the Password Safe API to retrieve the latest credentials for the user, application, infrastructure, cloud solution, or database to authenticate and then release the credentials at the end of the session. This triggers the automatic rotation of the password. The end-user is never exposed to the username or password. All authentication is performed silently behind the scenes with complete activity auditing if desired.
  • Simplified Developer Access: Improve IT's agility and responsiveness by never requiring the entry of a username and password for connectivity to create custom applications. End users, like database administrators, never need administrator credentials to access a database if the tools retrieve stored credentials automatically. Management tools for services, remote access, and infrastructure automatically recognize the logged-on user and their asset and seamlessly request and pass credentials for the application.
  • Protection from SSO Hacks: Since credentials can be passed within the application itself, directly from Password Safe, IT can secure runtime and avoid hacking techniques like pass-the-hash and keystroke logging, making this approach far more secure than single sign-on (SSO).

Privileged Threat Intelligence and Behavioral Analytics

BeyondTrust Password Safe connects the dots and flags the events you need to focus on, allowing you to act decisively and effectively prioritize risk mitigation. Analyze privileged password, user, and account activity, along with asset characteristics.

Benefits of Password Safe Threat Analytics include:

  • Revealing critical risks by correlating asset, user and threat activity
  • Identifying potential malware threats buried in asset activity data
  • Increasing the ROI of your existing security solutions
  • Generating reports to inform and align security decisions

Secure Team Passwords

Traditionally, smaller groups managed shared credentials manually with spreadsheets. Or in the worst cases, with sticky notes. Password Safe manages these credentials locally, within each team, in a secure and auditable way.

The Team Passwords capability is designed to securely store credentials owned by small groups within Password Safe in a fully controlled environment. This feature delivers secure password practices to teams outside of traditional privileged user roles. Sensitive credentials shared by groups can now be safely stored in Password Safe and locally managed.

Use BeyondInsight to Manage Team Passwords

More Resources on Privileged Password Management & Password Safe