®

One Identity
Safeguard
Securely store, manage, record and analyze privileged access

Introduction
Hackers continually evolve the methods they use togain access to your systems and data. Ultimately,
they want to get to your privileged accounts. In
nearly every recent high-profile breach, privileged
accounts have been compromised to gain access tocritical systems and data. With the proper solutions
in place, you can limit the damage from a breach by
deploying solutions that provide secure, efficientand compliant access to privileged accounts.
For IT managers, these all-access accounts area challenge to manage for a number of reasons,
including the sheer number of the privileged accounts
and the number of people who need access tothem. On top of these challenges, traditional
Privileged Access Management (PAM) solutions
involve complex architectures, lengthy deployment
times and onerous management requirements.

Yes, PAM can be a hugechallenge, but it doesn’t have tobe. One Identity Safeguard is an
integrated solution that combines
a secure hardened password
safe and a session managementBenefits• Mitigate the potential damageof a security breach• Meet compliance requirements• Realize quick ROI with simplified
deployment and management• Get efficient audit report creation• Identify and stop risky behaviors
and unusual events• Simplify privileged accountmanagement

and monitoring solution withthreat detection and analytics. It
securely stores, manages, records
and analyzes privileged access.
Secure privileged access without sacrifice
Take the stress out of protecting your privileged
accounts by securely storing, managing, recording
and analyzing privileged access while satisfying youradmins and auditors with One Identity Safeguard.

PRIVILEGED SESSIONS AND ANALYTICS

MonitorAnalyze

RecordReplaySearchReportReal-time Alerts

Optional Approval Workflow
SIEM

Blocked
Suspicious
AllowedAdministrator

Target Resources

DiscoverStoreManageRelease

ChangeLog

PRIVILEGED PASSWORDS

Safeguard for Privileged Passwords
One Identity Safeguard for Privileged Passwords
automates, controls and secures the process ofgranting privileged credentials with role-based
access management and automated workflows.
The user-centered design of Safeguard forPrivileged Passwords means a reduced learning
curve. Plus, the solution enables you to manage
passwords from anywhere and using nearly anydevice. The result is a solution that secures yourenterprise and gives your privileged users a newlevel of freedom and functionality.

Safeguard for Privileged Sessions
With One Identity Safeguard for Privileged
Sessions, you can control, monitor and record
privileged sessions of administrators, remotevendors and other high-risk users. Actions taken byusers in sessions are recorded and indexed, whichmakes finding session events easy, helps to simplify
and automate reporting and eases audit andcompliance requirements. In addition, Safeguard
for Privileged Sessions serves as a proxy andinspects the protocol traffic on the application level
and can reject any traffic that violates the protocol– thus making it an effective shield against attacks.

Safeguard for Privileged Analytics
With One Identity Safeguard for Privileged
Analytics, you can put user-behavior analytics towork for you by discovering previously unknown
internal and external threats, and finding andstopping suspicious activities.

Safeguard for Privileged
Analytics ranks the potential
risk level of threats so you canprioritize your response, take
immediate action on the mostimminent threats and ultimately
prevent data breaches.
Features
Policy-based release control
Using a secure web browser with support formobile devices, you can request access andprovide approval for privileged passwords andsessions. Requests can be approved automaticallyor require dual/multiple approvals based on yourorganization’s policy. So, whether your policies
consider the requestor’s identity and level of access,the time and day of the request attempt and thespecific resource requested—or all of these — youcan configure One Identity Safeguard to meet yourcustomized needs. Plus, you can input reason codes
and/or integrate with ticketing systems.

Full-session audit, recording and replay
All session activity – down to the keystroke, mouse
movement and windows viewed – is captured, indexed
and stored in tamper-proof audit trails that can beviewed like a video and searched like a database.
Security teams can search for specific events acrosssessions and play the recording starting from the exact
location the search criteria occurred. Audit trails areencrypted, time-stamped and cryptographicallysigned for forensics and compliance purposes.

2®

Instant on

Favorites

Safeguard for Privileged Sessions can be deployedin transparent mode, requiring no changes to userworkflows. Acting as a proxy gateway, Safeguard
can operate like a router in the network—invisible tothe user and to the server. Admins can keep using
the client applications they are familiar with andcan access target servers and systems without any
disruption to their daily routine.

Quickly access the passwords that you use most often
right from the login screen. You can group several
password requests into a single favorite so you can get
access to all the accounts you need with a single click.

User behavioral biometrics
Each user has an idiosyncratic pattern of behavior,even when performing identical actions, such as
typing or moving a mouse. The algorithms built into
Safeguard for Privileged Analytics inspect thesebehavioral characteristics (captured by Safeguard forPrivileged Sessions). Keystroke dynamics and mouse
movement analysis help identify breaches and also
serve as a continuous, biometric authentication.

Multifactor authentication support
Protecting access to passwords with anotherpassword isn’t enough. Enhance security by requiring
two-factor authentication to Safeguard. Safeguard
supports any RADIUS based 2FA solution.
Safeguard for Privileged Passwords supports theSAML 2.0 Web Browser SSO Profile, allowing you
to configure federated authentication with manydifferent Identity Provider STS servers and services
and use their MFA.
Privileged accounts may require a TOTP authenticator
generated code as an authentication factor.
Safeguard Privileged Passwords can act as anauthenticator and provide the associated code alongwith credential/session check-out.

Personal Password Vault
All your employees can store and generate random
passwords for non-federated business accounts in a freepersonal password vault. This enables your organization
to use a sanctioned tool with the ability to securely shareand recover passwords, providing much needed security
and visibility into business accounts.

Discovery
Quickly discover privileged accounts or systems on
your network with host-, directory- and networkdiscovery options.

Real-time alerting and blocking
Safeguard for Privileged Sessions monitors traffic
in real time and executes various actions if a certain
pattern appears in the command line or on screen.
Predefined patterns could be a risky commandor text in a text-oriented protocol or a suspicious
window title in a graphical connection. In the caseof detecting a suspicious user action, Safeguard
can log the event, send an alert or immediately
terminate the session.

Command and application control
Safeguard for Privileged Sessions supports bothblack listing and white listing of commands andwindows titles.

Wide protocol support
Safeguard for Privileged Sessions provides full
support for SSH, Telnet, RDP, HTTP(s), ICA and
VNC protocols. In addition, security teams candecide which network services (e.g. file transfer,shell access, etc.) within the protocols they want toenable/disable for administrators.

Full-text searchWith its Optical Character Recognition (OCR)
engine, auditors can do full-text searches for bothcommands and any text seen by the user in thecontent of the sessions.
It can even list file operations and extract
transferred files for review. The ability to searchsession content and metadata accelerates andsimplifies forensics and IT troubleshooting.

®

Drop-in deployment

About One Identity

With a rapid appliance-based deployment andsimplified traffic re-routing, One Identity Safeguard
can have you recording sessions in a matter of days,
without disrupting your users.

One Identity delivers unified identity security
solutions that help customers strengthen theiroverall cybersecurity posture and protect thepeople, applications and data essential to business.
Our Unified Identity Security Platform brings
together best-in-class Identity Governance andAdministration (IGA), Access Management (AM),Privileged Access Management (PAM) and Active
Directory Management (ADMgmt) capabilities toenable organizations to shift from a fragmented
to a holistic approach to identity security. One
Identity is trusted and proven on a global scale –managing more than 500 million identities for morethan 11,000 organizations worldwide.
For more information, visit www.oneidentity.com.

RESTful API
Safeguard uses a modernized API based on REST
to connect with other applications and systems.
Every function is exposed through the API toenable quick and easy integration, regardlessof what you want to do or which language yourapplications are written.

Change control
Supports configurable, granular change control ofshared credentials, including time- and last-usebased and manual or forced change.

The One Identity approach toPrivileged Access Management
The One Identity portfolio includes the industry’s
most comprehensive set of Privileged Access
Management solutions. You can build on thecapabilities of One Identity Safeguard withsolutions for granular delegation of the UNIX rootaccount and the Active Directory administrator
account; add-ons to make open source sudo
enterprise-ready and keystroke logging for UNIX
root activities – all tightly integrated with theindustry’s leading Active Directory bridge solution.

© 2023 One Identity LLC ALL RIGHTS RESERVED. One Identity, and the One Identity logo are trademarks and registered trademarks of One Identity LLC in the U.S.A. and other countries. For a complete list of One Identity trademarks,
please visit our website at www.oneidentity.com/legal. All other trademarks, servicemarks, registered trademarks, andregistered servicemarks are the property of their respective owners. Datasheet-2023-OI-Safeguard-US-PG-82102®