One Identity Safeguard

What is One Identity Safeguard?

One Identity Safeguard is a PAM (Privileged Access Management) platform - a system for controlling privileged accounts: administrators, root, DBA, service accounts. It protects against abuse and ensures audit trails.

Main components:

• Safeguard for Privileged Passwords - password vault
• Safeguard for Privileged Sessions - session recording and monitoring
• Safeguard for Privileged Analytics - behavioral analysis (UEBA)

What problem does it solve?

flowchart LR
    subgraph Without PAM
        A[Admin knows root password] --> B[Logs in directly]
        B --> C[No trace of who did what]
        C --> D[Risk]
    end

    subgraph With Safeguard
        E[Admin requests access] --> F[Approval workflow]
        F --> G[Password from vault]
        G --> H[Session recorded]
    end

    style A fill:#dc2626,stroke:#b91c1c,color:#fff
    style B fill:#dc2626,stroke:#b91c1c,color:#fff
    style C fill:#dc2626,stroke:#b91c1c,color:#fff
    style D fill:#dc2626,stroke:#b91c1c,color:#fff
    style E fill:#22c55e,stroke:#16a34a,color:#fff
    style F fill:#22c55e,stroke:#16a34a,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff

Common problems:

• Admins know root/Administrator passwords - shared
• No knowledge of who did what on the server
• Service accounts with passwords that never expire
• Contractors with access after contract ends
• Insider threat - admin stealing data

How does Safeguard work?

flowchart TD
    A[Admin] --> B[Request Access]
    B --> C{Approval?}
    C -->|Yes| D[Checkout password from Vault]
    C -->|No| E[Denied]
    D --> F[Session through Proxy]
    F --> G[Record session]
    G --> H[Check-in password]
    H --> I[Password rotation]

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style C fill:#f59e0b,stroke:#d97706,color:#fff
    style D fill:#22c55e,stroke:#16a34a,color:#fff
    style E fill:#dc2626,stroke:#b91c1c,color:#fff
    style F fill:#22c55e,stroke:#16a34a,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff
    style I fill:#22c55e,stroke:#16a34a,color:#fff

Safeguard Components

Password Vault

Central storage of privileged passwords:

flowchart LR
    A[Application] --> B{Needs password}
    B --> C[API call to Vault]
    C --> D[Safeguard Vault]
    D --> E[Returns password]
    E --> F[Login to system]

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#f59e0b,stroke:#d97706,color:#fff
    style C fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style D fill:#22c55e,stroke:#16a34a,color:#fff
    style E fill:#22c55e,stroke:#16a34a,color:#fff
    style F fill:#22c55e,stroke:#16a34a,color:#fff

Supported systems:

Type	Systems
Windows	Local Admin, Domain Admin, Service Accounts
Unix/Linux	root, sudo accounts
Database	Oracle SYS, SQL Server SA, MySQL root
Network	Cisco, Juniper, Fortinet admin
Cloud	AWS root, Azure admin, GCP

Session Recording

Recording administrator sessions:

Who is it for?

Safeguard vs competition

Aspect	Safeguard	CyberArk	Delinea	BeyondTrust
Deployment	Appliance + SaaS	On-prem + SaaS	SaaS + on-prem	SaaS + on-prem
Session recording	Native	Native	Native	Native
Analytics (UEBA)	Built-in	Add-on	Optional	Optional
Price	Competitive	Premium	Medium	Medium
Complexity	Medium	High	Low	Medium

Safeguard advantage:

• Analytics (UEBA) built into the price
• Appliance = quick deployment
• Integration with One Identity Manager (IGA+PAM)

Deployment Options

Option	Description
Appliance	Hardware appliance in DC. Simplest deployment.
Virtual	VM on Hyper-V. Flexibility.
SaaS	Safeguard On Demand. Zero infrastructure.
Hybrid	Vault on-prem, portal in cloud.

Specifications

Parameter	Value
Deployment	Appliance, VM, SaaS
Protocols	SSH, RDP, SQL*Net, HTTP/S, VNC, Telnet
Integration	AD, LDAP, RADIUS, SAML
HA	Active-Active clustering
API	REST API
Compliance	PCI DSS, SOX, HIPAA, GDPR, NIS2

FAQ

How is it different from a password manager? Password manager is for users. PAM is for privileged accounts - with workflow, recording, rotation.

Will admins see the passwords? Optionally. You can configure “transparent mode” where the admin logs in through a proxy without knowing the password.

How does password rotation work? After password check-in (or automatically after timeout) Safeguard logs into the system and changes the password.

What about emergency access? Break-glass procedure - access without approval but with alert and full audit.

Do recordings take up a lot of space? Session recording is ~5-10 MB/h for SSH, ~50-100 MB/h for RDP. Compression and retention are configurable.

How long does implementation take? Appliance: 2-4 weeks basic. Full with integrations: 1-3 months.

Does nFlo implement Safeguard? Yes. Appliance/SaaS deployments, vault configuration, system integration, session recording setup.