BeyondTrust Password Safe cheat sheet

Password Safe is a privileged credential management appliance (physical, virtual, or cloud) that brokers access to managed systems through a controlled jump path rather than exposing secrets directly to users.

Core components: the Password Safe appliance (application/database tier), managed systems with Functional Accounts, an optional Password Safe Cluster for high availability, and client access via web interface or SSH proxy.

Quorum approval is enforced by distributing approval authority across multiple administrators; a configurable number of approvers must authorize an action before it executes.

Functional Accounts are the privileged accounts on managed systems that Password Safe retrieves, rotates, and injects; users never see the password when session brokering is used.

Managed Systems are onboarded with platform type, address, and credentials; platform templates define how rotation, verification, and session protocols behave per system type.

Access is policy-driven: an Access Policy links a group of users, a group of assets/accounts, and a set of access rules (auto-approve, require approval, or deny).

The appliance stores secrets encrypted at rest; retrieval, rotation, and session launch are logged as events in the audit trail with user, asset, and timestamp.

Session brokering routes RDP/SSH/application sessions through the appliance so credentials are injected without disclosure; session recording and keystroke logging are configurable per policy.

Deployment tiers scale horizontally: multiple appliances behind a load balancer share a clustered database, and Password Safe supports disaster-recovery pairing with a secondary site.

A managed account's lifecycle states include: not managed, managed (password stored and tracked), and managed with automatic rotation; state transitions are driven by onboarding and policy.

Rotation is scheduled per account or per policy; a rotation schedule defines interval, and rotation can also be triggered on checkout or on password change detection.

Verification differs from rotation: verification confirms the stored password still works on the target, while rotation changes the password on the target and updates the vault.

Dependency-aware rotation handles accounts whose password change propagates (e.g., services, scheduled tasks, COM+ objects); dependent accounts must be updated in the correct order.

Password rules and complexity are defined per platform template, including length, character classes, and excluded characters; generated passwords must satisfy the target system's policy.

Heartbeat/check-out policies define whether a password is changed when checked in, checked out, or on a schedule; check-in can force rotation to close the loop.

Credential providers and application-to-application (A2A) retrieval allow scripts and services to fetch credentials via API without human interaction, subject to access policy.

Secrets are encrypted in transit and at rest; the vault master key is protected by the appliance's key management, and backups must be handled with equivalent protection.

Orphaned or unmanaged accounts are discovered via scan/import; onboarding them into management is a prerequisite for rotation and audit coverage.

Access Policy evaluation: a request is allowed if the user's group, the target account/asset group, and the requested access type match a rule; explicit deny overrides allow.

Approval workflow states: requested, pending approval, approved, active session, checked in/expired, denied; each transition is audited with approver identity.

Quorum rules can require N-of-M approvers, and approvers can be restricted so a requester cannot approve their own request.

Session time limits and idle timeouts are set per policy; exceeding the limit terminates the session and returns the account to the vault.

Session types include RDP, SSH, Telnet, and application sessions; each uses a proxy that injects credentials so the user never sees the password.

Session recording captures screen or terminal I/O; recording playback is available to auditors with appropriate roles, and recordings are retained per retention policy.

Check-out grants exclusive use of an account for a period; check-in releases it, and concurrent checkout can be blocked by policy to prevent credential sharing.

Role-based access separates requesters, approvers, auditors, and administrators; least privilege means administrators do not automatically gain access to secrets.

Administrative roles include System Administrator, Password Safe Administrator, Auditor, and Approver; each role maps to specific permissions and separation-of-duties constraints.

Audit events cover authentication, policy changes, credential retrieval, rotation, session start/end, and approval decisions; events are immutable and time-stamped.

Reports include access reports, credential usage, rotation status, and compliance reports; scheduled reports can be exported to SIEM or file share.

Syslog and SIEM forwarding send audit events to external collectors; forwarding must be configured to preserve event integrity and retention.

Backup and restore of the appliance includes configuration and encrypted vault data; restore requires the same key material, so key escrow is an operational requirement.

Patch and upgrade procedures follow vendor guidance; clustering allows rolling upgrades with minimal downtime, and pre-upgrade backups are mandatory.

License management controls the number of managed accounts and users; exceeding licensed counts blocks onboarding of new assets.

Health monitoring covers appliance services, database, and cluster replication; alerts should be configured for rotation failures and failed authentications.

Delegation of administration can be scoped by asset group so regional admins manage only their assigned systems, supporting least privilege.