BeyondTrust Password Safe flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Functional Account

A privileged account on a managed system that Password Safe stores, rotates, and injects during brokered sessions. Users authenticate to Password Safe and never see the underlying credential.

Managed System

A target host or device onboarded into Password Safe with a platform template, network address, and functional accounts. Onboarding enables rotation, verification, and session brokering.

Access Policy

A rule binding user groups, asset or account groups, and permitted access types. It determines whether a request is auto-approved, requires approval, or is denied outright.

Quorum Approval

A control requiring a minimum number of designated approvers to authorize a request before it proceeds. It distributes authority so no single administrator can unilaterally release a credential.

Session Brokering

Routing a user's RDP or SSH connection through the Password Safe appliance so credentials are injected on the user's behalf. The plaintext password is never disclosed to the requester.

Password Safe Cluster

Multiple appliances sharing a common database behind a load balancer. Clustering provides high availability and supports rolling upgrades with reduced downtime.

Platform Template

A configuration profile defining how Password Safe interacts with a system type, including rotation method, password complexity rules, verification commands, and supported session protocols.

Disaster Recovery Pairing

A secondary Password Safe deployment synchronized with the primary site. It enables failover if the primary appliance or database becomes unavailable.

Rotation

Changing a managed account's password on the target system and updating the stored value in the vault. Rotation can be scheduled, triggered on checkout, or forced at check-in.

Verification

Testing that the stored credential still authenticates successfully on the target. Verification detects drift between vault and system without changing the password.

Dependency-Aware Rotation

Coordinating password changes across accounts whose credentials are referenced by services or scheduled tasks. Dependents must be updated in the correct order to avoid outages.

Check-Out and Check-In

Check-out grants exclusive use of an account for a defined period; check-in releases it. Policies can force rotation at check-in to close the exposure window.

Password Complexity Rules

Per-platform constraints on generated passwords, including length, character classes, and excluded characters. Generated values must satisfy the target system's password policy.

Application-to-Application Retrieval

An API-based mechanism letting scripts and services fetch credentials without human involvement. Access is still governed by policy and fully audited.

Vault Encryption

Protection of stored secrets at rest using encryption keys managed by the appliance. Backups and replicas require equivalent key protection to remain secure.

Orphaned Account Discovery

Scanning or importing systems to find privileged accounts not yet under management. Onboarding discovered accounts is a prerequisite for rotation and audit coverage.

Heartbeat Policy

A rule specifying when a credential is rotated or verified, such as on checkout, on check-in, or on a fixed schedule. It defines the cadence of credential hygiene.

Unmanaged Account State

An account known to exist but not yet onboarded, so its password is neither stored nor rotated. It represents a gap in vaulting coverage.

Approval Workflow States

The lifecycle of an access request: requested, pending approval, approved, active, checked in or expired, and denied. Every transition is recorded with approver identity.

Self-Approval Restriction

A policy setting preventing a requester from approving their own access request. It enforces separation of duties within the approval workflow.

Session Timeout

A per-policy limit on session duration or idle time. When exceeded, the session terminates and the account returns to the vault automatically.

Session Recording

Capture of screen or terminal activity during a brokered session. Auditors with the appropriate role can replay recordings, subject to retention policy.

Exclusive Checkout

A policy that blocks concurrent checkout of the same account. It prevents credential sharing and ensures one accountable user holds the password at a time.

Least Privilege Roles

Separation of requester, approver, auditor, and administrator duties. Administrators do not automatically gain access to secrets, limiting blast radius of compromise.

Explicit Deny Precedence

In policy evaluation, a matching deny rule overrides any allow rule. Access is granted only when group, asset, and access type all match an allow rule.

Session Proxy Injection

The mechanism by which the appliance supplies credentials to the target during a brokered session. The user's client never receives the plaintext password.

Audit Event Immutability

Audit records cannot be altered or deleted by administrators. Immutability preserves evidentiary value for investigations and compliance attestations.

SIEM Forwarding

Sending Password Safe audit events to an external collector via syslog or similar protocol. Forwarding supports centralized correlation and long-term retention.

Scheduled Reports

Automated generation of access, usage, rotation, and compliance reports delivered to a file share or email. Scheduling reduces manual evidence collection effort.

Key Escrow

Secure storage of key material needed to restore encrypted vault data. Without escrowed keys, a backup cannot be decrypted after a catastrophic loss.

Scoped Administration

Delegating administrative rights by asset group so regional administrators manage only assigned systems. It applies least privilege to administrative functions.

License Entitlement

The licensed count of managed accounts and users. Exceeding entitlement blocks onboarding of new assets until licensing is adjusted.