Review: Thycotic Software Secret Server

The Thycotic Secret Server integrates into the exiting environment to manage and control access to critical privileged passwords using a cen­tral web-based repository.

With this product, administrators can assign permissions and role-based security to others throughout the organization using controlled shared secret passwords.

This product uses role-based rules to either allow administrators to just view the passwords via their dashboard or actually change the current password. This is kind of like the difference between a user or a power user in Windows.

We found this tool to be fairly easy to install, but installation was a lengthy process in terms of preparation. The Secret Server application installs with integra­tion into a SQL database and IIS web server, but it does not create its own databases. So there are several preparatory steps to be completed before installation can even begin.

Once installed, the system is quite simple and intuitive to use. The web GUI is easy to navigate, and adding users and accounts from Active Directory is quite simple. Policy and secret configu­ration was awkward at first, but became easier as we worked with the product.

From a performance standpoint, this is a fairly good product. We found some useful functionality, such as automatically updating passwords on remote accounts when they expire. For added secu­rity, passwords are centrally stored using AES 256-bit encryption. This product can directly integrate with many platforms.

An installation guide and user guide are provided with the soft­ware in PDF format. Both offer a great amount of detail on installa­tion and confi guration.

Thycotic offers support licenses for all user licensing pack­ages. Support includes all minor updates and major releases. Users with support also receive immedi­ate response to their technical issues from support staff via email, phone and remote assistance.

At a price starting at just under US$490 for 10 users, this product can become expensive quickly for larger environments. While it does have an interesting take on privi­leged password management, we find it to be an average value for the money.

See original article on SC Magazine US

For: Password management for privleged accounts using role-based administration and shared secrets. Against: Lacks flexability with network devices. Verdict: A good product for smaller environments with solid administration capabilities.

secretsecurityserversoftwarethycotic