Firstly, there is no issue with fulfilling some capabilities using a cloud-based Software-as-a-Service (SaaS) approach. Software-as-a-Service capabilities are popular for their quick setup and lower costs (although this isn’t always the case and requires due diligence). The key area to consider with SaaS is “does it meet all my requirements?”, not just “does it provide the functionality I’m after?”.
On-premise software continues to provide the strategic advantage for organizations that prioritize absolute data sovereignty, deep system customization, and real operational resilience! Deploying applications, on your own physical enterprise-class infrastructure, can offer distinct long-term advantages over cloud models.
What are the Advantages?
Each organization will have different advantages and not all organizations advantages will be to the same extent. This is because all organizations are influenced by numerous factors, including Capital and Operational budgets, number of employees and IT support staff, their Digital Literacy, the degree of Formalization in the organization and its Risk Appetite.
The Key advantages can be summarized as,
- Total Data Ownership and Control: ensuring data is stored within your organizational boundary, without the liability of exposing proprietary data to third-party cloud vendors or external hosts. Retaining capabilities in house, with immediate access to unfiltered log files and permission schemes, assists with forensic data auditing.
- Advanced Compliance and Data Sovereignty: Some industries like banking, healthcare, government, and defense operate under more stringent legal frameworks requiring data to stay local. This can fully satisfy regional data residency rules and ensure compliance with laws that require sensitive data doesn’t legally cross international borders.
- Unrestricted Customization: On-premise systems allow you to configure / customize to your organization’s requirements and build unique scripts / workflows that match company processes.
- Offline Reliability and Zero Internet Dependency: Unlike SaaS platforms, on-premise software works reliably even if the building’s external internet, or the Cloud providers solution, is unavailable. All data typically moves over a high-speed local area network (LAN) with minimal latency making software responsiveness highly predictable.
- Complete Control Over the Upgrade Cycle: SaaS providers push global updates automatically which can break active integrations or disrupt users. On-premise models put the timing within your control, allowing staff to rigorously test updates in a sandbox / quality assurance environment before migration to production.
- Long-Term Cost Predictability: While on-premise typically requires an upfront capital cost for hardware and licenses, it eliminates most recurring subscription based costs. As an organization scales its users, SaaS monthly / yearly costs can balloon dramatically. On-premise license costs are typically cheaper over a multi-year lifecycle.
Where does Passwordstate fit in?
Passwordstate is a self-hosted enterprise password manager and privileged access management (PAM) solution that runs on the Microsoft technology stack. Historically we marketed Passwordstate as an On-Premise solution, however this really just means within an environment that you control, can configure and manage, as if the software was hosted on your own servers.
While we don’t offer a SaaS version of Passwordstate, you can host it within your own cloud tenancy, such as in AWS or Azure. This allows you to still obtain some of the advantages, such as lower initial capital cost related to server and network infrastructure, and quicker setup of your virtual infrastructure.
Protecting your data!
For the purpose of this blog article, instead of implementing a SaaS solution you’re looking at installing Passwordstate on infrastructure you control on-premise, or in a cloud tenancy, and making it available to users no matter where they are located.
This is all well and good, however you’ll still need to give consideration to how you protect your data once you want to expand accessibility beyond your organizational boundary.
For this scenario we can use the following for our example.
The first example below, shows Passwordstate behind a Reverse Proxy where traffic is routed through an external firewall. Requests are validated by the Reverse Proxy before being passed through an internal firewall to reach the back-end Passwordstate instance.
This example is a modern implementation of the DMZ approach, where access to services is authorized by a “firewall” operating within a Demilitarized Zone. The Reverse Proxy approach is more sophisticated than simply hosting within a DMZ, but it suffices for the point of this blog.
The second example below, shows Passwordstate behind an App Proxy. Users hit a cloud security layer (such as Microsoft Entra ID Application Proxy). An outbound-only connector agent running inside the secure internal network establishes a persistent tunnel to the cloud proxy. This configuration enables your external firewall to be completely locked down with zero inbound open ports.
The third example (not shown) is via a corporate VPN solution, where each remote client establishes a VPN connection back to the corporate network. This extends a company’s private internal network across the internet, allowing employees to securely access company applications, data, and servers as if their computers were physically plugged into the office network.
You can also enable access to credential sets while away from the office, without providing online access to back-end systems. This can be readily done through the use of Passwordstate’s native Mobile Apps for iOS and Android devices. Users can use biometric authentication to access an encrypted cache of credentials they have been granted permission to use. This encrypted cache is available offline and has a maximum Time to Live after which it is automatically removed from their device. All access to credentials is audited, with audit records synchronized with Passwordstate the next time their device reconnects to their instance.
Don’t Forget Best Practice Options
Lastly, if you haven’t done so already, give serious consideration to implementing options aimed at strengthening and enforcing tighter controls on who can access Passwordstate, what they access, and where from. This isn’t intended to be an exhaustive list of all best practice options, rather an example of what to consider.
Look at implementing 2FA (2 Factor Authentication) with requirements for more stringent controls dependent on the level of access. As an example,
- General Users may access their Password Records with login via Single Sign-On,
- Security Administrators, who have access to higher privileged credentials, require additional 2FA to login,
- All users, when accessing highly confidential credentials, e.g. company’s bank account username and password, must provide 2FA when accessing those details.
Using Allowed IP Ranges, you can specify what network ranges Passwordstate can be accessed from. These can be defined at the website level, when using the APIs or accessing the Emergency Access login page. Additionally, if accessing the website from outside of the specified IP ranges, you can choose to deny access or request specific authentication requirements e.g. instead of Single Sign-On you’ll need Manual Login Authentication plus a One-Time Password.
In System Settings->Authentication Options->Web Authentication Options you can lock out any user after a specified number of failed login attempts. You can lock out based on either the originating IP address or the User ID and IP Address. This helps to protect against brute-force attacks.
Under Reporting & Webhooks you can setup Scheduled Reports or Webhooks. Scheduled Reports allow you to email an existing report or audit query result for specific Alerts for Failed Logins. With Auditing queries, you can also send the results through to your chosen Webhook provider e.g. Microsoft Teams or Slack, to send near real-time details into a channel.
Affordable, Extensive and Flexible
In summary, organizations can implement an Enterprise Password Management solution like Passwordstate, that offers more strategic advantage than Software-as-as-Service competitors. All that’s required is a little thought around the architecture for your hosting requirements, and the appropriate methods of strengthening and enforcing control over accessing your data.
As always, we recommend architecting your implementation in accordance with “meeting all my requirements“ and analysing your risks before proceeding to implementation.