Hospitals depend on outside vendors to keep their critical systems running. The catch: every vendor login hands privileged access to someone outside the organization. Privileged access to a hospital network is about as sensitive as it gets.
A hospital system administrator, Yehuda Fabian, knows that risk well. Recently he explained why his team deployed Safeguard by One Identity to address unsecured privileged account risk and how the solution has performed in production.
The riskiest moment in the network
For Fabian, external support is the highest-risk activity in his environment, and the decision to deploy Safeguard was a direct response to it.
“We use the virtual appliance of One Identity Safeguard to enhance security when external support is logged into our internal network. This is because it is the riskiest situation when an external company logs into servers to provide support. We want to increase security and monitoring to minimize risk. We have better monitoring tools to help us achieve this.” - Yehuda Fabian, Shaare Zedek Medical Centre
This deployment was a success because it targeted a known gap: visibility into what third parties were doing inside the network. By pointing Safeguard at that specific risk, Shaare Zedek got monitoring and control over the activity that previously had neither.
Rotating credentials, recorded sessions
The main workflow Fabian’s team uses is privileged access to remote desktop servers, with automated password rotation and session recording layered on top. That combination handles a problem that’s painful to solve manually.
“We currently use privileged access to remote desktop servers with rotating passwords for privileged accounts. This is the main feature we use, and it typically disconnects external users from the system before giving them a different user to use for logging in. We have to use the Safeguard session in an integrated separate session or with the exact name available to record the sessions.”
What this workflow does, in plain terms: external users never see the actual credentials they’re using. Safeguard rotates passwords automatically and routes the session through a named, integrated channel that gets recorded end to end. The vendor can do the work they came to do, and the hospital ends up with an audit trail.
For a healthcare organization, that traceability isn’t optional. It’s how you stay compliant and how you investigate when something goes wrong. Even when nothing goes wrong, the record is there if someone needs to verify what a vendor changed.
Stability where it matters
A security tool that destabilizes a hospital’s environment isn’t really a security tool. It’s another headache. Fabian’s verdict on this is brief.
“One Identity Safeguard is stable and provides great performance.”
Coming from an administrator running the solution day-to-day in a live healthcare environment, that’s worth more than any proof-of-concept assessment. A tool that stays stable in production is one that stays deployed.
Takeaway
This medical centre’s deployment is a useful model for targeted privileged access management. The hospital identified its highest-risk access point — third-party vendors connecting to internal systems — and put Safeguard directly in front of it. The activity that used to be the hardest to see is now the most carefully controlled.
If you’re facing the same problem at your organization, Fabian’s experience is a useful reference point. Request a One Identity Assessment for Safeguard to examine your security gaps and bolster your cybersecurity posture.
