VaultOne Deal Brings PAM and Compliance Boost to JumpCloud

JumpCloud purchased a Brazilian privileged access management startup to support a unified and secure user access experience.

See Also: Reimagining Access Management: The Threat Landscape

The Boulder, Co.-area company said its acquisition of Curitiba, Brazil-based VaultOne will add PAM to JumpCloud’s existing identity and access management, mobile device management and single sign-on offerings, according to CISO Bob Phan. He said VaultOne’s session recording and virtual credential handling capabilities will be especially valuable for auditing and compliance purposes.

“Adding in privileged access management complements our product offering and gives us an ability to put more fine-grain controls around sensitive access,” Phan said. “As much as I’d love for everyone to be using single sign on for everything, some vendors don’t support it, or it can be cost-prohibitive. So having a solution like VaultOne gives our customers more options in how they protect themselves.”

VaultOne, founded in 2017, employs 19 people and hasn’t announced any outside funding. The company has been led since its inception by Leonardo Cooper, who previously served as co-founder and CEO of Sikur, which protects sensitive information. Phan said all VaultOne employees were offered positions at JumpCloud.

VaultOne’s session recording feature will help security teams replay an admin session like a video rather than relying solely on logs, which Phan said will provide a much richer and more actionable form of auditing that’s especially useful in incident response or compliance scenarios. VaultOne enhances the ability to control privileged accounts with greater granularity, improving overall security for customers.

“JumpCloud likes to have a better together strategy,” Phan said. “We have identity and access management along with mobile device management. And when you add these stories together, the sum is greater than the parts.”

How JumpCloud, VaultOne Will Come Together

Phan plans to replatform VaultOne onto JumpCloud’s existing infrastructure to fully align the former with the latter’s operational, development and security standards, with a JumpCloud engineer slated to spend two months in Brazil to directly assist with the technical overhaul. This includes moving to infrastructure-as-code practices using Terraform and adopting JumpCloud’s development tooling.

“Aside from making sure that we maintain a consistent level of reliability and security for all of our product suites, it also ensures a swift path to compliance if everyone is using the same infrastructure where we already have our security tools hooked up, our operational tools hooked up and then they’re following all the company practices, policies and guidelines,” Phan said.

JumpCloud wants to ensure that VaultOne can meet industry compliance standards like SOC 2 and ISO 27001. Phan’s team will conduct a full internal audit of VaultOne to verify it’s operational and security controls are functioning effectively. The company also needs process-level adherence to standards such as change control approvals, system monitoring thresholds and deployment gating procedures, he said.

“The bulk of the work will be completed through replatforming,” Phan said. “My team will be performing the internal audit of the service once the replatforming is completed to ensure that all security and operational controls are functional and effective. Once that’s done, we will be submitting VaultOne through our standard audit.”

VaultOne securely manages username-password logins without ever exposing credentials to the end-user’s device through the use of virtual browser technology, which isolates credentials and ensures they never reside on the local machine. Plus VaultOne’s PAM capabilities provide URL-level control within sessions, which is a significant enhancement over conventional role-based access controls.

“When you add a PAM solution, you can get a lot more fine-grained about that and say, ‘Well, even though Bob can log in as an administrator to this service with the PAM, we’re restricting him to only these URLs on that downstream service,'” Phan said.

VaultOne’s ideal customer profile includes those who are especially concerned with security or who handle sensitive information in industries such as fintech – which typically require stringent access controls – as well as software-as-a-service providers that prioritize layered security. Some JumpCloud customers were already using or expressing interest in PAM solutions even before this acquisition, Phan said.

“I do think that VaultOne is going to be very attractive to the more security-minded customers or anyone that has to deal with sensitive information just because it adds another layer of depth to the security story,” Phan said. “And we do know that some of our existing customers have expressed interest in it, or are already going with a different PAM vendor today to cover those use cases.”