Safe-T Software Defined Access

Organizations face rising cyber-risk alongside increasingly heterogeneous access: mobile employees, customers, devices, applications, APIs, and partners connect remotely, while data keeps moving to the cloud. Traditional perimeter security is less effective, making “Zero Trust” approaches attractive: never trust by default, always verify, and avoid relying on a single control point such as a perimeter firewall. Several paths can strengthen security posture, including network segmentation (useful but often expensive with unclear ROI) and data-centric discovery/classification (effective but time- and effort-intensive). Given that many attack vectors are identity-related (weak/stolen passwords and compromised privileged credentials), an “access-first” approach is positioned as a strong initial line of defense.

Gateway-based solutions (e.g., Web Access Management, Web Application Firewalls, CASBs) combine identity services with application-level access and usage control, plus reporting. However, they require traffic to be forced through gateways via edge placement, application restrictions, or client proxy configuration, which can create constraints. Flexibility and transparency therefore become key selection criteria.

Safe-T Data provides a “Software-Defined Access” platform positioned for Zero Trust Security and Software Defined Perimeters. It restricts access by routing traffic through its secure application access infrastructure, reducing attack surface by hiding the data center perimeter. Core capabilities include authentication (including MFA), data usage control across multiple protocols (files, databases, more), anomalous behavior detection, and auditing/reporting. Its patented Reverse-Access architecture uses an external Access Gateway and an internal Access Controller that pulls requests inward over outbound connectivity, analyzes them via SecureStream, applies policies/workflows, and then brokers approved requests to internal applications—reducing the need to open application-specific firewall ports. Additional components include SmarTransfer for HTTPS-based NTFS file access, broad authentication integrations (AD/LDAP/RADIUS/Kerberos and Azure AD/DUO/Okta), and connectors for on-prem and cloud services. Strengths include breadth of use cases and clientless access; challenges include gateway performance considerations, required configuration changes, and the absence of a cloud-only service.

• Mobile employees, customers, connected devices, applications, APIs, and business partners increasingly access internal networks remotely.
• More organizational data is shifting to the cloud.
• Network segmentation can be expensive and difficult to justify on return on investment.
• Data discovery and classification can be costly in time and effort and requires subject-matter experts to classify data properly.
• A majority of attack vectors are identity-related and can stem from weak or stolen passwords or compromised privileged credentials.
• Gateway-based security requires access paths to be configured so traffic passes through the gateway.
• Safe-T’s core access gateway capabilities include access control, data usage control, anomalous user behavior detection, and auditing/reporting.
• Safe-T’s Reverse-Access uses an external Access Gateway and an internal Access Controller that pulls access requests into the internal network.
• The Reverse-Access approach removes the need to open application-specific ports at firewalls beyond communication between the two Safe-T servers.
• Safe-T supports hybrid cloud deployments but is not offered as a cloud service; it is deployed per customer.

• “The principle behind the Zero Trust buzzword is that organizations should never trust any entity and should always verify before giving it access to anything on the internal network or in the cloud.”
• “Basically, the idea is that there must not be a single source of trust such as the firewall at the network perimeter, but a constant verification of entities and their access request by different measures.”
• “Given that the majority of attack vectors are identity-related… a case can be made that an access first approach may be the better first line of defense.”
• “Gateway-based approaches require data to pass a certain component, the gateway.”
• “Flexibility in implementation and use is a key criterion for selecting solutions, aside of the added level of security.”
• “They restrict access to data, services, and applications by passing traffic to their secure application access infrastructure, which reduces the attack surface by hiding the actual data center perimeter.”
• “The strength of the Safe-T solution is based on the broad range of use cases supported, in contrast to solutions such as VPNs or other specialized solutions.”
• “Due to this approach, there is no need for opening application-specific ports at firewalls and other security components…”
• “An important feature of Safe-T’s Software Defined Access solutions is the unified protocol that exposes a common API for all data flows managed by Safe-T.”
• “Safe-T is – from a user perspective – a non-intrusive, transparent approach for increasing security.”