StrongDM vs Pomerium

Our Recommendation

You can use StrongDM with Pomerium to ensure both your backend servers and user-facing web services are protected.

• For securing databases and collecting full session replay logs on SSH/RDP sessions alone, StrongDM is a great solution.

• For securing clientless access to web applications and HTTPS-services, use Pomerium. Our self-hosted reverse proxy collects full audit logs and retain control over data to meet compliance mandates with continuous verification for every action.

Use Cases

• Secure your database — StrongDM provides a layer of authentication in front of non-HTTP based services and applications.

Strengths

• Camcorder on — StrongDM is able to provide a session-replay style audit logs for TCP-based services like databases, SSH, and RDP.

Weaknesses

• Web applications — Pomerium comes in for user-facing web applications where StrongDM isn’t necessarily a good fit.

• Client necessary everywhere — The nature of StrongDM’s design requires installing their client onto devices, which can be a heavy ask for end users or the device it runs on. This is why we recommend using Pomerium’s clientless access for services whenever possible.

• Not web-native — StrongDM was not designed with securing HTTP in mind, so they have grafted their layer 3 and 4 solution to support HTTP. As a result, StrongDM cannot replicate Pomerium’s layer 7 features, where each request can be authenticated, authorized, and logged for auditing purposes, making StrongDM not ideal for HTTP-based applications and services.

Evaluators Should Know

StrongDM and Pomerium are complementary solutions with different strengths.

• For managing access to databases and servers, use StrongDM.

• For securing clientless access to web applications, Pomerium is the answer.

The future will be increasingly web-based but legacy tech stacks and tooling will always need some help. We highly recommend using Pomerium and StrongDM together in your tech stack to get the best of both worlds.

On Session Recording for Auditing

We meant it literally when we said “camcorder on” for session recording. Check out StrongDM’s video on SSH replay to see it in action – it captures individual sessions on video.

Decisionmakers may think “Great! Everything is captured!” but session replay has limited usability in practice. Imagine the scale of reviewing recordings for multiple servers over hundreds of users when administrators need to hunt down a problem.

To maximize the use of session replay when auditing, you should already know:

• Which session you should be looking at

• When during the session the act(s) occurred

• What you are looking for

Otherwise, auditing session recordings at scale will be an expensive time-sink of watching recordings in the hope of finding what you may or may not be looking for.

For HTTP-based traffic, use Pomerium for its rich audit logs capable of tracking each action and why it was approved or denied. Read our writeup on the three pillars of observability to learn more.

If I Only Want One Solution?

While we still believe Pomerium and StrongDM are very different solutions, we have a strict four-pillar criteria for evaluating VPN-replacement solutions.

• Usability: Pomerium provides clientless access, giving users a better experience and reducing management burden for administrators.

• Speed: Pomerium is faster than StrongDM because it can be deployed at edge.

• Security: Pomerium has continuous verification for each action, ensuring each user request is logged and checked before allowed or denied.

• Context-aware access: Pomerium can leverage institutional context as additional data when making access decisions.

Finally, Pomerium secures TCP connections over HTTP. This ensures any company is wholly capable of protecting both their front-end and back-end services with Pomerium alone.

Try Pomerium Today!

Pomerium’s place as an open-source context-aware reverse proxy helps prevent ransomware attacks on internal services and resources. Whether you’re spinning up a new application or trying to add access control to a legacy service, Pomerium builds secure, clientless connections to internal web apps and services without a corporate VPN. The result is:

• Easier with clientless access.

• Faster by being tunnel-free and deployed where your apps and services are.

• Safer because every single action is verified before allowed to execute.

• Tailored to your organization’s needs by integrating all data for context-aware access.

Check out our open-source Github Repository or give Pomerium a try today!