Enportal/5.5/admin/system administration/security - Revision history

imported>Jason.nicholls: /* Passwords & Secrets */

2015-02-02T11:07:49Z

Passwords & Secrets

← Older revision		Revision as of 11:07, 2 February 2015
Line 23:		Line 23:
	* Single-Sign-On (SSO) tokens for proxied web applications (if not using auth pass-through)		* Single-Sign-On (SSO) tokens for proxied web applications (if not using auth pass-through)
	* access credentials if using an external configuration database		* access credentials if using an external configuration database
			* access credentials for LDAP repositories
	* access credentials for AppBoard Data Sources		* access credentials for AppBoard Data Sources
	* AppBoard session variables set ''encrypted''		* AppBoard session variables set ''encrypted''

imported>Jason.nicholls: /* Features & Recommendations */

2014-11-18T08:48:35Z

Features & Recommendations

← Older revision		Revision as of 08:48, 18 November 2014
Line 39:		Line 39:
	# Implement system-wide or domain-specific password policies to ensure end-users have secure passwords.		# Implement system-wide or domain-specific password policies to ensure end-users have secure passwords.
	# Use multi-factor authentication. For example, we have customers using CAC that makes use of HTTPS client authentication. Other options are possible via our extensible authentication handlers.		# Use multi-factor authentication. For example, we have customers using CAC that makes use of HTTPS client authentication. Other options are possible via our extensible authentication handlers.
	# Change the default encryption key as mentioned in the ''Passwords & Secrets'' section above.		# Change the default encryption key as mentioned in the ''Passwords & Secrets'' section above. Refer to the <tt>KeyCreate</tt> option in the [[enportal/5.5/admin/system_administration/CLI_utilities#Portal_Commands\|Portal Commands]] documentation.
	# If upgrading from a version prior to 5.5.2 then existing local user passwords would have been hashed using SHA-1. These cannot be automatically upgraded and it is recommended to change / force-change all local user passwords which will then be stored using SHA-256. This is ''not'' necessary for user accounts authenticated using external authentication providers such as Active Directory or any LDAP based provider as these passwords are not stored locally.		# If upgrading from a version prior to 5.5.2 then existing local user passwords would have been hashed using SHA-1. These cannot be automatically upgraded and it is recommended to change / force-change all local user passwords which will then be stored using SHA-256. This is ''not'' necessary for user accounts authenticated using external authentication providers such as Active Directory or any LDAP based provider as these passwords are not stored locally.
	# Disable the default accounts. Administrator privileges can be assigned to other users as needed (<tt>/portalAdministration</tt> role)		# Disable the default accounts. Administrator privileges can be assigned to other users as needed (<tt>/portalAdministration</tt> role)

imported>Jason.nicholls: /* Features & Recommendations */

2014-11-18T08:15:59Z

Features & Recommendations

← Older revision		Revision as of 08:15, 18 November 2014
Line 40:		Line 40:
	# Use multi-factor authentication. For example, we have customers using CAC that makes use of HTTPS client authentication. Other options are possible via our extensible authentication handlers.		# Use multi-factor authentication. For example, we have customers using CAC that makes use of HTTPS client authentication. Other options are possible via our extensible authentication handlers.
	# Change the default encryption key as mentioned in the ''Passwords & Secrets'' section above.		# Change the default encryption key as mentioned in the ''Passwords & Secrets'' section above.
			# If upgrading from a version prior to 5.5.2 then existing local user passwords would have been hashed using SHA-1. These cannot be automatically upgraded and it is recommended to change / force-change all local user passwords which will then be stored using SHA-256. This is ''not'' necessary for user accounts authenticated using external authentication providers such as Active Directory or any LDAP based provider as these passwords are not stored locally.
	# Disable the default accounts. Administrator privileges can be assigned to other users as needed (<tt>/portalAdministration</tt> role)		# Disable the default accounts. Administrator privileges can be assigned to other users as needed (<tt>/portalAdministration</tt> role)
	# Customize the login page. This can be used to disable form pre-fill or to provide/remove content as deemed necessary.		# Customize the login page. This can be used to disable form pre-fill or to provide/remove content as deemed necessary.

imported>Jason.nicholls: /* Passwords & Secrets */

2014-11-18T08:05:30Z

Passwords & Secrets

← Older revision		Revision as of 08:05, 18 November 2014
Line 24:		Line 24:
	* access credentials if using an external configuration database		* access credentials if using an external configuration database
	* access credentials for AppBoard Data Sources		* access credentials for AppBoard Data Sources
			* AppBoard session variables set ''encrypted''

	In the above situations passwords and secrets are stored encrypted using AES (approved by [http://www.nist.gov/ NIST]). By default, 128-bit keys are used~~, but larger key sizes~~ are supported if the Java Cryptography Extension is installed ([http://www.oracle.com/technetwork/java/javase/downloads/~~jce-7-download-432124~~.html Oracle Java ~~JCE~~]). Best practices are to create a new encryption key after installing the product.		In the above situations passwords and secrets are stored encrypted using AES (approved by [http://www.nist.gov/ NIST]). By default 128-bit keys are used however 192-bit and 256-bit keys are supported if using OpenJDK or the ''Unlimited Strength'' Java Cryptography Extension (JCE) is installed for [http://www.oracle.com/technetwork/java/javase/downloads/index.html Oracle Java]. Best practices are to create a new encryption key after installing the product.

	Also, for users that authenticate directly with the product versus an external authentication provider then a salted one-way hash is used to store the password. ~~The~~ hashing algorithm used is SHA-1 (designed and published by [http://www.nist.gov/ NIST]).		Also, for users that authenticate directly with the product versus an external authentication provider then a salted one-way hash is used to store the password. From enPortal 5.5.2 the hashing algorithm used is SHA-256 (designed and published by [http://www.nist.gov/ NIST]), previous versions used SHA-1.

	== Features & Recommendations ==		== Features & Recommendations ==

imported>Andy.hopper: /* Passwords & Secrets */

2014-11-12T18:07:19Z

Passwords & Secrets

← Older revision		Revision as of 18:07, 12 November 2014
Line 25:		Line 25:
	* access credentials for AppBoard Data Sources		* access credentials for AppBoard Data Sources

	In the above situations passwords and secrets are stored encrypted using ~~128-bit~~ AES (approved by [http://www.nist.gov/ NIST]). Best practices are to create a new encryption key after installing the product.		In the above situations passwords and secrets are stored encrypted using AES (approved by [http://www.nist.gov/ NIST]). By default, 128-bit keys are used, but larger key sizes are supported if the Java Cryptography Extension is installed ([http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html Oracle Java JCE]). Best practices are to create a new encryption key after installing the product.

	Also, for users that authenticate directly with the product versus an external authentication provider then a salted one-way hash is used to store the password. The hashing algorithm used is SHA-1 (designed and published by [http://www.nist.gov/ NIST]).		Also, for users that authenticate directly with the product versus an external authentication provider then a salted one-way hash is used to store the password. The hashing algorithm used is SHA-1 (designed and published by [http://www.nist.gov/ NIST]).

imported>Jason.nicholls: /* Passwords & Secrets */

2014-10-17T09:28:34Z

Passwords & Secrets

← Older revision		Revision as of 09:28, 17 October 2014
Line 19:		Line 19:
	== Passwords & Secrets ==		== Passwords & Secrets ==

	enPortal and AppBoard need to store passwords or secrets for a number of different purposes:		enPortal and AppBoard need to store passwords or secrets for a number of different purposes where the passwords need to be reused:

	* user authentication (if not using an external auth provider such as LDAP)
	* Single-Sign-On (SSO) tokens for proxied web applications (if not using auth pass-through)		* Single-Sign-On (SSO) tokens for proxied web applications (if not using auth pass-through)
	* access credentials if using an external configuration database		* access credentials if using an external configuration database
	* access credentials for AppBoard Data Sources		* access credentials for AppBoard Data Sources

	~~By default all these~~ passwords and secrets are stored encrypted using 128-bit AES (approved by [http://www.nist.gov/ NIST]). Best practices are to create a new encryption key after installing the product.		In the above situations passwords and secrets are stored encrypted using 128-bit AES (approved by [http://www.nist.gov/ NIST]). Best practices are to create a new encryption key after installing the product.

			Also, for users that authenticate directly with the product versus an external authentication provider then a salted one-way hash is used to store the password. The hashing algorithm used is SHA-1 (designed and published by [http://www.nist.gov/ NIST]).

	== Features & Recommendations ==		== Features & Recommendations ==

imported>Jason.nicholls at 09:49, 3 October 2014

2014-10-03T09:49:00Z

← Older revision		Revision as of 09:49, 3 October 2014
Line 1:		Line 1:
	[[Category:enPortal 5.5]]		[[Category:enPortal 5.5]]
	{{DISPLAYTITLE:~~enPortal~~ Security}}		{{DISPLAYTITLE:Product Security}}
	== Overview ==		== Overview ==

imported>Jason.nicholls: /* Features & Recommendations */

2014-10-03T09:48:04Z

Features & Recommendations

← Older revision		Revision as of 09:48, 3 October 2014
Line 47:		Line 47:
	#* enPortal core components are protected by performing input validation and a configurable set of rules checks all client requests (query, headers, body) for malicious matches.		#* enPortal core components are protected by performing input validation and a configurable set of rules checks all client requests (query, headers, body) for malicious matches.
	#* The CRS can be used to provide protection to proxied web applications. Some default handlers are included with enPortal but disabled by default.		#* The CRS can be used to provide protection to proxied web applications. Some default handlers are included with enPortal but disabled by default.
	#* Refer to the [[enportal/5.5/admin/~~user_administration~~/security/xss_rules\|Managing XSS Rules]] page for more information.		#* Refer to the [[enportal/5.5/admin/system_administration/security/xss_rules\|Managing XSS Rules]] page for more information.
	# SSL Browser Caching		# SSL Browser Caching
	#* By default, Appboard now marks all content (excpet for images, CSS, or Javascript) as non-cacheable, which is a suggestion to browsers not to retain such content for efficiency purposes. There is a property (<i>request.ssl.cache</i>, specified in WEB-INF/config/config.properties) which can be toggled to "true" and will cause XML, HTML, and SWF content to be cached, as well. Setting this to "true" may slightly increase client performance with the increased risk of possibly sensitive content being retained by browsers.		#* By default, Appboard now marks all content (excpet for images, CSS, or Javascript) as non-cacheable, which is a suggestion to browsers not to retain such content for efficiency purposes. There is a property (<i>request.ssl.cache</i>, specified in WEB-INF/config/config.properties) which can be toggled to "true" and will cause XML, HTML, and SWF content to be cached, as well. Setting this to "true" may slightly increase client performance with the increased risk of possibly sensitive content being retained by browsers.

imported>Jason.nicholls: /* Contacting Edge */

2014-10-03T09:45:31Z

Contacting Edge

← Older revision		Revision as of 09:45, 3 October 2014
Line 11:		Line 11:
	== Contacting Edge ==		== Contacting Edge ==

	To report security concerns or issues regarding ~~known vulnerability~~ please [[support/technical_support\|~~contact~~ Support]].		To report security concerns or issues regarding Edge products, please contact [[support/technical_support\|Technical Support]].

	== Security Patches ==		== Security Patches ==

imported>Jason.nicholls at 09:44, 3 October 2014

2014-10-03T09:44:56Z

← Older revision		Revision as of 09:44, 3 October 2014
Line 8:		Line 8:

	AppBoard provides limited views into various data sources, allowing for tailored information to be shown based on the role of a user. This may not be possible if users would have direct access to the data, or the native application to access this data doesn't provide any kind of restriction mechanism.		AppBoard provides limited views into various data sources, allowing for tailored information to be shown based on the role of a user. This may not be possible if users would have direct access to the data, or the native application to access this data doesn't provide any kind of restriction mechanism.

			== Contacting Edge ==

			To report security concerns or issues regarding known vulnerability please [[support/technical_support\|contact Support]].

	== Security Patches ==		== Security Patches ==

	If Edge becomes aware of a vulnerability in a component used by our products, or within the product itself, depending on the severity we will either produce a patch for existing deployments or address the issue in the subsequent product release.		If Edge becomes aware of a vulnerability in a component used by our products, or within the product itself, depending on the severity we will either produce a patch for existing deployments or address the issue in the subsequent product release.

	~~To report security concerns or issues regarding known vulnerability please [[support/technical_support\|contact Support]].~~

	== Passwords & Secrets ==		== Passwords & Secrets ==