立即与支持人员聊天
与支持团队交流

Safeguard for Privileged Sessions On Demand Hosted - Security Checklist

Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS)

The following checklist is a set of recommendations and configuration best practices to ensure that your One Identity Safeguard for Privileged Sessions (SPS) is configured securely.

Topics:

Encryption-related settings

  • TIP: One Identity recommends using 2048-bit RSA keys (or stronger).

  • Use strong passwords: at least 8 characters that include numbers, letters, special characters, and capital letters. For local One Identity Safeguard for Privileged Sessions (SPS) users, require the use of strong passwords (set Users & Access Control > Login options > Minimal password strength to strong). For more information, see "Setting password policies for local users" in the Administration Guide.

  • When exporting the configuration of SPS, or creating configuration backups, always use encryption. Handle the exported data with care, as it contains sensitive information, including credentials. For details on encrypting the configuration, see "Encrypting configuration backups with GPG" in the Administration Guide.

  • Use every keypair or certificate only for one purpose. Do not reuse cryptographic keys or certificates (for example, do not use the certificate of the One Identity Safeguard for Privileged Sessions (SPS) webserver to encrypt audit trails, or the same keypair for signing and encrypting data).

  • Do not use the CBC block cipher mode, or the diffie-hellman-group1-sha1 key exchange algorithm. For details, see "Supported encryption algorithms" in the Administration Guide.

  • Always encrypt your audit trails to protect sensitive data. For details, see "Encrypting audit trails" in the Administration Guide.

Connection policies

  • When configuring connection policies, always limit the source of the connection to the client network that requires access to the connection.

  • Always use gateway authentication to authenticate clients. Do not trust the source IP address of a connection, or the result of server authentication.

  • To prevent Denial of Service (DoS) attacks against One Identity Safeguard for Privileged Sessions (SPS), set the Connection rate limit option of your connection policies. For details, see "Configuring connections" in the Administration Guide.

  • Configure your RDP connection policies to use strong encryption. To enable SSL-encryption for the RDP protocol, see "Enabling TLS-encryption for RDP connections" in the Administration Guide.

  • In RDP connections, if the client uses the Windows login screen to authenticate on the server, the password of the client is visible in the audit trail. To avoid displaying the password when replaying the audit trail, encrypt the upstream traffic in the audit trail using a separate certificate from the downstream traffic. For details, see "Encrypting audit trails" in the Administration Guide.

  • Ensure that host key verification is enabled in SSH connection policies. That is, the Server side host key settings > Allow plain host keys and Server side host key settings > Allow X.509 host certificates options do not have the No check required option selected. For details, see "Setting the SSH host keys of the connection" in the Administration Guide.

Appliance access

自助服务工具
知识库
通知和警报
产品支持
下载软件
技术说明文件
用户论坛
视频教程
RSS订阅源
联系我们
获得许可 帮助
技术支持
查看全部
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级