-
When configuring connection policies, always limit the source of the connection to the client network that requires access to the connection.
-
Always use gateway authentication to authenticate clients. Do not trust the source IP address of a connection, or the result of server authentication.
-
To prevent Denial of Service (DoS) attacks against One Identity Safeguard for Privileged Sessions (SPS), set the Connection rate limit option of your connection policies. For details, see "Configuring connections" in the Administration Guide.
-
Configure your RDP connection policies to use strong encryption. To enable SSL-encryption for the RDP protocol, see "Enabling TLS-encryption for RDP connections" in the Administration Guide.
-
In RDP connections, if the client uses the Windows login screen to authenticate on the server, the password of the client is visible in the audit trail. To avoid displaying the password when replaying the audit trail, encrypt the upstream traffic in the audit trail using a separate certificate from the downstream traffic.
For more information, see "Encrypting audit trails" in the Administration Guide.
-
Ensure that host key verification is enabled in SSH connection policies. That is, the Server side host key settings > Allow plain host keys and Server side host key settings > Allow X.509 host certificates options do not have the No check required option selected. For details, see "Setting the SSH host keys of the connection" in the Administration Guide.