1.3 Security and Privacy

As a security best practice, you should apply patches that address security vulnerabilities to your PlateSpin Server host, as you would for other Windows servers in your enterprise.

Micro Focus is aware of the side-channel analysis vulnerabilities described in CVEs 2017-5715, 2017-5753 and 2017-5754, known as Meltdown and Spectre. We strongly recommend that you apply security updates that address such threats as recommended by Microsoft for the Windows Server you use as the PlateSpin Server host. See Protect Your Windows Devices Against Spectre and Meltdown on the Microsoft Support website.

Transfer encryption makes the transmission of your workload data more secure during workload replication. When encryption is enabled, over-the-network data transfer from the source to the target is encrypted by using AES (Advanced Encryption Standard).

You can enable or disable encryption individually for each workload by selecting the Encrypt Data Transfer option. See Workload Protection Details.

The PlateSpin Server enables SSL on the PlateSpin Server host, providing secure data transmission between your web browser and the PlateSpin Server with HTTPS (Hypertext Transfer Protocol Secure). The installation also adds a self signed certificate if no valid certificates are found.

PlateSpin Protect protects credentials by using an SSL connection for communications and the Windows cryptographic library to encrypt passwords.

Credentials that you use to access various systems (such as workloads and failback targets) are stored in the PlateSpin Protect database and are therefore covered by the same security safeguards that you have in place for your PlateSpin Server host.

In addition, credentials are included within diagnostics, which are accessible to accredited users. You should ensure that workload protection projects are handled by authorized staff.

PlateSpin Protect provides a comprehensive and secure user authorization and authentication mechanism based on user roles, and controls application access and operations that users can perform. See Configuring User Authorization and Authentication.

PlateSpin Protect includes Microsoft SQL Server Express Edition that you can optionally use with PlateSpin Server. Initially, the database engine uses a generated a password for the SQL system administrator user (sa). You can use your Windows Administrator credentials and SQL management tools to modify the password without needing to know the generated password.

For improved security, we strongly recommend that you modify the password for the SQL Server sa credentials after you set up PlateSpin Server in your environment. See Modifying the Password for the SQL Server Express System Administrator Userin the PlateSpin Protect Installation and Upgrade Guide.

PlateSpin Protect provides the ability to use Windows Authentication for access to the Microsoft SQL Server database. See Requirements for Windows Authentication to the Microsoft SQL Server Database.

Table 1-4 lists the default ports used by PlateSpin Protect. If you configure custom ports, you must open those ports instead. For communications between the PlateSpin Server and the source and target machines it manages, ensure that you also open the appropriate ports on any firewalls between them. Traffic for communications is bidirectional (incoming and outgoing). See also Access and Communication Requirements across Your Protection Network.