SSPR can be deployed along with applications that are available to the public Internet. As an administrator, you must protect SSPR so that unauthorized users cannot gain access to SSPR and make any change in the information. You need to check and control the installation, maintenance, and monitoring processes of SSPR to ensure that SSPR follows security practices.
This section includes:
SSPR is an endpoint for several communication traffic channels. You must protect each channel.
Communication channels include the following:
HTTP browser to SSPR traffic by using SSL/TLS over HTTP (HTTPS)
SSPR to LDAP server traffic by using SSL/TLS over LDAP (LDAPS)
SSPR to database server traffic, database specific (optional)
Each channel requires its own security configuration settings. But, you should encrypt all channels by using an end-to-end encryption protocol. Do not rely on private, secure networks. We recommend you to use the encryption protocols listed here.
SSPR can store sensitive security data in several locations.
|
Item |
Location |
|---|---|
|
Configuration File |
SSPR Server: webapps/SSPR/SSPRConfiguration.xml |
|
User Responses (Encrypted) |
Configurable: LocalDB, Database, LDAP, or NMAS |
|
Helpdesk Responses |
Configurable: LocalDB, Database, or LDAP |
|
Shared Password History |
LocalDB |
You must secure the operating system on which you have hosted SSPR, SSPR database, and LDAP directory by using the respective vendor’s best practices.
To enhance security of SSPR, do the following:
Enable the CAPTCHA support.
Configure HTTPS for end- to-end security.
Configure LDAPS for end- to-end security.
Use a strong encryption protocol for formatted hashed stored responses.
Configure SSPR to see source network addresses for complete audit records to be maintained.
For more information about SSPR security configurations, see Configuring Security Settings.
To enhance security of password policies:
Use a Wordlist to prevent easily guessable passwords.
Use a shared Wordlist to prevent organizational password value use from becoming common among many users.
Do not allow users to configure challenge questions.
Do not impose complex syntax rules on users; instead use a specific overall complexity level.
Use a long list of potential random question challenges those are unlikely to have similar answers among different users.
For more information about how to configure policies, see Configuring Password Policy.