You can deploy Self Service Password Reset along with applications that are available on the internet in the public domain. As an administrator, you must protect Self Service Password Reset so that unauthorized users cannot gain access to it and access users’ credentials or make any configuration changes. You must check and control the installation, maintenance, and monitoring processes of Self Service Password Reset to ensure that you are follows security best practices. This section includes the following information:
Self Service Password Reset is an endpoint for several communication traffic channels that send users’ credentials. Self Service Password Reset does not control the communication traffic channels.
Each channel requires its own security configuration settings. For example, ensure that all browser communication is HTTPS. However, you should encrypt all channels by using an end-to-end encryption protocol. Do not rely on private, secure networks. We recommend you use the encryption protocols listed below:
Secure this channel by using SSL/TLS for HTTPS communication.
Secure this channel by using SSL/TLS to LDAP by using LDAPS.
Secure this channel by using database specific security measures.
It is important to secure the data used in Self Service Password. You must secure the operating system where you have hosted Self Service Password Reset, the local database, and the LDAP directory by using the respective vendor’s best practices.
The Self Service Password Reset stores sensitive security data in several locations.
Stored in Self Service Password Reset here: SSPR-installation-directory/config/SSPRConfiguration.xml.
Stored in configurable locations of the local database, an external database, LDAP, or in NMAS. Self Service Password Reset stores the users answers as a one-way cryptographically hash using the configured hash algorithm. For more information, see Understanding Challenge-Response Storage Methods.
Stored in configuration locations of the local database, an external database, or LDAP.
Stored in the local database.
To enhance security of Self Service Password Reset, Micro Focus recommends that you do the following:
Enable the CAPTCHA support.
Configure HTTPS for end-to-end security.
Configure LDAPS for end-to-end security.
Use a strong encryption protocol for formatted hashed stored responses.
Configure Self Service Password Reset to see source network addresses for complete audit records to be maintained.
For more information, see Configuring Security Settings.
To enhance security of password policies:
Use a word list to prevent easily guessable passwords
Use a shared word list to prevent organizational password value use from becoming common among many users
Do not allow users to configure challenge questions
Do not impose complex syntax rules on users; instead use a specific overall complexity level
Use a long list of potential random question challenges that are unlikely to have similar answers among different users
For more information, see Configuring Password Policy.