2.1 Security Considerations

You can deploy Self Service Password Reset along with applications that are available on the internet in the public domain. As an administrator, you must protect Self Service Password Reset so that unauthorized users cannot gain access to it and access users’ credentials or make any configuration changes. You must check and control the installation, maintenance, and monitoring processes of Self Service Password Reset to ensure that you are following security best practices. This section includes the following information:

2.1.1 Over-the-Wire Data Encryption

Self Service Password Reset is an endpoint for several communication traffic channels that send users’ credentials. Self Service Password Reset does not control the communication traffic channels.

Each channel requires its own security configuration settings. For example, ensure that all browser communication is HTTPS. However, you should encrypt all channels by using an end-to-end encryption protocol. Do not rely on private, secure networks. We recommend you use the encryption protocols listed below:

HTTPS Browser to Self Service Password Reset

Secure this channel by using SSL/TLS for HTTPS communication. For more information, see Importing Certificates to Create an HTTPS Connection to Browsers in the Self Service Password Reset 4.1 Administration Guide.

Self Service Password Reset to the User Store (LDAP)

Secure this channel by using SSL/TLS to LDAP by using LDAPS. For more information, see Exporting LDAP Certificates.

Self Service Password Reset to the Database

Secure this channel by using database-specific security measures. For more information, see the database-specific documentation.

2.1.2 At-Rest Data

It is important to secure the data used in Self Service Password. You must secure the operating system where you have hosted Self Service Password Reset, the local database, and the LDAP directory by using the respective vendor’s best practices.

The Self Service Password Reset stores sensitive security data in several locations.

Configuration Files

Stored in Self Service Password Reset here: SSPR-installation-directory/config/SSPRConfiguration.xml.

User Responses (Hashed)

Stored in configurable locations of the local database, an external database, LDAP, or in NMAS. Self Service Password Reset stores the users answers as a one-way cryptographically hash using the configured hash algorithm. For more information, see Understanding Challenge-Response Storage Methods.

Help Desk Response

Stored in configuration locations of the local database, an external database, or LDAP.

Shared Password History

Stored in the local database.

2.1.3 Best Practices for Self Service Password Reset Security

To enhance the security of Self Service Password Reset, Micro Focus recommends that you do the following:

  • Enable the CAPTCHA support.

  • Configure HTTPS for end-to-end security.

  • Configure LDAPS for end-to-end security.

  • Use a strong encryption protocol for formatted hashed stored responses.

  • Configure Self Service Password Reset to see source network addresses for complete audit records to be maintained.

For more information, see Configuring Security Settings in the Self Service Password Reset 4.1 Administration Guide.

2.1.4 Best Practices for Password Policy

To enhance security of password policies:

  • Use a word list to prevent easily guessable passwords

  • Use a shared word list to prevent organizational password value use from becoming common among many users

  • Do not allow users to configure challenge questions

  • Do not impose complex syntax rules on users; instead use a specific overall complexity level

  • Use a long list of potential random question challenges that are unlikely to have similar answers among different users

For more information, see Configuring a Profile for a Password Policy in the Self Service Password Reset 4.1 Administration Guide.