1.2 Security and Privacy

PlateSpin Forge provides several features to help you safeguard your data and increase security.

1.2.1 Security of Workload Data in Transmission

To make the transfer of your workload data more secure, you can configure the workload protection to encrypt the data. When encryption is enabled, data replicated over the network is encrypted by using AES (Advanced Encryption Standard).

You can enable or disable encryption individually for each workload. See Workload Protection Details.

1.2.2 Security of Client/Server Communications

Because the PlateSpin Server enables SSL on the Forge VM, secure data transmission between your web browser and the PlateSpin Server is already configured to HTTPS (Hypertext Transfer Protocol Secure).

1.2.3 Security of Credentials

Credentials that you use to access various systems (such as workloads and failback targets) are stored in the PlateSpin Forge database and are therefore covered by the same security safeguards that you have in place for your Forge VM.

In addition, credentials are included within diagnostics, which are accessible to accredited users. You should ensure that workload protection projects are handled by authorized staff.

1.2.4 User Authorization and Authentication

PlateSpin Forge provides a comprehensive and secure user authorization and authentication mechanism based on user roles, and controls application access and operations that users can perform. See Setting Up User Authorization and Authentication.

1.2.5 Network Port Settings

Table 1-4 lists the default ports used by PlateSpin Forge. If you configure custom ports, you must open those ports instead. For more information about network access configuration for your PlateSpin Server environment, see Access and Communication Requirements across your Protection Network.

Table 1-4 Default Ports Used by PlateSpin Forge

Port Number	Protocol	Details
80	TCP	(Not secure) Used for HTTP communications between the Forge VM and the source and target machines. Open this port on your Forge VM, the source and target workloads, and the VMware ESXi hosts.
443	TCP	(Secure) Used for HTTPS communications, if SSL is enabled, between the Forge VM and the source and target machines. Open this port on your Forge VM, the source and target workloads, the VMware ESXi hosts, and the vCenter server.
3725	TCP	Used for data transfer between the source and target machines, including file-based transfer and block-based transfer. Open this port on the target and source servers for all workloads. See Supported Configurations.
135, 445	TCP	Used for RPC/DCOM communications on Windows machines during the discovery process, and when taking control and rebooting the source machine. Open these ports for communications on the target and source servers for all Windows workloads. See Supported Windows Workloads.
137, 138, 139	TCP	Used for NetBIOS communications (name service, datagram service, and session service). Open these ports for communications on the target and source servers for all Windows workloads. See Supported Windows Workloads.
137, 138	UDP	Used for SMB communications for the file transfer of the Take Control folder and files from the PlateSpin Server to the source machine.
139, 445	TCP
22	TCP	Used for SSH and SCP communications on Linux machines during the discovery process. Open this port on the source servers and target servers for all Linux workloads. See Supported Linux Workloads.
25	TCP and UDP	Used for SMTP traffic if email notification is enabled. Open this port on the Forge VM.
1433	TCP	Used for Microsoft SQL Server communications for authentication and data exchange to a remote SQL Server. Open this port on your Forge VM and the remote SQL Server host. For more information the SQL Server port requirements, see Configure the Firewall to Allow Server Access in the Microsoft Developers Network.
1434	TCP	Used for the Microsoft SQL Server dedicated admin connection.
1434	UDP	Used for the Microsoft SQL Server named instances. This port might be required when you use named instances on a remote SQL Server.
49152 to 65535	TCP	Used for the Microsoft SQL Server or RPC for LSA, SAM, and Netlogon. If you have configured Microsoft SQL Server to use a specific TCP port, you must open that port on the firewall.

1.2.6 Additional Security Enhancements

PlateSpin Forge provides information in Knowledgebase Article 7015818 about how to remove the vulnerability to potential POODLE (Padding Oracle On Downgraded Legacy Encryption) attacks from your PlateSpin servers.