SecureAuth IdP appliance security hardening details

During the OS hardening process, security applications prerequisites (e.g. EMET and LocalGPO) are installed on the base member template, and relevant templates are applied on the base member server. These actions affect the local group policy and registry. More specific information on these templates is available in the SecureAuth IdP appliance baseline security hardening settings documents.

One of the most common types of attack on a system (client or server) targets the browser. The SecureAuth Web Admin is a web-based console that requires the use of a browser. Most administrative functions – though not all – can be executed remotely, requiring a local browser to perform these tasks. Thus, for security purposes, the browser used by SecureAuth IdP should not be used for anything other than configuring the IdP application.

Using Internet Explorer 11, the browser's functionality on the appliance is controlled by the local group policy. This policy limits the browser's ability to run specific script types, update/add sites on the Trusted Sites and Intranet Zone, and relax other browser security settings. Restrictions imposed by these policies can be modified if permitted by the organization's security policies.

Additional settings for auditing the baseline are documented in the SecureAuth IdP appliance baseline security hardening settings documents.

Since limiting the attack surface is paramount to enforcing security, only required server roles and related features are installed. Thus, the only server role installed is the Web server role.

Windows Firewall with advanced security is enabled by default on the SecureAuth IdP appliance as a protective measure during the initial setup. The Windows advanced firewall is configured to deny incoming sessions by default. Custom rules are added, allowing only SecureAuth IdP-specific inbound and outbound network communications. More specific information on these communications is provided in Network communication requirements for SecureAuth IdP.

The standard appliance shipped to the majority of SecureAuth's customers is generally configured to exceed PCI and HIPAA security standards. However, a growing percentage of the customer base includes state and federal agencies that require HSPD-12 compliance or other pertinent requirements. SecureAuth has worked with several federal customers as well as Conscious Security, Inc. to develop and test additional configuration options that meet requirements for higher security guidance defined in the DISA Security Technical Implementation Guide (STIG), along with other general security settings that may be required depending upon the enterprise or security needs of an organization. These may include, but are not limited to, the following:

Message-level security uses the WS-Security specification to secure messages, providing confidentiality, integrity, and authentication at the SOAP message level (instead of the transport level). Message-level security encapsulates the security credentials and claims for each message, along with any message protection (signing or encryption). Security is applied directly to the message by modifying its content, thereby ensuring the security of the message is self-contained.

By encrypting the message body and leaving the header in clear text, communications between the SecureAuth IdP appliance and the SecureAuth hosted services can easily traverse router and other SOAP intermediaries without requiring the data be exposed at each hop. Additionally, WCF message-level security provides mutual authentication between the two parties.

Transport Layer Security (TLS), a cryptographic protocol, is designed to provide communications security over a network. Using X.509 certificates, asymmetric cryptography is employed to verify the relationship between a certificate and its owner, and to negotiate a symmetric session key.

The most common implementation of this protocol can be found in the use of Secure Sockets Layer (SSL) to encrypt and sign contents of packets sent over Secure HTTP (HTTPS).