One Identity Safeguard for Privileged

Sessions 6.2

Security Checklist
Copyright 2019 One Identity LLC.
ALL RIGHTS RESERVED.
This guide contains proprietary information protected by copyright. The software described in this guide
is furnished under a software license or nondisclosure agreement. This software may be used or copied
only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced
or transmitted in any form or by any means, electronic or mechanical, including photocopying and
recording for any purpose other than the purchaser’s personal use without the written permission of
One Identity LLC .
The information in this document is provided in connection with One Identity products. No license,
express or implied, by estoppel or otherwise, to any intellectual property right is granted by this
document or in connection with the sale of One Identity LLC products. EXCEPT AS SET FORTH IN THE
TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT,
ONE IDENTITY ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR
STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-
INFRINGEMENT. IN NO EVENT SHALL ONE IDENTITY BE LIABLE FOR ANY DIRECT, INDIRECT,
CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT
LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF
INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF
ONE IDENTITY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. One Identity makes no
representations or warranties with respect to the accuracy or completeness of the contents of this
document and reserves the right to make changes to specifications and product descriptions at any
time without notice. One Identity does not make any commitment to update the information
contained in this document.
If you have any questions regarding your potential use of this material, contact:
One Identity LLC.
Attn: LEGAL Dept
4 Polaris Way
Aliso Viejo, CA 92656
Refer to our Web site (http://www.OneIdentity.com) for regional and international office information.
Patents
One Identity is proud of our advanced technology. Patents and pending patents may apply to this
product. For the most current information about applicable patents for this product, please visit our
website at http://www.OneIdentity.com/legal/patents.aspx.
Trademarks
One Identity and the One Identity logo are trademarks and registered trademarks of One Identity
LLC. in the U.S.A. and other countries. For a complete list of One Identity trademarks, please visit
our website at www.OneIdentity.com/legal. All other trademarks are the property of their
respective owners.
Legend

WARNING: A WARNING icon highlights a potential risk of bodily injury or property

damage, for which industry-standard safety precautions are advised. This icon is
often associated with electrical hazards related to hardware.

CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if

instructions are not followed.

SPS Security Checklist

Updated - August 2019
Version - 6.2
Contents

Security checklist for configuring One Identity Safeguard for Privileged

Sessions (SPS) 4
Encryption-related settings 4
Connection policies 5
Appliance access 5
Networking considerations 6

About us 7
Contacting us 7
Technical support resources 7

SPS 6.2 Security Checklist 3

 3

Security checklist for configuring

One Identity Safeguard for
Privileged Sessions (SPS)

The following checklist is a set of recommendations and configuration best practices

to ensure that your One Identity Safeguard for Privileged Sessions (SPS) is
configured securely.

Encryption-related settings
l One Identity recommends using 2048-bit RSA keys (or stronger).
l Use strong passwords: at least 8 characters that include numbers, letters, special
characters, and capital letters. For local One Identity Safeguard for Privileged
Sessions (SPS) users, require the use of strong passwords (set AAA > Settings >
Minimal password strength to strong). For details, see "Setting password policies
for local users" in the Administration Guide.
l When exporting the configuration of SPS, or creating configuration backups, always
use encryption. Handle the exported data with care, as it contains sensitive
information, including credentials. For details on encrypting the configuration, see
"Encrypting configuration backups with GPG" in the Administration Guide.
l Use every keypair or certificate only for one purpose. Do not reuse cryptographic
keys or certificates (for example, do not use the certificate of the One Identity
Safeguard for Privileged Sessions (SPS) webserver to encrypt audit trails, or the
same keypair for signing and encrypting data).
l Do not use the CBC block cipher mode, or the diffie-hellman-group1-sha1 key
exchange algorithm. For details, see "Supported encryption algorithms" in the
Administration Guide.
l Always encrypt your audit trails to protect sensitive data. For details, see "Encrypting
audit trails" in the Administration Guide.

SPS 6.2 Security Checklist

Security checklist for configuring One Identity Safeguard for Privileged 4

Sessions (SPS)
Connection policies
l When configuring connection policies, always limit the source of the connection to the
client network that requires access to the connection.
l Always use gateway authentication to authenticate clients. Do not trust the source IP
address of a connection, or the result of server authentication.
l To prevent Denial of Service (DoS) attacks against One Identity Safeguard for
Privileged Sessions (SPS), set the Connection rate limit option of your connection
policies. For details, see "Configuring connections" in the Administration Guide.
l Configure your RDP connection policies to use strong encryption. To enable SSL-
encryption for the RDP protocol, see "Enabling TLS-encryption for RDP connections"
in the Administration Guide.
l In RDP connections, if the client uses the Windows login screen to authenticate on the
server, the password of the client is visible in the audit trail. To avoid displaying the
password when replaying the audit trail, you are recommended to encrypt the
upstream traffic in the audit trail using a separate certificate from the downstream
traffic. For details, see "Encrypting audit trails" in the Administration Guide.
l Ensure that host key verification is enabled in SSH connection policies. That is, the
Server side hostkey settings > Allow plain host keys and Server side
hostkey settings > Allow X.509 host certificates options do not have the No
check required option selected. For details, see "Setting the SSH host keys of the
connection" in the Administration Guide.

Appliance access
l Accessing the One Identity Safeguard for Privileged Sessions (SPS) host directly
using SSH is not recommended or supported, except for troubleshooting purposes. In
such case, the One Identity Support Team will give you exact instructions on what to
do to solve the problem.
For security reasons, disable SSH access to SPS when it is not needed. For details,
see "Enabling SSH access to the One Identity Safeguard for Privileged Sessions
(SPS) host" in the Administration Guide.
l Permit administrative access to SPS only from trusted networks. If possible,
monitored connections and administrative access to the SPS web interface should
originate from separate networks.
l Configure SPS to send an alert if a user fails to login to SPS. For details, see the
Login failed alert in "System related traps" in the Administration Guide.
l Configure Disk space fill-up prevention, and configure SPS to send an alert if the
free space on the disks of SPS is low. For details, see "Preventing disk space fill-up"
in the Administration Guide.

SPS 6.2 Security Checklist

Security checklist for configuring One Identity Safeguard for Privileged 5

Sessions (SPS)
Networking considerations
l One Identity Safeguard for Privileged Sessions (SPS) stores sensitive data. Use a
firewall and other appropriate controls to ensure that unauthorized connections
cannot access it.
l If possible, enable management access to SPS only from trusted networks.
l Make sure that the HA interface of SPS is connected to a trusted network.

SPS 6.2 Security Checklist

Security checklist for configuring One Identity Safeguard for Privileged 6

Sessions (SPS)
 About us

About us

One Identity solutions eliminate the complexities and time-consuming processes often
required to govern identities, manage privileged accounts and control access. Our solutions
enhance business agility while addressing your IAM challenges with on-premises, cloud and
hybrid environments.

Contacting us
For sales or other inquiries, visit https://www.oneidentity.com/company/contact-us.aspx
or call +1-800-306-9329.

Technical support resources

Technical support is available to One Identity customers with a valid maintenance contract
and customers who have trial versions. You can access the Support Portal at
https://support.oneidentity.com/.
The Support Portal provides self-help tools you can use to solve problems quickly and
independently, 24 hours a day, 365 days a year. The Support Portal enables you to:

l Submit and manage a Service Request

l View Knowledge Base articles
l Sign up for product notifications
l Download software and technical documentation
l View how-to videos at www.YouTube.com/OneIdentity
l Engage in community discussions
l Chat with support engineers online
l View services to assist you with your product

SPS 6.2 Security Checklist

7
About us