ArcGIS Enterprise Security. Gregory Ponto & Jeff Smith

Transcription

1 ArcGIS Enterprise Security Gregory Ponto & Jeff Smith

2 Agenda Focus: Security best practices for ArcGIS Enterprise ArcGIS Server Portal for ArcGIS 10.5 Features Strongly Recommend: Knowledge of ArcGIS Server and Portal for ArcGIS

3 Security is Important

4 Review: ArcGIS Enterprise On-Premises Enabling GIS Everywhere Desktop Web Device Simple Integrated Open Portal Server Online Content and Services The Science of Where

5 ArcGIS Enterprise On-Premises: Behind the scenes Includes 3 components: Portal GIS Server ArcGIS Data Store Portal Portal for ArcGIS ArcGIS Server (GIS Server) ArcGIS Enterprise On-premises ArcGIS Data Store

6 Agenda GIS Server - Enable and use HTTPS - Disable services directory - Restrict cross domain requests - Restrict file permissions - Disable PSA account - Scan Server script Portal for ArcGIS Advanced options Portal for ArcGIS ArcGIS Server (GIS Server)

7 Review: ArcGIS Server Administrator Directory Web App, provides interface into an ArcGIS Server site Many security settings enabled via this interface

8 Enable and Use HTTPS HTTPS Hypertext Transfer Protocol Secure Initial step in creating a secure environment should always be to encrypt traffic Protects against a simple network sniffer Enabled by default in Recommended to restrict to HTTPS only if possible ArcGIS Server Admin Directory - Security > config > update

9 Disable the Services Directory ArcGIS Services Directory exposes GIS web services - Recommend to NOT expose GIS web services on Production Servers Before After REST

10 How to Disable the Services Directory Server Administrator Directory - System > Handlers > Rest > Servicesdirectory > edit - Uncheck Services Directory Enabled option Help topic: Disable the Services Directory

11 Restrict Cross-Domain (CORS) Requests server.arcgis.com > Search cross-domain requests By default, ArcGIS Server allows cross-domain requests so that client apps can invoke its services from any domain Client Web Browser Web Application ArcGIS Server

12 How to Restrict Cross-Domain Requests For JavaScript, a common method used to make cross domain requests is called a CORS request (cross origin resource sharing) These can be restricted in the Server Administrator Directory - system > handlers > rest > servicesdirectory > edit - AllowOrigins field: specify a comma-separated list of domain names that are allowed to make CORS requests to access your web services

13 Demo Restrict Cross-Domain Requests

14 Restrict File Permissions Recommend restrict file and folder permissions on - ArcGIS Server installation directory - Configuration store - Server directories to the ArcGIS Server account ArcGIS Server (GIS Server) Installation directory Configuration store Server directories Your organization may require that additional accounts have access - Warning: Any account with write access to the configuration store can change ArcGIS Server settings

15 Disable Primary Site Administrator (PSA) Account Recommend disable the PSA account to remove an alternate method of administering ArcGIS Server outside of your enterprise users Access the Server Administrator Directory - Security > PSA > disable PSA account

16 Scan GIS Server for Security Checks serverscan.py is a script in the Server installation directory - Located: <install directory>\arcgis\server\tools\admin Script checks for security settings generates a report that makes recommendations to improve security

17 Demo Run serverscan.py Security Check

18 Agenda GIS Server Portal for ArcGIS - Enforce HTTPS Communication only - Disable ArcGIS Portal Directory (aka Sharing API) - Restrict proxies - Disable the Create Account button on the sign-in page - Trusted servers list - Scan Portal script Advanced options Portal for ArcGIS ArcGIS Server (GIS Server)

19 Enable HTTPS Communication Enforce HTTPS so that all communication in your portal is sent using HTTPS Configure your portal and the web server hosting ArcGIS Web Adaptor to only allow communication through HTTPS

20 Disable ArcGIS Portal Directory (Production Servers) Provides a browsable HTML-based representation of all of Portal items - services, web maps, and content Recommend disable this to reduce the chance that your items can be browsed, found in a web search, or queried through HTML forms Before After

21 How to Disable ArcGIS Portal Directory Access the Portal Administrator Directory - Security > Config > Update Security Configuration - Set property = true

22 Restrict Proxy Hosts Portal ships with a built-in proxy server that is used in some scenarios to access resources on a different machine - Storing credentials (Single Sign On) - OGC Services - Non-CORS Systems Client App Portal for ArcGIS PROXY Machine A gis.site.com Firewall

23 Restrict Proxy Hosts Portal ships with a built-in proxy server that is used in some scenarios to access resources on a different machine By default the portal's proxy is open - Your Portal can be used to launch attacks against internal and external targets Attacker Portal for ArcGIS PROXY web.site.com (Victim) Firewall Machine B (Victim)

24 How to Restrict Proxies Access the Portal Administrator Directory - Security > Config > Update Security Configuration - For Configuration field, add the allowedproxyhosts property and specify the list of approved addresses

25 Disable Create Account on Login Page Recommend disable ability to create a new Portal account Access Portal Administrator Directory - System > Properties

26 Trusted Servers List in Portal Configure list of trusted servers that work with Portal for ArcGIS My Organization > Edit settings > Security

27 Trusted Servers in Portal A list of servers to where credentials will be passed when making a CORS request to access secured resources Client Web Browser Web Map Application (Portal for ArcGIS) PROXY ArcGIS Server

28 Demo Trusted Servers in Portal for ArcGIS

29 Scan Portal for Security Checks portalscan.py is a script in the Portal installation directory - Location: <install_directory>\arcgis\portal\tools\security When you run the script, it checks for security settings generates a report that makes recommendations to improve security

30 Demo Run portalscan.py Security Check

31 Agenda GIS Server Portal for ArcGIS Advanced Topics - SSL property configurations for Server and Portal - Define cipher suites to encrypt communications - Portal Collaboration Portal for ArcGIS ArcGIS Server (GIS Server)

32 SSL Property Configurations In 10.4, both Server and Portal can be configured to limit which SSL protocol is accepted and used For organizations that are very security-aware, restricting Server and Portal to TLS 1.2 is highly recommended TLS (and it predecessor SSL) are cryptographic protocols designed to provide secure network communication between a client and a server TLS 1.0 Client App TLS 1.2 Ports: Portal for ArcGIS

33 Password settings for Portal (long passwords, complex, etc)

34 How to Specify Cipher Suites Access the Portal Administrator Directory - Security > SSLCertificates > Update - For the SSL Protocols text box, specify the protocols to be used

35 10.5 Allow Portal Access Collaboration

36 10.5: SAML Access to any ArcGIS Enterprise Bring secured services together from anywhere! SAML Portal Esri Apps SAML Portal Feature: Allow Portal Access - Portal > My Organization > Edit Settings > Security

37 Demo Allow Portal Access

38 10.5: Portal Collaboration As a Developer what do I need to know? Collaborating Apps - Oauth? - App ID? - Access Token? Portal App Portal App

39 10.5: Portal Collaboration As an Administrator what do I need to know? Collaborating Service Items - Low Risk Portal Service Portal Service Data

40 10.5: Portal Collaboration As an Administrator what do I need to know? Collaborating Data Items - Moderate Risk Portal Data Portal Data

41 10.5: Portal Collaboration As an Administrator what do I need to know? Transitive Trust - High Risk Portal Data Portal Data Portal Data

42 10.5: Portal Collaboration As an Administrator what do I need to know? Recommended Practices - Limit Collaborations to Trusted Partners - Share Services instead of Data - Establish New Groups for Collaboration Portal Portal Portal

43 Key Takeaways Summary Use Server Scan Script to Validate ArcGIS Server Security Use Portal Scan Script to Validate Portal for ArcGIS Security Developers: Collaborating Apps = No code changes required Admins: Collaborate Carefully, particularly when sharing Data Items

44 Check for Updates / Patch Notification

45 Please Take Our Survey! No more memorizing Session ID numbers!! Download the Esri Events app and find your event Select the session you attended Scroll down to the Feedback section Complete Answers, add a Comment, and Select Submit

46 Security Topic Resources Securing your ArcGIS Server site Best practices for configuring a secure environment Disable the Services Directory Restricting cross-domain requests to ArcGIS Server Restrict SSL protocols and cipher suites

47

48

49

50

51

52 Did you know? For More Templates, Sample Files, and Icons See New Feature Footers have been added to this template. To learn about using footers for PowerPoint 2010: For PowerPoint 2013: 8B0A-ED75BBAE22B3 Videos not working? For video in PowerPoint, animated GIF is recommended. AVI and WMV (native PC files) will work best on a PC platform. H.264 MP4 will work only on PowerPoint 2013 and later. Esri Corporate Template-Dark v3.3 16:9 version January 21, 2016

53 Aspect Ratio Test If this shape does not appear as a perfect circle, adjust the aspect ratio of your display until it does. Try the resolution 1920x1080 for 16:9 displays. Esri Corporate Template-Dark v3.3 16:9 version January 21, 2016