Security in Bomgar Cloud Remote Support

Transcription

1 Security in Bmgar Clud Remte Supprt 2018 Bmgar Crpratin. All rights reserved wrldwide. BOMGAR and the BOMGAR lg are trademarks f Bmgar Crpratin; ther trademarks shwn are the prperty f their respective wners. TC:6/27/2018

2 Table f Cntents Security in Bmgar Remte Supprt (Clud) 3 Architecture f Bmgar Remte Supprt (Clud) 4 Authenticatin t Bmgar Remte Supprt (Clud) 6 Credential Management in Bmgar Remte Supprt (Clud) 7 Credential Management with Bmgar Vault 7 Encryptin and Prts in Bmgar Remte Supprt (Clud) 9 Auditing f Bmgar Remte Supprt (Clud) 10 Validatin f Bmgar Remte Supprt (Clud) 11 CONTACT BOMGAR inf@bmgar.cm (US) +44 (0) (UK/EMEA) BOMGAR.COM 2

3 Security in Bmgar Remte Supprt (Clud) The purpse f this dcument is t help technically-riented prfessinals understand the security-related value Bmgar can bring t yur rganizatin. Bmgar can help yur supprt rganizatin stay secure and cmpliant, while imprving the efficiency and success f yur rganizatin with a better end-user supprt experience. Bmgar Overview Bmgar cnnects and prtects peple and technlgy with leading secure access slutins that strengthen security while increasing prductivity. Bmgar Clud gives supprt technicians secure remte cntrl f cmputers ver the internet. This specialized sftware prvides exceptinal perfrmance, reliability, ease f use, and scalability thrugh a slutin that is ptimized fr remte supprt. With Bmgar, a supprt technician can see the supprted screen and cntrl the supprted system remtely, as if physically present. Using multiple features designed t ensure the security f remte supprt sessins, Bmgar integrates with external user directries, such as LDAP, fr secure user management, and supprts extensive auditing and recrding f supprt sessins. Lgging is perfrmed n the Bmgar Clud instance, which allws fr the review f all custmer and supprt representative interactins, including vide playback f all desktp screen interactins. Bmgar als integrates with leading systems management and identity management slutins and includes an API fr deeper integratin. With Bmgar, supprt managers can create supprt teams, custmize queues, and reprt n all supprt activity. Bmgar enables remte access t multiple perating systems, including Windws, Mac, varius Linux distributins, and mbile perating systems. Bmgar als enables remte cntrl f varius kinds f systems, including laptps, desktps, servers, kisks, pint-f-sale systems, smartphnes, and netwrk devices. Bmgar allws supprt rganizatins t avid less effective means f supprt by driving requests thrugh custm supprt prtals. Bmgar can match supprt requests with the apprpriate technician r team. Bmgar then mediates cnnectins between custmers and supprt representatives, allwing chat sessins, file dwnlads/uplads, remte cntrl f desktps, screen-sharing in either directin, running f presentatins, and access t system infrmatin and diagnstics. CONTACT BOMGAR inf@bmgar.cm (US) +44 (0) (UK/EMEA) BOMGAR.COM 3

4 Architecture f Bmgar Remte Supprt (Clud) Infrastructure The Bmgar Clud infrastructure is currently spread acrss six Tier 3 r higher data centers. Bmgar custmers can designate a reginal data center t hst their Bmgar slutin s that perfrmance is nt hindered by gegraphic distance between users f the slutin. All data centers leverage advanced electrical and cling systems and N+1 redundancy with uninterruptable pwer slutins and generatr backup. The data centers have advanced netwrking capabilities such as 10Gb+ cnnectivity and a 40Gb+ cre netwrk. CONTACT BOMGAR inf@bmgar.cm (US) +44 (0) (UK/EMEA) BOMGAR.COM 4

5 Cmpliance Data centers hsting the Bmgar Clud have achieved ISO/IEC certificatin f its infrmatin security management systems. Additinally all data centers have cmpleted the fllwing examinatins: SOC II Type 1 SSAE 16 SOC 1 Type II SOC 2 Type II They are als Privacy Shield certified t meet Eurpean Data Privacy cmpliance regulatins. Physical Security All Bmgar Clud servers are hused in data centers that emply a high standard f physical prtectin. The measures include multiple levels f physical security, such as: Man traps / air lck Badged access Securely lcked cages Bimetric access Securely islated strage area 24/7 security persnnel n duty Netwrk Security The netwrk architecture is built t prtect all entry pints assigned t custmers. Highly-available edge gateways and segmented netwrk cmpnents are dedicated and cnfigured in Bmgar. The infrastructure is cntinuusly mnitred, and vulnerability testing is cnducted regularly by internal security staff. Custmer Data All custmer data is cnfined t a dedicated instance f Bmgar allcated t yur rganizatin. The data physically and lgically resides in a siled Bmgar instance and is nt shared between custmers. This unique apprach t the segregatin f custmers keeps yur data safe. CONTACT BOMGAR inf@bmgar.cm (US) +44 (0) (UK/EMEA) BOMGAR.COM 5

6 Authenticatin t Bmgar Remte Supprt (Clud) Bmgar may be prvisined fr lcally defined Bmgar user accunts r can be integrated int existing authenticatin surces. Fr instance, a cmmnly integrated authenticatin surce is Micrsft Active Directry. When using a directry such as this, all authenticatin fllws the existing cntrls and prcesses in place fr safeguarding user accunts. Additinal security prviders are available that allw fr representative authenticatin using Kerbers r SAML (fr single sign-n) r using RADIUS (fr multi-factr authenticatin). Each f these prviders can be cnfigured t use LDAP grups t set the permissins fr the supprt representative, allwing yu t map existing LDAP grups t supprt teams in Bmgar. There are a large number f granular permissins that can be granted t supprt representatives. These permissins determine which features in Bmgar a representative has access t and can require end-user prmpting s that the user receiving supprt must apprve representative actins. CONTACT BOMGAR inf@bmgar.cm (US) +44 (0) (UK/EMEA) BOMGAR.COM 6

7 Credential Management in Bmgar Remte Supprt (Clud) Bmgar Remte Supprt can be integrated with an Endpint Credential Manager (ECM) t imprve passwrd security fr representatives, privileged users, and vendrs. An ECM functins as the middleware fr cmmunicatin, and the ECM can be used t integrate Bmgar Remte Supprt with thirdparty passwrd vaults as well as with Bmgar Privileged Identity. Fr mre infrmatin abut Bmgar Privileged Identity, frmer RED IM, please see Bmgar Privileged Identity at Nte: The ECM is nt required when using the n-appliance credential stre, Bmgar Vault. Credential injectin is a built-in feature f Bmgar Remte Supprt. It allws administratrs, representatives, and ther privileged users t seamlessly inject credentials int systems withut expsing plain text passwrds, and this feature can als be used with third-party vault tls. Credential Management with Bmgar Vault Bmgar Vault is an n-appliance credential stre, enabling discvery f and access t privileged credentials. Yu can manually add privileged credentials, r yu can use the built-in discvery tl t scan and imprt Active Directry and lcal accunts int Bmgar Vault. Bmgar Vault fits seamlessly with service desk wrkflw because it is integrated directly with the Remte Supprt slutin. Technicians d nt have t learn t use anther tl r even exit Bmgar t retrieve passwrds. With just ne click in the Bmgar representative cnsle, users can simply select the crrect credential frm the drpdwn and lg directly int a remte system - withut ever having t knw r even see the actual passwrd. Frequently Asked Questins abut Bmgar Vault What cmmunicatin pathways are used with Bmgar Vault (prts, prtcls, cnnectin types, etc.)? Active Directry and Discvery: By default, discvery ccurs ver LDAP via the Active Directry Service Interface (ADSI) n prt 389. If LDAPS is enabled, Active Directry queries run ver LDAP under an SSL/TLS layer n prt 636, unless anther prt is specified. This transprt-layer security encrypts all data cmmunicated t and frm Active Directry. Windws Lcal Discvery Lcal Windws accunts are discvered via a series f calls directly t Windws APIs. These APIs use Remte Prcedure Calls (RPCs) and named pipes as the netwrk prtcl. The RPC prcess translates the request parameters as well as any respnse data int a standard, encded frmat fr transmissin. Prtectin is negtiated at the perating system level. Where des encryptin fr Bmgar Vault ccur? Passwrds and private SSH keys are encrypted at rest using AES-256-GCM in additin t any full disk encryptin enabled fr the Bmgar Appliance. CONTACT BOMGAR inf@bmgar.cm (US) +44 (0) (UK/EMEA) BOMGAR.COM 7

8 Passwrds and private SSH keys are encrypted in transit using an ephemeral public+private key pair when used fr injectin. This encryptin ccurs in additin t Remte Supprt's use f TLS t encrypt cmmunicatin amng all Bmgar cmpnents, such as the appliance, Jumpint, custmer client, etc. Passwrds are encrypted in transit by TLS. Passwrds used by Jumpints t authenticate with Active Directry are never sent in plaintext t Active Directry. Where is the Vault encryptin key stred? Can it be accessed via /lgin r /appliance? The Vault encryptin key is needed t decrypt credentials managed by Bmgar Vault. This key is stred n disk in yur Bmgar Appliance. Fr added security and prtectin, check ut Bmgar Remte Supprt's Data at Rest Encryptin functinality at Intrductin t Data at Rest Encryptin with Bmgar at The encryptin key can be backed up by ging t /lgin > Management > Sftware Management > Backup Vault Encryptin Key. The backup file frmat used fr the encryptin key is the same.nsb file frmat used fr cnfiguratin and reprting data. Is the Bmgar applicatin database encrypted, and if s, hw? Bmgar Vault stres data in an encrypted frmat in the database. If full disk encryptin is enabled fr yur Bmgar Appliance, the Bmgar applicatin database is als encrypted. Hwever, this is independent f the encryptin perfrmed by Bmgar Vault. What best practices are recmmended t maintain the highest level f security acrss all pints f cnnectin (discvery, injectins, supprt, etc)? Bmgar recmmends using a valid CA-signed SSL certificate t prtect cmmunicatin amng all Bmgar cmpnents. Jumpints shuld run n a system nly a few privileged users have permissins t access. Fr mre infrmatin abut Jumpints, please see Remte Supprt Jumpint Guide: Unattended Access t Cmputers in a Netwrk at Nte: At this time, there are n user-visible security settings fr Bmgar Vault. CONTACT BOMGAR inf@bmgar.cm (US) +44 (0) (UK/EMEA) BOMGAR.COM 8

9 Encryptin and Prts in Bmgar Remte Supprt (Clud) Bmgar can be cnfigured such that it enfrces the use f SSL fr every cnnectin made t the site. Bmgar requires that the SSL certificate being used t encrypt the transprt is valid. Bmgar can natively generate certificate signing requests. Cnfiguratin ptins als are available t disable the use f TLSv1 and/r TLSv1.1. Bmgar always has TLSv1.2 enabled t ensure prper peratin f the sftware. Available cipher suites can be enabled r disabled and rerdered as needed t meet the needs f yur rganizatin. The Bmgar sftware itself is uniquely built fr each custmer. As part f the build, an encrypted license file is generated that cntains the supprt prtal Dmain Name System (DNS) name and the SSL certificate, which is used by the respective Bmgar client t validate the cnnectin that is made t the Clud site. The chart belw highlights the required prts and the ptinal prts. Nte that there is very minimal prt expsure f the Bmgar Clud infrastructure. This drastically reduces the ptential expsed attack surface f the site. Belw are example firewall rules fr use with Bmgar Clud, including prt numbers, descriptins, and required rules. TCP Prt 80 (ptinal) TCP Prt 443 (required) TCP Prt 25, 465, r 587 (ptinal) TCP Prt 443 (ptinal) Firewall Rules Internal Netwrk t the Bmgar Clud Instance Used t hst the prtal page withut the user having t type HTTPS. The traffic can be autmatically rlled ver t prt 443. Used fr all sessin traffic. Bmgar Clud Instance t the Internal Netwrk Allws the appliance t send admin mail alerts. The prt is set in SMTP cnfiguratin. Appliance t web services (e.g., HP Service Manager, BMC Remedy) fr utbund events. CONTACT BOMGAR inf@bmgar.cm (US) +44 (0) (UK/EMEA) BOMGAR.COM 9

10 Auditing f Bmgar Remte Supprt (Clud) Bmgar prvides tw types f supprt sessin lgging. All the events f an individual supprt sessin are lgged as a text-based lg. This lg includes representatives invlved, permissins granted by the custmer, chat transcripts, system infrmatin, and any ther actins taken by the Bmgar representative. This data is available n the appliance in an un-editable frmat fr up t 90 days, but it can be mved t an external database using the Bmgar API r the Bmgar Integratin Client. All supprt sessins are assigned a unique sessin ID referred t as an LSID. The sessin LSID is a 32-character string that is a unique GUID fr each sessin. The LSID is stred as part f each sessin lg fr every sessin cnducted. Bmgar als allws enabling vide sessin recrdings. This recrds the visible user interface f the custmer screen fr the entire screen sharing sessin. The recrding als cntains metadata t identify wh is in cntrl f the muse and keybard at any given time during the playback f the recrded sessin. The perid f time these recrdings remain available depends n the amunt f sessin activity and the available strage, up t 90 days maximum. As with the supprt sessin lgging, these recrdings can be mved t an external file stre using the Bmgar API r the Bmgar Integratin Client. The Bmgar Integratin Client can be used t exprt data frm the site and stre it if needed t cmply with security plicies. Bmgar can als be cnfigured t stre data fr a shrter perid f time t help cmply with security plicies. The Integratin Client (IC) is a Windws applicatin that uses the Bmgar API t exprt sessin lgs, recrdings, and backups frm the Bmgar Clud site accrding t a defined peridic schedule. The IC uses plug-in mdules t determine the repsitry fr the exprted data. Bmgar prvides tw IC plug-in mdules. One handles exprt f reprts and vide recrdings t a file system destinatin. The secnd exprts select reprt infrmatin (a subset f the entire data cllectin) t a Micrsft SQL Server database. Setup f the IC fr SQL Server includes all f the prcedures needed t autmatically define the necessary database, tables, and fields. In practice, the Integratin Client is used t exprt supprt sessin data that must be retained fr legal and cmpliance reasns. The reprts and recrdings are archived in a file system, indexed by sessin IDs. Data stred in the SQL Server tables may be queried t lcate the Bmgar sessin ID crrespnding t given search criteria such as date, representative, r IP address. All authenticatin events, such as when a representative lgs int the representative cnsle r accesses the /lgin interface, generate a syslg event which can be lgged n a syslg server. Additinally, any cnfiguratin change that is made t the Bmgar Clud instance als generates a syslg event shwing the change that was made and by which user. CONTACT BOMGAR inf@bmgar.cm (US) +44 (0) (UK/EMEA) BOMGAR.COM 10

11 Validatin f Bmgar Remte Supprt (Clud) T ensure the security and value f ur prduct, Bmgar incrprates vulnerability scanning in ur sftware testing prcess. We track the results f vulnerability scans perfrmed prir t a sftware release and priritize reslutin based n severity and criticality f any issues uncvered. Shuld a critical r high-risk vulnerability surface after a sftware release, a subsequent maintenance release addresses the vulnerability. Updated maintenance versins are distributed t ur custmers via the update manager interface within the Bmgar administrative interface. When necessary, Bmgar Supprt cntacts custmers directly, describing special prcedures t fllw t btain an updated maintenance versin. Additinally, Bmgar Clud instances may be autmatically updated based n the update interval chsen by the custmer at the time f purchase. In additin t internal scanning prcedures, Bmgar cntracts with third-parties fr a surce cde level review as well as penetratin testing. The surce cde review cnducted essentially prvides validatin frm a third party that cding best practices are fllwed and that prper cntrls are in place t prtect against knwn vulnerabilities. A penetratin test is cnducted t cnfirm the findings. CONTACT BOMGAR inf@bmgar.cm (US) +44 (0) (UK/EMEA) BOMGAR.COM 11