Hardening Guidelines

The CipherTrust Manager should be deployed into as secure an environment as possible. Every effort has been made to make the CipherTrust Manager as secure as possible, however, additional precautions should be taken especially when the CipherTrust Manager is deployed into an untrusted environment.

Network Security Groups

A network security group includes security rules that permit or deny inbound network traffic to required ports of CipherTrust Manager interfaces and outbound network traffic from CipherTrust Manager clients. For the list of available CipherTrust Manager inbound network traffic ports, refer to the following Recommended Interface Types and Port Assignments.

Recommended Interface Types and Port Assignments

The recommended interface types and port assignments for the CipherTrust Manager are:

Encryption of Virtual CipherTrust Manager

It is best practice to encrypt any Virtual CipherTrust Manager used in production. This is especially true if the Virtual CipherTrust Manager is deployed into an untrusted environment. When a Virtual CipherTrust Manager instance first boots, there are a number of secrets generated specific to that instance. To ensure that these secrets are never exposed, the CipherTrust Manager should be encrypted on first boot before it generates these. Please refer to Disk Encryption for details.

System Administrative Key

The SSH Private Key, used to access the System Administrative account "ksadmin", is extremely sensitive and should be kept in a secure environment.

HSM Configurations

If configured to use an HSM (SafeNet Luna Network HSM, Luna T-Series Network HSM, DPoD's Luna Cloud HSM service, or AWS CloudHSM), the CipherTrust Manager will protect all of its secrets with a non exportable HSM key. To protect all secrets, the CipherTrust Manager must be connected to the HSM on first boot. This is the most secure configuration. Special configuration is required to use an HSM with a cluster of appliances.

TLS Compatibility

This table identifies the supported TLS versions for each of the CipherTrust Manager interfaces. The default minimum value reflects the default minimum_tls_version setting. This setting controls the lowest acceptable TLS version allowed for connections to the interface.