Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

SafeNet App Gateway

Security Recommendations

search

Security Recommendations

Securing the SafeNet App Gateway agent installation and deployment is critical to protect sensitive data and prevent unauthorized access. Following are some best practices to ensure security:

Secure Environment

Open the following ports on the perimeter firewall to facilitate HTTPS external communication to and from the application server:

  • Port 443: Use this port for secure communication over the internet using the HTTPS protocol.

  • Port 8443 / 7443: Use this port for administrative purposes. Allow only authorized networks to access this port.

Secure Installation

  • Deploy a physical or virtual modern 64-bit Linux server in your perimeter network (or DMZ).

  • Install Docker using these instructions.

  • Install Docker-Compose using these instructions.

Docker Security

  • Do not publicly expose the Docker API. If you choose to expose the Docker API, secure it with Transport Layer Security (TLS) certificates. For more information, refer to Protect the Docker daemon socket documentation.

  • Train users with the user credentials security guidelines. To secure containers,

    • Do not execute processes as root user.
    • Run AppArmor (Application Armor) or SELinux (Security-Enhanced Linux) to enhance security by enforcing access control policies.

TLS Deployment

When securing the SafeNet App Gateway environment with TLS, it is recommended to adhere to the following guidelines:

  • Use a valid SSL certificate for your SafeNet App Gateway server. Acquire an SSL/TLS certificate from a trusted Certificate Authority (CA) with the fully qualified DNS name of your server (for example, yourserver.example.com), or consider using a wildcard SSL certificate.

  • Ensure that the TLS certificate is kept secure and not exposed.

  • Avoid the use of any version of SSL. Disable outdated and insecure protocols (SSLv2, SSLv3).

  • The SafeNet App Gateway solution supports TLS 1.2 and above, so appropriately configure it on the client machines.

  • Extend support for the Signaling Cipher Suite Value extension, TLS_FALLBACK_SCSV. This measure helps prevent protocol downgrade attacks on TLS.

On this page