Your suggested change has been received. Thank you.

close
Thales Logo

All

  • All
  • CipherTrust Manager
  • CipherTrust Application Data Protection (CADP)
  • CipherTrust Application Key Management (CAKM)
  • CipherTrust Batch Data Transformation (BDT)
  • CipherTrust Cloud Key Management (CCKM)
  • CipherTrust Data Discovery and Classification (DDC)
  • CipherTrust Data Protection Gateway (DPG)
  • CipherTrust Database Protection (CDP)
  • CipherTrust Intelligent Protection (CIP)
  • CipherTrust Integrations
  • CipherTrust Migrations
  • CipherTrust RESTful Data Protection (CRDP)
  • CipherTrust Transparent Encryption (CTE)
  • CipherTrust Transparent Encryption Userspace (CTE-U)
  • CipherTrust Secrets Management (CSM)
  • CipherTrust Vaulted Tokenization (CT-V)
  • CipherTrust Vaultless Tokenization (CT-VL)
  • CTE-Linux
  • CTE-Windows
  • CTE-AIX
  • CTE-K8s
  • CTE-U
  • Crypto Command Center
  • Data Protection on Demand
  • Luna Cloud HSM
  • Luna Network HSM
  • Luna PCIe HSM
  • Luna USB HSM
  • OneWelcome Identity Platform
  • ProtectApp LUKS
  • ProtectServer 2 HSM
  • ProtectServer 3 HSM
  • SafeNet Trusted Access (STA)
  • SafeNet MobilePASS+
  • SafeNet MobilePASS+ for Android
  • SafeNet MobilePASS+ for Chrome
  • SafeNet MobilePASS+ for macOS
  • SafeNet MobilePASS+ for iOS
  • SafeNet MobilePASS+ for WatchOS
  • SafeNet MobilePASS+ for Windows
  • SafeNet Synchronization Agent
  • SafeNet Logging Agent
  • SafeNet Agent for FreeRADIUS
  • SafeNet Agent for NPS
  • SafeNet Agent for Windows Logon
  • SafeNet Authentication Service Private Cloud Edition (SAS PCE)
  • SafeNet Remote Logging Agent
  • SafeNet Keycloak Agent
  • SafeNet IDPrime Virtual (IDPV)
  • SafeNet FIDO Key Manager
  • SafeNet FIDO Key Manager for Android
  • SafeNet FIDO Key Manager for iOS
  • SafeNet FIDO Key Manager for Windows
back

SafeNet App Gateway

Security Recommendations

search
printsuggest an edit

Security Recommendations

Securing the SafeNet App Gateway agent installation and deployment is critical to protect sensitive data and prevent unauthorized access. Following are some best practices to ensure security:

copy link to clipboardSecure Environment

Open the following ports on the perimeter firewall to facilitate HTTPS external communication to and from the application server:

  • Port 443: Use this port for secure communication over the internet using the HTTPS protocol.

  • Port 8443 / 7443: Use this port for administrative purposes. Allow only authorized networks to access this port.

copy link to clipboardSecure Installation

  • Deploy a physical or virtual modern 64-bit Linux server in your perimeter network (or DMZ).

  • Install Docker using these instructions.

  • Install Docker-Compose using these instructions.

copy link to clipboardDocker Security

  • Do not publicly expose the Docker API. If you choose to expose the Docker API, secure it with Transport Layer Security (TLS) certificates. For more information, refer to Protect the Docker daemon socket documentation.

  • Train users with the user credentials security guidelines. To secure containers,

    • Do not execute processes as root user.
    • Run AppArmor (Application Armor) or SELinux (Security-Enhanced Linux) to enhance security by enforcing access control policies.

copy link to clipboardTLS Deployment

When securing the SafeNet App Gateway environment with TLS, it is recommended to adhere to the following guidelines:

  • Use a valid SSL certificate for your SafeNet App Gateway server. Acquire an SSL/TLS certificate from a trusted Certificate Authority (CA) with the fully qualified DNS name of your server (for example, yourserver.example.com), or consider using a wildcard SSL certificate.

  • Ensure that the TLS certificate is kept secure and not exposed.

  • Avoid the use of any version of SSL. Disable outdated and insecure protocols (SSLv2, SSLv3).

  • The SafeNet App Gateway solution supports TLS 1.2 and above, so appropriately configure it on the client machines.

  • Extend support for the Signaling Cipher Suite Value extension, TLS_FALLBACK_SCSV. This measure helps prevent protocol downgrade attacks on TLS.

On this page