Sicherheit bei Diensten: ArcGIS Server und ArcGIS Online. Matthias Schenker, Esri Schweiz AG

Transkript

1 Sicherheit bei Diensten: ArcGIS Server und ArcGIS Online Matthias Schenker, Esri Schweiz AG

2 Esri Schweiz AG Basics & Strategy

3 Esri Schweiz AG

4 Where are the vulnerabilities? SANS Relative Vulnerabilities Esri Schweiz AG

5 Vulnerabilities in Applications Esri Schweiz AG

6 Esri Schweiz AG

7 Esri Schweiz AG

8 Esri Schweiz AG Mechanisms

9 Esri Schweiz AG

10 Authentication + GIS Tier (Default) > Built-in User store > Enterprise (AD / LDAP / SAML) > oauth > ArcGIS Tokens + Web Tier (Add web adaptor) > Enterprise (AD / LDAP) > Any authentication supported by web server Esri Schweiz AG > HTTP Basic / Digest > PKI > Windows Integrated

11 Authorization Role based access control + Esri COTS > Assign access with ArcGIS Manager > Service Level Authorization across web interfaces > Services grouped in folders utilizing inheritance + 3rd Party > Web Services Conterra s Security Manager (more granular) > RDBMS Row Level or Feature Class Level > Versioning with Row Level degrades RDBM performance > Alternative - SDE Views + Custom - Limit GUI > Rich Clients via ArcObjects > Web Applications > Sample code Links in ERC > Microsoft s AzMan (Authorization Manager) tool Esri Schweiz AG

12 Filters 3rd Party Options + Firewalls + Reverse Proxy + Web Application Firewall > Open Source option ModSecurity + Anti-Virus Software + Intrusion Detection / Prevention Systems + Limit applications able to access geodatabase Esri Schweiz AG

13 Filters WAF + High availability ArcGIS infrastructure + Traffic filtered before accessed by web servers + Internal users > Access GIS servers via port 6080 directly + If need more encryption > Configure SSL across backend systems + If want no web tier > Loadbalancer can hit GIS Servers directly Esri Schweiz AG

14 Encryption 3rd Party Options + Network > IPSec (VPN, Internal Systems) > SSL (Internal and External System) > Cloud Encryption Gateways > Only encrypted datasets sent to cloud + File Based > Operating System BitLocker > GeoSpatially enabled PDF s combined with Certificates > Hardware (Disk) + RDBMS > Transparent Data Encryption (TDE) > Low Cost Portable Solution - SQL Express 2012 w/tde Esri Schweiz AG

15 Logging / Auditing + Esri COTS > Geodatabase history > May be utilized for tracking changes > ArcGIS Workflow Manager > Track Feature based activities > ArcGIS Server 10+ Logging > User tag tracks user requests + 3rd Party > Web Server, RDBMS, OS, Firewall > Consolidate with a SIEM + Geospatial service monitors > Vestra s GeoSystems Monitor > Geocortex Optimizer Esri Schweiz AG

16 Logging / Auditing + Vestra GeoSystems Monitor > ArcGIS Platform access and availability awareness > New - User consumption metrics > SDE Table/Feature class (Who & Frequency) > ArcGIS Server Services & Apps (Who & Action) Esri Schweiz AG

17 Esri Schweiz AG ArcGIS Server

18 ArcGIS for Server Security Protecting your ArcGIS Server site and its web services Control who has access - Integrate with your organization s IT infrastructure Define what valid users can do - Permissions Server

19

20 ArcGIS for Server Access: Authorization User Valid login to access Server site Role Grouping of users 1. Administrators Full admin control Server 2. Publishers Publish web services 3. Users view web services Identity Store Repository for user and role information

21 ArcGIS for Server: User considerations Where are you users coming from? - Determines which type of identity store you should use Internal : Windows Active Directory or LDAP External : Built-in or custom Organizations IT network External Identity store Internal Server

22 ArcGIS for Server: Role considerations How much control do I have on my ArcGIS Server site? - Managed by me, within my Dept? or - Managed by my organization s IT Dept May affect where you define your roles

23 ArcGIS for Server: Identity store Identity store Defines your users and roles 3 different options 1. Built-in (default) 2. Register with an enterprise identity store - Windows Active Directory - LDAP 3. Mixed mode - Users from enterprise identity store - Roles from built-in store

24 Securing GIS Web Services Set permissions for roles on - A Folder - Individual services Administrators / Publishers grant permissions Server All new services are public by default - Anonymous access Can specify whether folders require HTTPs

25 Authentication Tier / Method Authentication Check and verify user identity Authentication options 1. GIS Tier - Uses ArcGIS Tokens to authenticate 2. Web Tier - Uses Integrated Windows authentication, Client certificates, Basic, Digest, etc

26 GIS Tier vs. Web Tier Authentication GIS Tier / Token Web Tier / HTTP Auth Default Yes No Public / anonymous possible Clients Supporting Yes Esri No All, including OGC Requirements Enable SSL Web Adaptor(s) required Basic require SSL Digest special setup IWA Windows only

27

28

29

30

31

32

33

34 36 Protecting Against Attacks

35 Preventing Snooping HTTPS - Between Server and web adaptor/proxy - Between web adaptor/proxy and client - Easy to configure Lock down your directories - Config-store - Output directories - No permissions to anyone except ArcGIS Server account

36 Enabling HTTPS Click by click

37 Preventing Cross-Site Scripting Attacks Bad Guy gets you to click on a link for reputable site Bad Guy gets you to do bad things with your credentials Four recommendations - Use latest software - Disable Services Directory in Server - Disable Portal directory in Portal - Log out when done

38 Preventing Cross-Site Request Forgery (CSRF) Bad Guy gets you to go to their site Bad Guy gets you to do bad things with your credentials ArcGIS Server (10.1 SP1+) automatically protects against CSRF admin operations Recommendations - Upgrade to 10.1 SP1 or later - Configure cross-domain access ( - Configure shorter-lived tokens

39 Disabling Services Directory Navigation Path in Admin Directory Enabling/disabling easy as a click Bonus: limit which web servers can access Your services

40 Preventing SQL Injection Attacks Bad guy uses normal access to find holes in your database - To modify data - Grant greater permissions to himself - Execute code on your machine If you use an enterprise database, you re at risk Recommendation: - Latest DBMS upgrade - Follow DBMS vendor best practices - Upgrade to ArcGIS Server 10.2 or greater - Validate inputs in custom apps

41 Standardized queries Prior to 10.2, query syntax unique for each database Led to two problems Software passes through queries directly to database scanning for malicious attacks. - Hard to prevent many creative SQL injection attacks. - Hard for developers to write query code.

42 Standardized queries 10.2 introduces standardized queries - Same syntax against all databases (FGDB syntax) - Each query parsed and prepared before sending to the database. - Stronger defense against SQL injection attacks. - Easier to write queries.

43 Standardized queries What can you do if things break? - Recommended: update your applications to use new syntax. - Disable standardized queries. Not recommended for security reasons. Puts your Server at risk.

44 Escalation of Privileges Attacks Bad guy is able to upgrade his privileges - In ArcGIS Server - In your domain Recommendations - Using enterprise groups (not built-in groups) , use admin API to list admins/publishers to detect changes

45 Checking Privileges Navigation Path Home > security > roles > getrolesbyprivilege Check to see which roles have administer privilege Uh oh!

46 Denial-of-Service Attacks Bad guy is able to shut your ArcGIS Server down by sending lots of requests Most attacks observed in wild are still through low-level network protocols Recommendations - Secure services - Set wait and usage time outs

47 Setting Time-outs

48

49 Esri Schweiz AG Web Applications

50 Common use cases for secured services How service URLs authenticate Application (server & portal tokens) Web server (e.g., IIS) User login Impersonated Single sign on or User login AGOL via OAuth AGS service AGOL item via Secured app with tokens stored Application Level Browser-based Authentication via Web app Mobile app Identity Mgr In the Code In a Proxy IWA PKI Esri UC2013. Technical Workshop.

51 Application level authentication Implementation - Web server MUST be configure for anonymous access - Token-based ArcGIS Server uses server tokens ArcGIS Online uses portal tokens - Requires server or portal token service - GIS server tier authentication in ArcGIS Server Login using ArcGIS Identity manager - Handles all login and token processing - Supported in all Web APIs Esri UC2013. Technical Workshop. Building Secure Applications

52 What is OAuth? Industry standard enterprise authentication system - Login redirected to enterprise security server - Application NEVER see credentials Works with SAML - Server based mechanism that handles login requests - Supported by AGOL for enterprise authentication - More in final section Esri UC2013. Technical Workshop. Building Secure Applications

53 Identity Manager Why should I use it? - Handles all login and token processing - Works with default token security model AGS & AGOL - Available in all Web API s & viewer apps What should I watch out for? - Only works for token secured services - Prompts multiple times rather than ignoring services Esri UC2013. Technical Workshop. Building Secure Applications

54 56 Cloud

55 57

56 Datenschutz und Sicherheit Standards Sicherer Betrieb Onpremise Verfügbarkeit Anwendungssicherheit Datenmanagement 58

57 Standards betreffend ArcGIS Online Standards Internationales Public Cloud Angebot Sicherheit? Audits? Privacy? + ISO > Betrifft nicht die Software, sondern die Maßnahmen zur IT-Sicherheit > Genügt den Anforderungen des BDSG + SSAE 16 > regelt detailliert welche Anforderungen und welche Form die Prüfung eines dienstleistungsbezogenen internen Kontrollsystems zu erfüllen hat und wie und mit welchen Inhalten die Berichterstattung zu erfolgen hat. + TRUSTe Certified Privacy Seal + Safe Harbor > Festlegung von Maßnahmen zum Datenschutz 59

58 Standards Authentifizierung und Transfer Standards Standards für Anmeldung der Nutzer + SAML > Einbindung von Unternehmens Logins > Active Directory Federation Service, NetIQ Access, Shibboleth, SimpleSAMLphp + OAuth2 > Offenes Protokoll zur standardisierten Autorisierung von Desktop-, Web- oder Mobilen Anwendungen > Die Anwendung selbst bekommt keine Anmeldeinformationen, sondern nur einen Token + SSL > Verschlüsselte Übertragung von Informationen > Anmeldeinformationen sollte immer verschlüsselt übertragen werden + PKI > Public Key Infrastructure > Extra Verschlüsselung für eigene Infrastruktur 60

59 Sicherer Betrieb Sicherer Betrieb Wer darf wann auf was zugreifen? + Sicherheitsüberprüfung der Mitarbeiter. + Der Zugriff auf Kundendatenbankinformationen ist auf ausgewählte und erforderliche Zahl an Mitarbeiter beschränkt. + Weniger als 10 spezialisierte ArcGIS Online Administratoren haben Zugang zu Kundendaten. Es werden hierfür X.509 Zertifikate für Autorisierung benutzt (ISO 27001; A11.2.1, etal) 61

60 Datenmanagement - ArcGIS Online Datenmanagement Wer darf was mit den (Geo) Daten machen? Besitz Die Daten gehören dem Einsteller Mandantenfähigkeit Datensatz mit Subskriptions ID gekennzeichnet Extraktion gesteuert über Rechte für Nutzer. Löschen Aufgabe des Einstellers 62

61 Anwendungssicherheit Anwendungs Sicherheit Inhalte sind per se privat. D.h. nur für den Einsteller sichtbar. Inhalte können explizit für Gruppen (und die Anwender die Zugang zu diesen Gruppen haben) freigegeben werden Öffentlicher Zugang zu Inhalten kann vom Administrator ausgeschaltet werden Rollenkonzept: Zugehörigkeit zu Rolle steuert Rechte 63

62 Cloud und On Premise Konzepte On- Premise Apps Portal GIS Servers Ready to use Content SaaS ArcGIS Online (Portal) ArcGIS Online (Hosted Servers) ArcGIS Online Services On-Premise Portal for ArcGIS ArcGIS Server ArcGIS Data Appliance 64

63 Esri Schweiz AG

64 Esri Schweiz AG

65 Esri Schweiz AG

66 Esri Schweiz AG

67 Esri Schweiz AG Summary

68 Zusammenfassung + Security is NOT about just a technology > Understand your organizations GIS risk level > Realize the game has changed and prioritize efforts accordingly > Don t just add components, simplify! + Secure Best Practice Guidance is Available > Check out the ArcGIS for Professionals site! > Drill into details by mechanism or application > Trust.arcgis.com Esri Schweiz AG