Securing ArcGIS Server Services: Advanced Options

Transcription

1 Federal GIS Conference February 9 10, 2015 Washington, DC Securing ArcGIS Server Services: Advanced Options Michael Sarhan Esri

2 Agenda Review Common Threats Security Configurations Securing ArcGIS Server Services: Advanced Options

3 Review: ArcGIS for Server Architecture or ArcGIS Server site Service directories GIS Server Manager Server Administrator API Primary Site Administrator (PSA) ArcGIS account (OS level) Configuration store Data Server directories Securing ArcGIS Server Services: Advanced Options

4 How can I protect myself from. Image courtesy of Stuart Miles at FreeDigitalPhotos.net Securing ArcGIS Server Services: Advanced Options

5 Lock down Configuration Store and Server Directories ArcGIS account (OS level) Configuration store Systems Admin ArcGIS account (OS level) Server directories Securing ArcGIS Server Services: Advanced Options

6 How can I protect myself from. Image courtesy of Stuart Miles at FreeDigitalPhotos.net Securing ArcGIS Server Services: Advanced Options

7 Use Authentication Use Enterprise from Active Directory or LDAP Disable Primary Site Administrator You can federate an ArcGIS Server site with Portal for ArcGIS Federated server Server site uses Portal s identity store Web Server Portal Web Adaptor Portal for ArcGIS Identity store X Identity store ArcGIS Server site Federated Server A Securing ArcGIS Server Services: Advanced Options

8 Demo Authentication Show how to disable Primary Site Administrator

9

10 How can I protect myself from. Image courtesy of Danilo Rizzuti at FreeDigitalPhotos.net Securing ArcGIS Server Services: Advanced Options

11 Demo Eavesdropping Show how to configure HTTPS

12

13 How can I protect myself from. Image courtesy of Ambro at FreeDigitalPhotos.net Securing ArcGIS Server Services: Advanced Options

14 Demo SQL Injection Show Standardized Queries Help Topic

15 How can I protect myself from. Image courtesy of Stuart Miles at FreeDigitalPhotos.net Securing ArcGIS Server Services: Advanced Options

16 Demo Cross Site Scripting Disable REST Services Directory Configure Allowed Origins

17

18 How can I protect myself from. Image courtesy of iosphere at FreeDigitalPhotos.net Securing ArcGIS Server Services: Advanced Options

19 Demo Denial of Service Service Properties and Security

20

21

22 How can I protect myself from. Image courtesy of Stuart Miles at FreeDigitalPhotos.net Securing ArcGIS Server Services: Advanced Options

23 Backup and Recovery ArcGIS Server Backup Files Data store and configuration backup Server Securing ArcGIS Server Services: Advanced Options

24 What is Backed up? Information included in the backup Service configurations and service properties Server object extensions (SOEs) Registered data store item locations User and role information List of machines in the site Clusters and their lists of machines Log settings Statistics reports Information not included Web Adaptor configurations Data used by your services Cache tiles and tiling schemes Primary site administrator name and password Log messages Geoprocessing job statuses and messages Dynamically generated map images and other temporary output Statistics data Securing ArcGIS Server Services: Advanced Options

25 Summary Review Common Threats Security Configurations Securing ArcGIS Server Services: Advanced Options

26

27 Federal GIS Conference February 9 10, 2015 Washington, DC Don t forget to complete a session evaluation form!

28 Federal GIS Conference February 9 10, 2015 Washington, DC Print your customized Certificate of Attendance! Printing stations located on L St. Bridge, next to registration

29 Federal GIS Conference February 9 10, 2015 Washington, DC Networking Reception: National Museum of American History Tuesday, 6:30 PM 9:30 PM Bus Pickup located on L Street

30 Federal GIS Conference February 9 10, 2015 Washington, DC Interested in diving deeper into Esri technology? Add a day to your Fed GIS experience and register to attend the Esri DevSummit Washington DC. Stop by the registration counter to sign up.