Securing your deployment

To harden your PEM deployment against attack, consider the following measures:

• Ensure PEM, your operating system, and third-party libraries are regularly updated. Without the most recent security patches, your system is vulnerable to cyberattacks. See Dependencies of the PEM Server and Agent on Linux to learn more about the system packages used by PEM.

• Ensure the Postgres instance used as the PEM server is kept up to date and apply Postgres security best practices .

• Secure the web server .

• Configure the security settings of the PEM web application as appropriate.

• Web server security configuration
  • Recommendations applied by default
    • Disable insecure SSL and TLS protocols
    • Disable web server information exposure
    • Disable directory listing
    • Cross-site tracing
  • Optimize HTTP headers for security
    • X-Frame-Options
    • Content-Security-Policy
    • Strict-Transport-Security
    • X-Content-Type-Options
    • X-XSS-Protection
    • Cookie security
  • Additional recommendations that can be applied manually
    • Secure HTTPD with SSL certificates
    • Run the web server from a non-privileged user account
• PEM application security configurations
  • Session timeout
  • RestAPI header customization
    • PEM_HEADER_SUBJECT_TOKEN_KEY
    • PEM_HEADER_TOKEN_KEY
    • PEM_TOKEN_EXPIRY
  • Role-based access control in PEM
  • Password management
  • Run PEM agent jobs with a non-root user
  • Changing the PEM agent and PEM backend database server certificates