Securing your deployment

When you configure PEM, there are security practices to consider. These security practices are optional. However, EDB recommends these practices to enhance the overall system security.

PEM depends on third-party components from the vendor repository, including the Apache web server, OpenSSL, snmp++, and libcurl. To ensure these components are up to date, update your operating system and regularly apply security updates to avoid any security vulnerability. Without the most recent security patches, your system is vulnerable to cyberattacks. Security patches protect your devices and their data by applying the latest updates to guard against the latest threats.

Some of the benefits of regularly applying security patches include:

• Reducing exposure to cyberattacks

• Avoiding lost productivity

• Protecting data from malware like ransomware

• Avoiding worm infections that use security loopholes to spread over the network

• Apache HTTPD security configurations
  • Disable SSLv2 and SSLv3
  • Secure HTTPD with SSL certificates
  • Disable web server information exposure
  • Disable directory listing
  • Restrict the access to a network or IP address
  • Cross-site tracing
  • Run web server from a nonprivileged user account
  • Customize security HTTP headers in PEM web server
  • Host header injection attacks
    • X-Frame-Options
    • Content-Security-Policy
    • Strict-Transport-Security
    • X-Content-Type-Options
    • X-XSS-Protection
    • Cookie security
• PEM application security configurations
  • Session timeout
  • RestAPI header customization
    • PEM_HEADER_SUBJECT_TOKEN_KEY
    • PEM_HEADER_TOKEN_KEY
    • PEM_TOKEN_EXPIRY
  • Role-based access control in PEM
  • SQL/Protect plugin
  • Password management
  • Run pemAgent jobs with a non-root user
  • Changing the pemAgent and PEM backend database server certificates