Skip to main content

Managing the Passwords

Password Management Features​

1. Single Sign-On (SSO):

SSO eliminates the need for users to remember multiple passwords for different applications and services, thereby reducing password fatigue and improving user experience. IDHub offer robust SSO functionality, integrating seamlessly with diverse applications and platforms. This centralized authentication streamlines access and strengthens security by eliminating the risk of password reuse across multiple accounts.

2. Multi-Factor Authentication (MFA):

MFA adds an extra layer of security beyond passwords, requiring users to provide additional verification factors like biometrics, one-time passwords, or security tokens. IDHub offers a variety of MFA options, catering to different user preferences and security needs. This multi-layered approach significantly reduces the risk of unauthorized access even if a user's password is compromised.

3. Password Complexity Enforcement:

IDHub can enforce password complexity requirements to ensure users create strong and difficult-to-crack passwords. This includes setting minimum password length, requiring a mix of character types, and prohibiting dictionary words or personal information. By enforcing strong password policies, IAM solutions help mitigate the risks associated with weak passwords.

5. Password Expiration and Rotation:

IDHub can require users to change their passwords periodically, further mitigating the risks of password compromise. This feature can be configured to specific timeframes based on organizational security policies. By enforcing regular password changes, IDHub helps ensure passwords remain secure even if they are exposed inadvertently.

6. Password Vaulting via KeyCloak:

IDHub offers secure password vaulting functionality, allowing users to store their passwords in a centralized and encrypted location in KeyCloak. This eliminates the need for users to store passwords in insecure locations like plain text files or personal documents. Password vaults are often integrated with SSO and MFA, providing convenient and secure access to all user passwords.

7. Password Auditing and Reporting:

IDHub can generate comprehensive reports on password usage, strength, and compliance with organizational policies. This allows administrators to identify weak passwords, potential security vulnerabilities, and enforce password hygiene practices. By providing actionable insights into password management, IDHub empower organizations to proactively address security risks.

Connector Credential Security​

IDHub utilizes the Spring Security Crypto Module to implement robust encryption. Specifically, we employ Encryptors.stronger() to create a BytesEncryptor with the following specifications:

  • Algorithm: 256-bit Advanced Encryption Standard (AES) in Galois Counter Mode (GCM)
  • Key Derivation: Password-Based Key Derivation Function 2 (PBKDF2)
  • Initialization Vector: 16-byte random value for enhanced security

Context and Significance​

The Encryptors.stronger() method is part of the Spring Security framework, which is widely recognized for its robust security implementations. By using this method, IDHub leverages a well-tested and industry-standard approach to encryption.

  • BytesEncryptor: This interface provides methods for encrypting and decrypting byte arrays, which is ideal for securing various types of sensitive data, including credentials and configuration information.
  • AES-GCM: This combination of AES encryption with Galois Counter Mode provides both confidentiality and authenticity, making it highly resistant to tampering and unauthorized decryption attempts.
  • PBKDF2: This key derivation function adds an extra layer of security by deriving the encryption key from a passphrase. It uses a computationally intensive process that helps protect against brute-force and dictionary attacks.
  • Random Initialization Vector: The use of a random IV for each encryption operation ensures that identical plaintext values will produce different ciphertext, significantly enhancing security against pattern analysis attacks.

This encryption standard is applied consistently across IDHub's infrastructure, ensuring that all sensitive data, including connector credentials, are protected with the same high level of security.

Encryption Process​

  1. Encryption:
  • The encryption key is derived using the 256-bit AES encryption with GCM algorithm.
  • The sensitive value is encrypted using this key and a randomly generated IV.
  • The encrypted value is securely stored within the application's file system.
  1. Decryption:
  • The encrypted value is retrieved from secure storage.
  • It is decrypted using the 256-bit AES encryption with GCM algorithm and the passphrase.
  • This process ensures that only authorized parties with the correct passphrase can access the original sensitive data.

Principle of Least Privilege​

  • Utilization of least-privileged service accounts for workload operations
  • Regular review and adjustment of access permissions

Audit and Monitoring​

  • Comprehensive audit logging for all system actions
  • Real-time monitoring and alerting for suspicious activities

Container Security​

Data Storage​

  • Use of volume abstraction for persistent data storage
  • Enhanced control over data encryption, backup, and restoration

Vulnerability Management & Image scanning​

  • Proactive scanning of container images for known vulnerabilities
  • Regular updates and patches to address security issues

Runtime Security​

  • Implementation of container runtime security measures
  • Continuous monitoring of container behavior for anomaly detection
  • Containers are isolated at the network level, preventing unauthorized access and lateral movement within the environment.

Advanced Security Considerations​

Passphrase and Salt Management​

  • Secure storage and management of encryption passphrases
  • Generation and secure storage of random salts to prevent dictionary attacks

Key Rotation and Management​

  • Regular rotation of encryption keys
  • Secure key management practices, including separation of duties and access controls

Compliance and Standards​

  • Adherence to industry standards such as NIST, ISO 27001, and GDPR
  • Regular security assessments and compliance audits