High Security Settings

High Security Settings provide advanced security options for your instance.

This module is activated with the High Security Settings plugin, which is active by default on new instances. If High Security Settings are not active on your instance, you can request activation.

These features are available:

  • Default property values: To harden security on your platform by centralizing all critical security settings to one location for management and auditing.
  • Default deny property: Provides a security manager property to control the default security behavior for table access.
  • Security Administrator role: Provides a role to prevent modification of key security settings and resources. The Security Administrator role is not inherited by the admin role and must be explicitly assigned.
  • Elevated privilege: Allows users with the security admin role to operate in the context of a normal user and elevate to higher security role when needed.
  • Property access control: Allows security administrators to set the roles required to read and write properties.
  • Transaction and system logs: Are read only.
  • Access control rules: Control what data users can access and how they can access it.

High Security Settings automatically activates the Contextual Security plugin, if it is not already active. In addition, Platform Security Settings - High delivers settings and features in the context of increasing the security of your instance.

Upgrade considerations

Warning: This functionality is intended for new instances. Configuring this plugin on an existing instance may cause changes to behavior. Review the upgrade considerations below before enabling.

Before activating High Security Settings on an existing instance:

  1. Review the following information to understand the new behavior:
  2. Enable the plugin on a sub-production instance. A recent clone of production is preferable.
  3. Test the revised functionality, especially the added ACLs and default-deny functionality. Continue testing until the system performs as expected. If users cannot access expected resources, ensure that they have appropriate roles and ACL rules to grant them the access.
  4. Create update sets of any needed changes so you can apply them to production.

Property access control

Two additional columns are created in the Properties [sys_properties] table.

  • read_roles: A comma-separated list of role names that are allowed to read all fields of this property.
  • write_roles: A comma-separated list of role names that are allowed to write/modify all fields of this property.

Properties listed in the Properties table have read_roles of admin and write_roles of security_admin. Users with the admin role can view and read the property values, but must elevate to the security_admin role to modify them.

Notifications

Activation of high security settings also activates security warning messages. The following is an example of a message that appears after an approval.

Figure 1. Security Warning notification
Security Warning notification