Deployment best practices

    This document covers the measures ManageEngine recommends for hardening a SecureAI deployment, whether administrators access it from your network or remotely.

    How secure deployment works

    Each security measure is configured either in SecureAI or on the server.

    • Logon Settings configures the authentication factors, the CAPTCHA, the login block, and the IP addresses SecureAI answers. These apply as soon as they are saved.
    • Connection Settings configures the protocol, its port, and the session expiry. SecureAI reads all three at startup, so they apply only after a restart.
    • Privacy Settings configures the passwords for exported reports and compressed files. SecureAI applies the configured password when it creates the file, so the password is required to open the file regardless of where it is stored.
    • The server contains the installation directory and the permissions on it.

    Security Hardening reports how much of this is configured as the Product Security Hardening score and alerts you when a recommended measure is missing. The measures are not weighted equally, so the figure is not a count.

    Prerequisites

    Before you start:

    • Log in with a role that has access to Settings, Security and Privacy, and Delegation. The Super Admin role has access to all three. Learn more.
    • Obtain an SSL certificate issued for the hostname that administrators use to access SecureAI. Learn more.
    • Open the port for the protocol you intend to use. SecureAI answers on 8989 for HTTP and 9352 for HTTPS.
    • Arrange access to the SecureAI server, and the rights to stop and start the product there.
    • Collect all IP addresses or ranges from which administrators access SecureAI. An incomplete allowed-IP list can prevent access from omitted addresses.

    Steps to deploy SecureAI securely

    1. Harden the installation directory

    Click Settings > Security and Storage > Security and Privacy > Security Hardening > Learn How beside Secure installation folder permissions. Both measures are carried out on the server.

    • Secure Installation Directory: keep the product in C:\Program Files or C:\Program Files (x86).
    • Verify Folder Permissions: limit the folder to the users and groups that need it.

    Run SecureAI as a Windows service so that it starts with the server. Stop SecureAI, install the SecureAI service using the documented Windows service option, then open Services (services.msc) and start ManageEngine SecureAI.

    2. Secure authentication and login

    • Change the default admin password. Click the account icon > My Account > Change Password.
    • Enable two-factor authentication. Click Delegation > Logon Settings > Two Factor Authentication and turn on Two-Factor Authentication, which offers Google Authenticator, One time password via email, Microsoft Authenticator, and SMS Verification.
    • Click Delegation > Logon Settings > General and select Enable CAPTCHA on login page, then Always show CAPTCHA or Show CAPTCHA after invalid login attempts.
    • Select Block technician after invalid login attempts, then set the Invalid attempts limit, the time period in which failed attempts are counted, and the Block technician for duration.
    • Clear Show Forgot Password? option on login page and Show Log on to option on login page. Select Disable concurrent login and configure Show disclaimer with your organization's disclaimer text. Click Save Settings.
    • Click Delegation > Help Desk Delegation > Help Desk Roles and give each team a role built from the tasks it performs.

    3. Configure network security

    • Click Settings > General Settings > Connection and select HTTPS. If no certificate is configured, click SSL Certificate Tool and apply the issued certificate first.
    • Select a period in Session Expiry Time, which ranges from 10 mins to 2 hrs, then click Save Changes.
    • Click Delegation > Logon Settings > Allow/Restrict IPs, select Enable Allow/Restrict IPs. Choose Allowed IPs to permit only the listed addresses, or Restricted IPs to block the listed addresses. SecureAI accepts IPv4 addresses only, and does not apply the list to the machine it runs on.
    • Restart SecureAI so that the protocol, port, and session expiry changes take effect.

    4. Enable security hardening settings

    • Click Settings > Security & Storage > Security and Privacy > Privacy Settings, select Exported reports and ZIP files (database backup etc..), and enter a password against each. If your organization does not allow usage statistics to be sent, clear Help improve SecureAI by sending us the usage statistics. Click Save.
    • Review the Product Security Hardening score under Security Hardening and address any recommended measure that is still reported as missing.
    • Select Don't show alerts even if the recommended settings are not configured only after any remaining exceptions have been reviewed and documented.

    Example scenario

    An enterprise installs SecureAI on an internal server. Most of its administrators work on the corporate network, and a few reach the product remotely through the company VPN.

    • Permissions on the installation folder belong to the service account and the administrators who manage it.
    • The default admin password has been replaced.
    • SecureAI is accessed over HTTPS, and the HTTP port is closed in the firewall.
    • Two-factor authentication and CAPTCHA are enabled, and a technician is blocked for 30 minutes after five failed logins.
    • The IP address list covers the corporate ranges and the VPN pool.
    • Exported reports and compressed backups are password-protected, and the passwords are stored in the team's credential store.

    Both internal and remote access to SecureAI is then protected, and the protection travels with the files it writes.

    Considerations

    • Securing the installation directory protects the product's own files. Operating system hardening is separate and should follow your organization's server build standards.
    • For an internet-reachable deployment, use HTTPS together with additional access controls appropriate to your environment, such as restricted IP access, a VPN, or an application gateway. Maintain server access while configuring the IP list so you can recover from an accidental lockout.
    • Treat the file passwords as shared credentials, and change them when someone who held one leaves.
    • The hardening figure can fall without anyone configuring SecureAI, because the measures behind it sit with other features and often other teams.