Security and privacy

ManageEngine SecureAI writes files that leave the product, and it is reached through a login available to anyone who can reach the server. Security and Privacy covers both. You can require anyone who opens the files SecureAI exports and archives to enter a password first, and choose whether SecureAI sends usage statistics to ManageEngine. It also names the security measures ManageEngine recommends for the deployment and shows which of them are not yet in place.

Use security and privacy to protect what your reporting and backup routines produce, and to keep track of the hardening of the deployment. The passwords and the usage statistics choice are stored here, while each hardening measure is turned on in the feature that owns it.

How it works

Password protection is offered separately for the reports SecureAI exports and for the compressed database backup and audit log archives. Each of the two stores one password, and SecureAI applies it to the file as the file is written. The protection then travels with the file, so the password is entered in whatever opens it and not in SecureAI, and it is asked for wherever the file is taken. Passwords are masked as they are typed and are not displayed again once stored, and one password applies to every file of its kind, product-wide.

Security Hardening holds no settings of its own. It checks each recommended measure in the feature that owns it, the second authentication factor and the login controls in Logon Settings, the connection protocol and the accepted TLS versions in Connection Settings, and the installation directory and its permissions on the server. It then reports the result as the Product Security Hardening figure.

The measures are not treated as equally important, so the figure does not simply count how many are in place, and one measure can move it further than another. SecureAI also raises a Recommended Security Hardening alert while any measure is still missing. The alert carries the same figure, and turning it off is the only change Security Hardening itself saves.

Prerequisites

Complete the following before you configure security and privacy:

• Log in with a role that includes the Security and Privacy permission, because that single permission reveals both the password protection settings and security hardening, and neither can be delegated on its own. Of the roles supplied with SecureAI, Super Admin and Governance Manager include it, but Access Protection does not.
• Decide each password, and plan how it will reach everyone who has to open the files, because SecureAI does not display a stored password again and a protected file cannot be read without it. Hold it in whatever your organization uses to manage shared credentials, and not in a document, a ticket, or the message that carries the file.
• Confirm that whoever will act on the hardening recommendations holds the permissions for Connection Settings and for Logon Settings, because each measure is saved in one of those features rather than in Security and Privacy.
• Arrange access to the server that SecureAI is installed on before you take up the installation folder recommendation, because the directory and its permissions are set outside the product.
• Check whether your organization allows product usage data to be sent to ManageEngine before you leave the usage statistics option as it stands, because SecureAI selects it until someone clears it.

Configuration instructions

Security and privacy holds two sets of settings, and each is saved on its own.

• Privacy settings
• Security hardening

Privacy settings

1. Navigate to Settings > Security & Storage > Security and Privacy > Privacy Settings.
2. Under Enable Password Protection, select each kind of file that has to be protected and enter a password for it. A password can be entered only once the option it belongs to is selected, and it is masked as you type.
   • Exported reports: The reports SecureAI exports.
   • ZIP files: The compressed database backup and audit log archives.
3. Clear Help improve SecureAI by sending us the usage statistics to stop SecureAI sending usage data to ManageEngine. SecureAI has this selected by default.
4. Click Save to save the changes. Click Cancel to leave the values as they are without saving.

Security hardening

1. Navigate to Settings > Security & Storage > Security and Privacy > Security Hardening.
2. The Product Security Hardening figure reports how much of the recommended hardening SecureAI finds in place.
3. Work through the recommendations that are not yet in place. Three of them, Change default admins password, Enforce two-factor authentication, and Enforce HTTPs, are marked Recommended. Most carry a control that displays the logon settings or the connection settings where the measure is actually set. Two behave differently. The Change default admins password recommendation reports Changed once the default password has been replaced and is satisfied outside security hardening. The Secure installation folder permissions recommendation offers documentation for the server rather than a setting.
   • Change default admins password: The account with which SecureAI is installed.
   • Enforce two-factor authentication: Log in with a second authentication factor.
   • Enforce HTTPs: Traffic between the browser and SecureAI.
   • Enforce secure TLS: The TLS versions the server accepts by disabling v1.0 and v1.1.
   • Enable CAPTCHAs: Adds a CAPTCHA to the login, to blunt brute-force attempts.
   • Block invalid login attempts: Accounts under repeated failed logins.
   • Secure installation folder permissions: The installation directory on the server.
4. Select Don't show alerts even if the recommended settings are not configured to stop the Recommended Security Hardening alert. The choice is stored as soon as you select it, with no separate save required.

Tips

• Record which password was in force when each backup set was written. A backup taken under an earlier password still needs that password, and SecureAI does not report which password applies to which backup.
• The figure can fall without anyone opening Security and Privacy, because it reflects settings that are changed elsewhere, often by another team. Check Connection Settings and Logon Settings for a recent change before treating a drop as a fault.
• SecureAI does not show which recommendations raise the figure most, and the order they appear in is not a priority order. Choose what to take on first on security grounds, not from the order on screen.