Encryption transforms information to make it unreadable to anyone except those possessing a key. Encryption can be performed in a variety of areas of an ArcGIS Solution to help ensure confidentiality. Key areas to think about encryption are:

  • Data in movement
  • Network (Internal LAN and communication with external systems)
  • Data at rest
  • Data Storage managed by the Operating System (File) or database
  • Configuration file settings

Network

SSL

  • SSL is a common encryption mechanism for connecting external clients
  • Between Internal Systems in Advanced Security deployments
    • Client to RDBMS SSL provided by RDBMS via Direct Connect
    • Client to Web Server SSL provided by Web Server typically via port 443
  • Limiting usage of SSL to protect administrative functions
    • Sometimes adequate for Basic Security needs
    • .NET REST API administrator redirect page to SSL
      • Set property  "UseSslForLoginAndAdminin" REST config.properties to true
    • Java REST API Administrator redirect page to SSL
      • Add a "transport-guarantee"

        CONFIDENTIAL security-constraint in the web.xml (which is part of the REST war file)

    • .NET Manager administrator redirect to SSL
      • Property in the Web.config to enable SSL
        • authenticationService enabled="true" requiredSSL="true" 
      • Set IIS website for Manager to require SSL

IPSec

  • Encryption managed independent of application layer
  • Common encryption mechanism for VPN tunnels
  • Between Internal Systems in Advanced Security deployments
    • Configurable at server OS or firewall level

File Based – Data Storage

  • Operating System
    • Low cost implementation, but performance impact can be significant
  • Hardware (Disk)
    • Minimal performance impact, but only recently viable
  • Applications
    • Adobe PDF Encryption can be combined with PKI

File Based – Configuration Settings

Secure database connection strings with Windows Integrated security when possible

  • String only contains server location and DB Name (No password)
  • Encrypt string and store in Registry
  • Use ACL’s for Admin and Process only

By default ArcGIS Server encrypts sensitive information stored in Web.Config files, but when implementing custom applications you will need to ensure sensitive information is encrypted

Sites utilizing Tomcat may store passwords for JDBC data source connections in clear-text in the JNDI resource definition files

  • For Basic security needs, create a class that extends BasicDataSourceFactory and configure it with an encrypted password – See http://java.sys-con.com/node/393364/print
  • For Standard and Advanced security, look into utilizing web application server solutions with security functions built-in
    • JBOSS and the org.jboss.resource.security.SecureIdentityLoginModule is a low cost solution

Database

Transparent Data Encryption (TDE)

  • Low Cost Portable Solution - SQL Express 2008 w/TDE
  • Most database vendors now provide this option
  • Typically only implemented on mobile systems or Advanced Security deployments due to performance impact
  • Operates independently of ArcGIS software
  • There is a noticeable performance impact
Filed under: