Understanding the global requirements

  • The server on which the Stormshield KMaaS is installed must be healthy. There must be an information system security policy whose requirements are met on the servers. This policy shall verify the installed software is regularly updated and the system is protected against viruses and spyware or malware (firewall properly configured, antivirus updates, etc.). It is imperative to follow the operating system security recommendations issued by the ANSSI in their document ANSSII-BP-028-EN.

  • Access to the administrative functions of the workstation system is restricted only to system administrators.

  • The operating system must manage the logs generated by the product in accordance with the security policy of the company. It must for example restrict read access to these logs to only those explicitly permitted. For more information, see the section Managing logs.

  • You must set up a system upstream of the Stormshield KMaaS to protect against distributed denial-of-service (DDoS) and brute-force attacks. Please follow the ANSSI recommendations (French only).

  • You must filter incoming requests upstream of the Stormshield KMaaS. Only requests meeting the following conditions should be accepted:

    • The request header size must be smaller than the NodeJS default value. See the NodeJS documentation.

    • The size of the request body must be less than 1 MB.

  • The Stormshield KMaaS must be installed on a server whose system and contributions are kept up to date.

  • The server hosting the solution must be located in a secure physical environment with access control protocols and must be trusted.

  • The Stormshield KMaaS administrators are considered as trusted. They are responsible for defining the Stormshield KMaaS security policy by respecting the state of the art.

  • The system administrator responsible is also considered as trusted. He/She is responsible for the installation and maintenance of the application and server. He/She applies the security policy defined by the Stormshield KMaaS administrators.

The content of the requests processed by the Stormshield KMaaS is in JSON format, except for the /simpleenroll route. You can add the following rules to your web firewall (WAF) or load balancer to ensure optimum protection.

  • You must block all HTTP requests except:

    • The POST requests with a Content-Type header containing "application/json".

    • The GET and OPTIONS requests without a Content-Type header or with a Content-Type header containing "application/json".

  • Be sure to open the following network streams for the modules you use:

    Route

    Origin wildcard

    (* = all URLs are allowed)

    		 Allowed method Module
    /health * GET All
    /api/v1/<tenant_id>/crypto/decrypt * POST Crypto API
    /api/v1/<tenant_id>/crypto/encrypt * POST Crypto API
    /api/v1/<tenant_id>/.well-known/est/simpleenroll * POST PKI
    /api/v1/<tenant_id>/certs * GET KACLS
    /api/v1/<tenant_id>/delegate .google.com POST KACLS
    /api/v1/<tenant_id>/digest .google.com POST KACLS
    /api/v1/<tenant_id>/status * GET KACLS
    /api/v1/<tenant_id>/privatekeydecrypt .google.com POST KACLS
    /api/v1/<tenant_id>/privatekeysign .google.com POST KACLS
    /api/v1/<tenant_id>/privilegedprivatekeydecrypt * POST KACLS
    /api/v1/<tenant_id>/privilegedunwrap * POST KACLS
    /api/v1/<tenant_id>/privilegedwrap * POST KACLS
    /api/v1/<tenant_id>/rewrap .google.com POST KACLS
    /api/v1/<tenant_id>/unwrap .google.com POST KACLS
    /api/v1/<tenant_id>/wrap .google.com POST KACLS
    /api/v1/<tenant_id>/wrapprivatekey * POST KACLS
    /api/v1/<tenant_id>/kas/decrypt * POST KAS
    /api/v1/<tenant_id>/kas/encrypt * POST KAS
    /api/v1/<tenant_id>/kas/rewrap * POST KAS
    /api/v1/{tenantid}/dke/{keyId} * GET DKE
    /api/v1/{tenantid}/dke/{keyId}/{versionId}/Decrypt * POST DKE

  • On all the routes that you use, activate the OPTIONS method, that enforces the across-origin resource sharing (CORS).