Hardening the operating system

Bravura Security recommends that organizations follow their standard operating patching processes to promptly download and install all vendor-supplied patches for the OS, DB and web server, as these often address security problems. In Bravura Security's experience, there has never been a compatibility problem with Bravura Security Fabric caused by such automated patching.

One way to limit the number of users who can access the Bravura Security Fabric server is to remove it from any Windows domain. If the Bravura Security Fabric server is not a member of a domain, it reduces the risk of a security intrusion in the domain being leveraged to gain unauthorized access to the Bravura Security Fabric server.

For any accounts that must remain, limit their access. At a minimum, block access by members of ’Everyone’ to files and folders on the server.

Disable any unused service. This eliminates potential sources of software bugs that could be exploited to violate the server’s security.

Only the following Windows services are required on Bravura Security Fabric servers:

Additional services should only be enabled if there is a specific need for them.

Open ports are an exploitable means of system entry. Limiting the number of open ports effectively reduces the number of potential entry points into the server. A server can be port scanned to identify available services.

Use packet filtering to block all inbound connections other than the following default ports required by Bravura Security Fabric: