Securing a Decisions Installation

Overview

When installing, it is important to consider possible security risks and potential attacks on an instance or environment.

Fortunately, there are a number of ways to secure an installation including:

• Installing with Windows Integrated Security credentials
• Configuring cookies
• Enabling HTTP Strict Transport Security (HSTS)
• Securing TLS
• Displaying exception details
• Excluding specific file extensions
• Protecting against cross-frame scripting and/or clickjacking

Installing with Windows Integrated Security

If a user previously set up MSSQL Server with their Windows authentication credentials, they may use these same credentials to enable Windows Integrated Security on their database connection.

This may be beneficial for system administrators reliant on Windows Integrated Security and for users conducting a local installation.

1. Proceed with installation until the Database Setup and Hosting Options section of the Installation Guide.
2. From the Settings section, define the desired Directory. Enable the Show Service Settings checkbox. Click Next.
   
3. In the Service Settings window, under Service Account select Specify Account.
   
   Input the Windows Username and Password matching the Windows account logged into the installing computer/FileSystem. Click Next.

   

4. From the Database Setup page, select MS SQL for the Database Type. Under Connection Type, select Basic and then enter the corresponding database server and name via DB Server and DB Database respectively.
   
   Under Connection Settings, select Windows Integrated Security. Click Next. 
5. Proceed with the rest of the installation.

Configuring Cookies

Secure Cookies for HTTPS

Secure cookies no longer require configuration in v8. 

If an installation uses HTTPS for web traffic communication, secure cookies are enabled by default. 

Same Site Cookies

1. From the Decisions Server Folder within the default Decisions installation location aka C:\Program Files\Decisions, add the following value to the Settings.xml file.

   <DefaultSameSiteCookieMode></DefaultSameSiteCookieMode>

   
   

2. Enter one of the following text values between the DefaultSameSiteCookieMode tags according to the desired cookie settings.

   Text Value	Cookie Properties
   None	Indicates the client should disable same site restrictions
   Lax	Indicates the client should send the cookie with "same-site requests, and with "cross-site" top-level navigations.
   Strict	Indicates the client should only send the cookie with "same-site" requests.

   
   

Securing Session ID in Logs

If using v8.5+, users can encrypt the Session ID when viewing logs.

1. Run the Decisions Installer and click EDIT SETTINGS.
   
2. Scroll down to ObfuscateSessionIdInLogs and change the value to True.
   
3. Click Save.

Enabling HTTP Strict Transport Security (HSTS)

By using HSTS via response header, a web app can prevent any HTTP communications by forcing only HTTPS communications. This may prevent access to any untrusted or invalid certificates. It also disables prompts asking a user to temporarily trust a certificate.

Method 1

The following instructions configure this for a self-hosted installation.

1. Complete a Decisions installation.
2. Run the installer as an Administrator. Click EDIT SETTINGS.
   
3. Locate the EnableHttp setting and set it to False. 
4. Locate the EnableHttps setting and set it to True. Set the HttpsPort to 443.
5. Locate the EnableHsts setting and set it to True. Click Save to confirm.
6. Restart Decisions via RESTART SERVICE.
   
   

Method 2

1. Navigate to C:\Program Files\Decisions\Decisions Server and open the Settings.xml file.
2. Set the <EnableHsts> value to false.
3. Add the following to the <CustomHeaders> node:

   <CustomHeader>
   <Name>Strict-Transport-Security</Name>
   <Value>max-age=31536000;includeSubDomains</Value>
   </CustomHeader>

4. Save the Settings.xml file.
5. Restart Decisions.

Securing TLS (Transport Layer Security)

1. From Decisions Studio, navigate to System > Settings. Open Integration Settings. 
2. Under SETTINGS > Security Option, select Secure. Click SAVE. 

Show Exception Details

1. From the Decisions Studio, navigate to System > Settings. Open Portal Settings. 
2. Under the PORTAL SETTINGS category, enable the Show Exception Details setting, then click SAVE.

   

Extensions Not Allowed

In this feature, admin users can block certain file type extensions from being imported or used by the users into the Decisions portal.

1. From Decisions Studio, navigate to Portal Settings. Search for extensions in the search bar.
2. To block certain file extensions in Portal, enter them under Extensions Not Allowed.
   Note:

   If the Extensions Not Allowed field is left empty. No files will be blocked, and all the files will be allowed in the instance.
3. The following list details all extensions/executables/scripts that can be restricted by the Extensions Not Allowed setting.

Use Extensions Allowed

In this feature, admin users can allow only certain file type extensions from being imported or used by the users into the Decisions portal.

1. From Decisions Studio, navigate to Portal Settings. Search for extensions in the search bar.
2. Enable Use Extensions Allowed.
3. Enter the List of Extensions under the Extensions Allowed field.
   Note:

   If .zip and .decobj are not mentioned, the Import and Export actions will not work.
   If the Extensions Allowed field is left empty, no files will be allowed in the portal.

Protecting Against Cross-Frame Scripting (XFS) Attacks and Clickjacking

1. Navigate to C:\Program Files\Decisions\Decisions Server and open the Settings.xml as an Administrator.
2. Add the following code before the closing </Settings> tags in the xml.
   
   This tag makes the necessary changes to the Content-Security-Policy by adding custom headers that will embed Decisions with the domain in [BasePortalURL].

   <CustomHeaders>
   	<CustomHeader>
   		<Name>Content-Security-Policy</Name>
   		<Value>frame-ancestors 'self'; default-src 'self'; script-src https://[BasePortalURL] 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' data:; style-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; worker-src 'self' 'unsafe-inline' blob:</Value>
   		<Name>X-Content-Type-Options</Name>
   		<Value>nosniff</Value>
   	</CustomHeader>
   	<CustomHeader>
   		<Name>X-Content-Type-Options</Name>
   		<Value>nosniff</Value>
   	</CustomHeader>
   </CustomHeaders>

   
   

3. Restart the server. If applied correctly, the tags as shown for requests in the Chrome Dev Tools.