Securing a Decisions Installation
  • 28 Dec 2022
  • 4 Minutes to read
  • Dark

Securing a Decisions Installation

  • Dark


When installing, it is important to consider possible security risks and potential attacks on an instance or environment.

Fortunately, there are a number of ways to secure an installation including:

Installing with Windows Integrated Security

If a user previously set up MSSQL Server with their Windows authentication credentials, they may use these same credentials to enable Windows Integrated Security on their database connection.

This may be beneficial for system administrators reliant on Windows Integrated Security and for users conducting a local installation.

  1. Proceed with installation until the Database Setup and Hosting Options section of the Installation Guide.
  2. From the Settings section, define the desired Directory. Enable the Show Service Settings checkbox. Click Next.
  3. In the Service Settings window, under Service Account select Specify Account.

    Input the Windows Username and Password matching the Windows account logged into the installing computer/FileSystem. Click Next.

  4. From the Database Setup page, select MS SQL for the Database Type. Under Connection Type, select Basic and then enter the corresponding database server and name via DB Server and DB Database respectively.

    Under Connection Settings, select Windows Integrated Security. Click Next. 
  5. Proceed with the rest of the installation.

Configuring Cookies

Secure Cookies for HTTPS

Secure cookies no longer require configuration in v8. 

If an installation uses HTTPS for web traffic communication, secure cookies are enabled by default. 

Same Site Cookies

  1. From the Decisions Server Folder within the default Decisions installation location aka C:\Program Files\Decisions, add the following value to the Settings.xml file.

  2. Enter one of the following text values between the DefaultSameSiteCookieMode tags according to the desired cookie settings.
    Text ValueCookie Properties
    NoneIndicates the client should disable same site restrictions
    LaxIndicates the client should send the cookie with "same-site requests, and with "cross-site" top-level navigations.
    StrictIndicates the client should only send the cookie with "same-site" requests.

Securing Session ID in Logs

If using v8.5+, users can encrypt the Session ID when viewing logs.

  1. Run the Decisions Installer and click EDIT SETTINGS.
  2. Scroll down to ObfuscateSessionIdInLogs and change the value to True.
  3. Click Save.

Enabling HTTP Strict Transport Security (HSTS)

Available in v8.1+
If interested in upgrading, review the Upgrading section and consult

By using HSTS via response header, a web app can prevent any HTTP communications by forcing only HTTPS communications. This may prevent access to any untrusted or invalid certificates. It also disables prompts asking a user to temporarily trust a certificate.

Method 1

The following instructions configure this for a self-hosted installation.

  1. Complete a Decisions installation.
  2. Run the installer as an Administrator. Click EDIT SETTINGS.
  3. Locate the EnableHttp setting and set it to False. 
  4. Locate the EnableHttps setting and set it to True. Set the HttpsPort to 443.
  5. Locate the EnableHsts setting and set it to True. Click Save to confirm.
  6. Restart Decisions via RESTART SERVICE.

Method 2

  1. Navigate to C:\Program Files\Decisions\Decisions Server and open the Settings.xml file.
  2. Set the <EnableHsts> value to false.
  3. Add the following to the <CustomHeaders> node:
  4. Save the Settings.xml file.
  5. Restart Decisions.
Setting Custom Header for Containerised Instance
For containerised instances, the custom header can be set by adding DECISIONS_CUSTOMHEADERS=[{"Name": "Strict-Transport-Security","Value": "max-age=31536000;includeSubDomains"}] to the environment variable file.

Securing TLS (Transport Layer Security)

  1. From Decisions Studio, navigate to System > Settings. Open Integration Settings
  2. Under SETTINGS > Security Option, select Secure. Click SAVE. 

Show Exception Details

The Show Exception Details setting displays exception details within the Portal and is enabled by default. To locate this setting:

  1. From the Decisions Studio, navigate to System > Settings. Open Portal Settings
  2. Under the PORTAL SETTINGS category, enable the Show Exception Details setting, then click SAVE.

Extensions Not Allowed

In this feature, admin users can block certain file type extensions from being imported or used by the users into the Decisions portal.

  1. From Decisions Studio, navigate to Portal Settings. Search for extensions in the search bar.
  2. To block certain file extensions in Portal, enter them under Extensions Not Allowed.
    If the Extensions Not Allowed field is left empty. No files will be blocked, and all the files will be allowed in the instance.
  3. The following list details all extensions/executables/scripts that can be restricted by the Extensions Not Allowed setting.
File ExtensionFile Type 
.asaASP Declarations file
.ashxASP.NET Web handler file. Web handlers are software modules that handle Raw HTTP requests received by ASP.NET.
.asmxASP.NET Web Services source file
.asp/,aspxActive Server Page files 
.bat Batch file
.chmCompiled HTML Help file 
.cmdMicrosoft Windows NT command script
.comMicrosoft MS-DOS program
.dllWindows dynamic-link library
.exeExecutable file 
.gadgetWindows Gadget
.hlpHelp file
.htaHTML program 
.htr Script file
.htwHTML document
.msc Microsoft Common Console document 
.mshMicrosoft Agent Script helper
.msh1 Microsoft Agent Script helper
.msh1xmlMicrosoft Agent Script helper
.msh2Microsoft Agent Script helper 
.msh2xmlMicrosoft Agent Script helper
.mshxmlMicrosoft Agent Script helper
.msiMicrosoft Windows Installer package file 
.mspWindows Installer Update package file 
.pifShortcut to MS-DOS program
.plPerl script
.prfSystem file
.prgProgram Source file
.ps1 Windows PowerShell cmdlet file
.ps1xmlWindows PowerShell Display configuration file
.ps2 Windows PowerShell cmdlet file 
.ps2xmlWindows PowerShell Display configuration file
.psc1Windows PowerShell Console file
.psc2 Windows PowerShell Console file
.rarCompressed file
.regRegistration entries 
.remACT! Database maintenance file
.scfWindows Explorer command file
.sfxCompressed file 
.shbWindows shortcut 
.shtmHTML file that contains Server-Side directives
.shtmlHTML file that contains Server-Side directives 
.stmHTML file that contains Server-Side directives 
.svc Windows Communication Foundation (WCF) Service file
.urlUniform Resource Locator (Internet shortcut) 
.vbeVBScript Encoded Script file
.vbs VBScript file
.zipCompressed file

Use Extensions Allowed

In this feature, admin users can allow only certain file type extensions from being imported or used by the users into the Decisions portal.

  1. From Decisions Studio, navigate to Portal Settings. Search for extensions in the search bar.
  2. Enable Use Extensions Allowed.
  3. Enter the List of Extensions under the Extensions Allowed field.
    If .zip and .decobj are not mentioned, the Import and Export actions will not work.
    If the Extensions Allowed field is left empty, no files will be allowed in the portal.

Protecting Against Cross-Frame Scripting (XFS) Attacks and Clickjacking

  1. Navigate to C:\Program Files\Decisions\Decisions Server and open the Settings.xml as an Administrator.
  2. Add the following code before the closing </Settings> tags in the xml.

    This tag makes the necessary changes to the Content-Security-Policy by adding custom headers that will embed Decisions with the domain in [BasePortalURL].
    		<Value>frame-ancestors 'self'; default-src 'self'; script-src https://[BasePortalURL] 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' data:; style-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; worker-src 'self' 'unsafe-inline' blob:</Value>

  3. Restart the server. If applied correctly, the tags as shown for requests in the Chrome Dev Tools.

For further information on Installation, visit the Decisions Forum.

Was this article helpful?