Securing a Decisions Installation

Overview

When installing, it is important to consider possible security risks and potential attacks on an instance or environment.

Fortunately, there are a number of ways to secure an installation including:

• Installing with Windows Integrated Security credentials
• Configuring cookies
• Enabling HTTP Strict Transport Security (HSTS)
• Securing TLS
• Displaying exception details
• Excluding specific file extensions
• Protecting against cross-frame scripting and/or clickjacking
  
  

Installing with Windows Integrated Security

If a user previously set up MSSQL Server with their Windows authentication credentials, they may use these same credentials to enable Windows Integrated Security on their database connection.

This may be beneficial for system administrators reliant on Windows Integrated Security and for users conducting a local installation.

1. Proceed with installation until the Database Setup and Hosting Options section of the Installation Guide.
2. From the Settings section, define the desired Directory. Enable the Show Service Settings checkbox. Click Next.
   
3. In the Service Settings window, under Service Account select Specify Account.
   
   Input the Windows Username and Password matching the Windows account logged into the installing computer/FileSystem. Click Next.

   
   

4. From the Database Setup page, select MS SQL for the Database Type. Under Connection Type, select Basic and then enter the corresponding database server and name via DB Server and DB Database respectively.
   
   Under Connection Settings, select Windows Integrated Security. Click Next. 
5. Proceed with the rest of the installation.
   
   

Configuring Cookies

Secure Cookies for HTTPS

Secure cookies no longer require configuration in v8. 

If an installation uses HTTPS for web traffic communication, secure cookies are enabled by default. 

Same Site Cookies

1. From the Decisions Server Folder within the default Decisions installation location aka C:\Program Files\Decisions, add the following value to the Settings.xml file.

   <DefaultSameSiteCookieMode></DefaultSameSiteCookieMode>

   
   

2. Enter one of the following text values between the DefaultSameSiteCookieMode tags according to the desired cookie settings.

   Text Value	Cookie Properties
   None	Indicates the client should disable same site restrictions
   Lax	Indicates the client should send the cookie with "same-site requests, and with "cross-site" top-level navigations.
   Strict	Indicates the client should only send the cookie with "same-site" requests.

   
   

Enabling HTTP Strict Transport Security (HSTS)

By using HSTS via response header, a web app can prevent any HTTP communications by forcing only HTTPS communications. This may prevent access to any untrusted or invalid certificates. It also disables prompts asking a user to temporarily trust a certificate.

The following instructions configure this for a self-hosted installation.

1. Complete a Decisions installation.
2. Run the installer as an Administrator. Click EDIT SETTINGS.
   
   
3. Locate the EnableHttp setting and set it to False. 
4. Locate the EnableHttps setting and set it to True. Set the HttpsPort to 443.
5. Locate the EnableHsts setting and set it to True. Click Save to confirm.
6. Restart Decisions via RESTART SERVICE.
   
   

Securing TLS (Transport Layer Security)

1. From Decisions Studio, navigate to System > Settings. Open Integration Settings. 
2. Under SETTINGS > Security Option, select Secure. Click SAVE. 

Show Exception Details

1. From the Decisions Studio, navigate to System > Settings. Open Portal Settings. 
2. Under the PORTAL SETTINGS category, enable the Show Exception Details setting, then click SAVE.

   
   

Excluding File Extensions

Excluding file extensions limit the allowed file types within an instance, thus protecting users from the threat of potentially harmful, unknown files. 

1. From Decisions Studio, navigate to System > Settings > Portal Settings.
2. Navigate to the GLOBALIZATION SETTINGS category. 
3. Under Extensions Not Allowed, enter the file extensions to exclude within the text box. Click SAVE to confirm.

Excluded Extensions List

The following list details all extensions/executable/scripts that can be restricted by the Extensions Not Allowed setting.

Protecting Against Cross-Frame Scripting (XFS) Attacks and Clickjacking

1. Navigate to C:\Program Files\Decisions\Decisions Server and open the Settings.xml as an Administrator.
2. Add the following code before the closing </Settings> tags in the xml.
   
   This tag makes the necessary changes to the Content-Security-Policy by adding custom headers that will embed Decisions with the domain in [BasePortalURL].

   <CustomHeaders>
   	<CustomHeader>
   		<Name>Content-Security-Policy</Name>
   		<Value>frame-ancestors 'self'; default-src 'self'; script-src https://[BasePortalURL] 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' data:; style-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; worker-src 'self' 'unsafe-inline' blob:</Value>
   		<Name>X-Content-Type-Options</Name>
   		<Value>nosniff</Value>
   	</CustomHeader>
   	<CustomHeader>
   		<Name>X-Content-Type-Options</Name>
   		<Value>nosniff</Value>
   	</CustomHeader>
   </CustomHeaders>

   
   

3. Restart the server. If applied correctly, the tags as shown for requests in the Chrome Dev Tools.