Security hardening checklist
After you install Netwrix Privilege Secure for Access Management (Privilege Secure), review the settings that control how the server is exposed and how it protects secrets. Start with Replace the web console certificate, because the installer creates a self-signed certificate.
| Task | Where to find it |
|---|---|
| Replace the console certificate with one from a trusted certificate authority | Replace the web console certificate |
| Renew the JWT signing certificate | Renew the JWT signing certificate |
| Restrict the SSH algorithms that Privilege Secure offers | Configure SSH algorithms |
| Protect the encryption key in AWS Key Management Service | Protect the encryption key with AWS KMS |
| Prefer HTTPS for WinRM connections by setting WinRM HTTP Setting to Use Https Only. The default, Use Http, connects over HTTP. | Choose HTTP or HTTPS |
| Require strong passwords for local console users | Local User Password |
| Keep the Privilege Secure server off the managed domain | Security Considerations: Non-Domain-Joined Netwrix Privilege Secure Server |
| Give the SQL Server backend only the permissions it needs | Least Privilege Model for SQL Server Backend |