Home
Security
Configure different security features to adequately protect business assets and resources in the data model when using BigFix Inventory.
Configuring passwords and encryption mechanisms
To improve the application security, define a security policy for user passwords. You can also configure passwords and encryption mechanisms for the keystore in which the passwords are stored, and the BigFix Inventory database.
Configuring security policy for user passwords
Available from 9.2.7. If your company has a security policy for user passwords, or you want to improve the application security, you can configure BigFix Inventory to require that user passwords fulfill the policy requirements.

Security
Configure different security features to adequately protect business assets and resources in the data model when using BigFix Inventory.
- Flow of data
  There are several different interactions that occur between the components of the BigFix Inventory infrastructure and between the user and tool.
- Security configuration scenarios
  Check what security options need to be enabled on the BigFix server and the BigFix Inventory server to achieve each of the supported security scenarios.
- Configuring database connection encryption
  You can encrypt the connection between BigFix Inventory server and the BigFix Inventory database. Encryption is established between BigFix Inventory server and the database engine using a JDBC driver. You can encrypt the connection while upgrading the server.
- Configuring secure communication
  To ensure secure communication, BigFix Inventory uses public key cryptography, which is based on algorithms that use two separate keys, a private key and a public key. This key pair is used to encrypt and decrypt communication
- Assuring compliance with federal encryption standards
  You can configure BigFix Inventory to be compliant with the Federal Information Processing Standard requirements that are related to encryption.
- Authenticating users with LDAP
  BigFix Inventory supports authentication through a Lightweight Directory Access Protocol (LDAP) server. To use this feature, you must configure the BigFix Inventory server.
- Configuring and enabling single sign-on (SSO)
  Available from 9.2.1. You can now use the two-factor authentication and use SSO to log on to BigFix Inventory and maintain login consistency with other applications in the enterprise. You can configure BigFix Inventory to use two-factor authentication with single sign-on based either on the exchange of Security Assertion Markup Language (SAML 2.0) token and Microsoft™ Active Directory Federation Services as Identity Provider or you can use the IBM Lightweight Third-Party Authentication (LTPA) technology and IBM Security Access Manager for Web as the authentication service.
- Configuring passwords and encryption mechanisms
  To improve the application security, define a security policy for user passwords. You can also configure passwords and encryption mechanisms for the keystore in which the passwords are stored, and the BigFix Inventory database.
  - Configuring security policy for user passwords
    Available from 9.2.7. If your company has a security policy for user passwords, or you want to improve the application security, you can configure BigFix Inventory to require that user passwords fulfill the policy requirements.
  - Configuring cryptographic keystore password and encryption
    Configure a unique password to the cryptographic keystore, and encrypt it with the AES encryption algorithm.
  - Configuring database password encryption
    Change the configuration of your locally stored database password to improve application security. Encrypt the password using AES encryption algorithm. This solution does not apply if you use Windows Authentication for the database access.
  - Improving security of storing VM manager passwords
    Available from 9.2.9. To improve security of storing passwords to VM managers, you can overwrite the default key that is used to encrypt the passwords or change the default password to the VM Manager tool keystore. These two procedures are independent. You can change the encryption key, the keystore password or both, depending on your needs.
  - Changing the default secret key and password to the SAP Metric Data Collector keystore
    Available from 9.2.9. To improve security of encrypting the password to the SAP Metric Data Collector, you can change the default secret key or the default password to the SAP Metric Data Collector keystore. These two procedures are independent. You can change the secret key, the keystore password or both depending on your needs.
- Configuring user account lockout
  Available from 9.2.8. By default, user account is locked for 5 minutes after the user attempts to log in to BigFix Inventory more than 10 times within 5 minutes. You can change the default settings or disable the user account lockout.
- Configuring VM Manager tool to accept trusted VM manager certificates
  By default, the VM Manager tool accepts all VM manager certificates regardless of whether they are trusted or not. You can change the default behavior to ensure that only trusted certificates are accepted by the VM Manager tool.
- Relays
  Relays lighten both upstream and downstream burdens on the server. Rather than communicating directly with a server, clients can instead be instructed to communicate with designated relays, considerably reducing both server load and client and server network traffic.

Configuring security policy for user passwords

Available from 9.2.7. If your company has a security policy for user passwords, or you want to improve the application security, you can configure BigFix Inventory to require that user passwords fulfill the policy requirements.

Before you begin

Starting from application update 9.2.7, user passwords must fulfill the following default requirements:

Must be at least 8 characters long
Must contain at least one lowercase character, one uppercase character, and one digit

If you upgraded from an earlier version and a user password does not fulfill these requirements, it remains valid until the user changes it. The new password must fulfill the default requirements. Similarly, if you introduce a password policy, existing passwords that do not meet the requirements remain valid until the next time they are changed.

Procedure

Go to Management > Advanced Server Settings.
Define requirements for user passwords.
- To specify the minimal length of the password, set the user_password_min_length parameter. For example:
```
user_password_min_length = 8
```
- To specify the maximal length of the password, set the user_password_max_length parameter. For example:
```
user_password_max_length = 16
```
- To set a limit on the number of the same characters that can be used in a row, set the user_password_max_of_identical_characters_in_row parameter. For example:
```
user_password_max_of_identical_characters_in_row = 3
```
- To specify that at least one special character must be used, provide the list of acceptable characters in the user_password_special_characters parameter. For example:
```
user_password_special_characters = ?!%&
```
- To specify other requirements such as the need to use at least one uppercase character, create a regular expression that defines the requirement, and provide it in the user_password_regular_expression parameter. For example:
```
user_password_regular_expression = ^(?=.*[A-Z]).+$
```
Tip: To learn more about each parameter, see: Advanced server settings.