Password Manager Pro Security Specifications

Overview

Password Manager Pro deals with administrative passwords that offer secure access to enterprise credentials and devices. Any compromise on the security of these passwords will expose organizations to serious risks. Therefore, we've designed Password Manager Pro, to offer maximum security right from the application installation to user authentication, data transmission, storage, and throughout the usage work flow.

Besides the following security measures,we continuously strive to make the application more secure. This document briefly provides details about the security specifications of the product.

Security at Various Levels

Password Manager Pro protects data at various levels and is classified into the following categories:

Security Features

1. Vaulting Mechanism: Secure by Design

1.1. Installation Master Key

• Password Manager Pro uses AES-256 encryption (the strongest known encryption that the US government has approved). The key used for encryption is auto-generated and is unique for every installation. This serves as the first-level encryption key.


• The first-level encryption key is not allowed to be kept with the Password Manager Pro installation. This is done to ensure that the encryption key and the encrypted data, in both live and backed-up databases, do not reside together.


• The recommended setup is to store the key in a physically separate server or device and ensure that it is available to the server during application start-up. Subsequently, the key is held only in the server memory and never written anywhere.


• Password Manager Pro also supports periodic rotation of the encryption key, where a new key is generated and applied to the existing data and then the old key is discarded. More info.

1.2. Database Key

• The Password Manager Pro database is secured through a separate key, which is auto-generated and unique for every installation.


• The key for the database can be stored securely within Password Manager Pro.


• Password Manager Pro also allows users to store the database key in any secured location, leaving the key accessible to only the server.


• The RDBMS is always configured to accept only secure connections (forces SSL mode for client connections) and clients can connect only from the same local host. In cases where the web server and the RDBMS have to reside in separate servers, the configuration enforces connections only from configured IP addresses.

1.3. FIPS-compliant Mode

• Password Manager Pro can be set up to run in the FIPS 140-2-compliant mode (with SQL server back end) where all encryption is done through FIPS 140-2-certified systems and libraries.

1.4. Multi-tenant Architecture (MSP Edition)

• Password Manager Pro provides MSP edition for secure data segmentation between departments or in the case of MSP customers, between their customers. The segmentation is implemented at the level of database rows in the RDBMS.


• Each department or customer that requires data segmentation is provided a value range for the unique identity for each row. All database operations performed for that department or customers is automatically restricted to that value range. For more details, click here.



Fig 1. Product Architecture

2. Identification and Authentication

2.1. Strong Application Level Authentication - Various Options

Password Manager Pro provides four options for uniquely identifying the users who will be accessing the application. All the options are complemented by various two-factor authentication provisions, which provide an extra layer of security.

• Integration with identity stores: Password Manager Pro readily integrates with external identity stores like Microsoft Active Directory, any LDAP-compliant directory service (Novell eDirectory and Oracle OID), and RADIUS. Users can be imported from identity stores and the respective authentication mechanism can be leveraged. Users will be uniquely identified through their respective accounts in the identity store. More info.


• Unique accounts and strong local authentication: Password Manager Pro comes with a local authentication mechanism in which unique accounts are created for users. Users will be able to access the application with their credentials. Password Manager Pro employs SHA2 algorithm to generate passwords, which ensures that each login password is unique and irreversibly secured.


• Common access card: Password Manager Pro supports smart card authentication - the user must possess the smart card and know the personal identification number (PIN) as well. For more details, click here.


• Enforced password resets for local authentication. As a security precaution, Password Manager Pro requires the user to reset the local authentication password as a mandatory first step in the following scenarios:
  • User logs in for the first time using default password,
  • When the login password is the same as username,
  • When the user forgets the password and receives a new system generated password by email.
  In all these scenarios, the user will be allowed to proceed further only after resetting the password.


• SAML compliant service: Password Manager Pro offers support for SAML 2.0, which facilitates integration with Federated Identity Management Solutions for Single Sign-On. Password Manager Pro acts as the service provider (SP) and it integrates with Identity Providers (IdP) by using SAML 2.0. The integration basically involves supplying details about SP to IdP and vice versa. After you integrate Password Manager Pro with an IdP, the logged in users can log on from the respective identity provider's GUI without providing the credentials again. For more details, click here.

Fig 2. Product Security Architecture

2.2. Assurance Mechanism - Two-factor Authentication

To introduce an additional level of security, Password Manager Pro provides two-factor authentication. Users will be required to authenticate through two successive stages to access the web interface. The second level of authentication can be done using one of the following:

• PhoneFactor- This leading global provider of phone-based TFA enables simple and effective security by placing a confirmation call to your phone during the login process.
• RSA SecurID- Integrate RSA SecurID with Password Manager Pro to generate a one-time validation token that changes every 60 seconds.
• Unique password through email- Authenticate by emailing users unique passwords. The passwords validate the user for one login session and then expire.
• Google Authenticator- Time-based numeric tokens developed by Google can be received by installing the Google Authenticator app on your smart phone or tablet device.
• RADIUS Authenticator- Leverage the authentication mechanisms of any RADIUS-compliant system, such as Vasco Digipass, to create one-time passwords.
• Duo Security- Leverage the Duo security authentication as the second level of authentication.
• YubiKey- Generate one-time passwords with YubiKey as the medium for the second level of authentication.

For more details, click here.

3. Data Integrity

3.1. Data Transmission

• All data transmission between the Password Manager Pro user interface and the server are encrypted and take place through HTTPS.

Fig 3. Data Flow Diagram

• All data transmission between the Password Manager Pro server and database occur over SSL.


• For remote password reset actions, there is an option to transmit user password using SSH.


• Communication between PMP and agents: Password Manager Pro allows agents to be deployed that can connect to the server. The communication is always one way - that is, the agent always initiates this connection. Therefore, only the server needs to be available for the agents, eliminating the need to punch firewall holes or creating VPN paths for the server to reach all agents. The agent periodically pings the server through HTTPS to check whether any operation (password reset or verify password) is pending for execution. The agent will then carry out the tasks and after completing them, will notify back the server with the results. More info.


• Communication between Primary and Secondary servers: Encrypted and over HTTPS

3.2. Data Storage with Dual Encryption

• Password Manager Pro is designed as a web application with a web server for business logic and RDBMS for data store.


• Upon applying appropriate initialization vectors and other standard good practices around encryption, the first-level encryption key with AES-256 algorithm is generated in the web server.


• The encrypted data is pushed to the RDBMS for storage by using SQL queries. Next, Password Manager Pro encrypts the data with built-in AES functions of RDBMS for dual layers of encryption.
• The recorded data of privileged sessions are also encrypted before storage and can be played only through proprietary player because the data is stored in the proprietary format.

3.3. Secure Remote Access

• Password Manager Pro allows users to launch highly secure, reliable, and completely emulated Windows RDP, SSH, and Telnet sessions from any HTML5-compatible browser, without the need for additional plug-in or agent software.


• Remote connections to end points are tunneled through the Password Manager Pro server, requiring no direct connectivity between the user device and remote host.


• In addition to superior reliability, the tunneled connectivity provides extreme security as passwords needed to establish remote sessions do not need to be available on the user's browser. More info.

3.4. Application-to-Application Password Management

• In the case of application-to-application passwords, Password Manager Pro exposes a web API and the applications connect and interact through HTTPS. The application's identity is verified by forcing it to issue a valid SSL certificate, matching the details that have already been recorded in PMP about the application. More info.

3.5. Web GUI Input Validation

• Password Manager Pro thoroughly validates all inputs in the GUI. Usage of special characters and HTML code are filtered, and the application is guarded against common attacks like SQL injections, cross-site scripting, buffer overflow, and other attacks.

4. Access Control Measures

4.1. Data Access Control