Security Checklist review
The Security Checklist in Pega Platform™ provides best practices for securely deploying Pega applications. It helps you track task completion through the Home page of Dev Studio and through built-in status tools.
Security is a shared responsibility between Pega and its clients. Each Pega Platform release strengthens security features to protect applications and data from unauthorized access.
Key benefits of the Security Checklist:
- Offers Pega’s leading practices for secure deployment.
- Protects confidentiality, integrity, and availability in production.
- Indicates when tasks should be performed: early development, ongoing, or pre-deployment.
- Reduces costly rework late in development.
To support tracking, Pega automatically installs an application guideline Rule instance with the checklist tasks for each application version.
The following figure shows the Application Guides menu in Dev Studio where you can access the checklist:
The Security Checklist offers Pega best practices for the secure deployment of applications. It helps safeguard the confidentiality, integrity, and availability of your application during its production phase. The checklist delineates the optimal timing for each Task, emphasizing when to perform them:
- At or near the Project's initiation.
- On an ongoing basis throughout Development.
- Just before the Deployment phase.
By adhering to the Security Checklist, you can proactively address security concerns at the outset, maintain vigilance throughout Development, and prevent costly rework in the later stages of the Development process.
The Security Checklist comprises core tasks and additional tasks. Core tasks in the Security Checklist occur during the development and production stages.
Security is critical, and as a Lead System Architect (LSA), it is your responsibility to maintain the confidentiality, integrity, and availability of your application.
Core tasks to perform during development
Perform the following actions to define the security of your application during development:
- Address Security alerts promptly.
- Examples of security alerts include:
- SECU0001 - Unexpected properties received in an HTTP request
- SECU0019 - Unauthorized request detected
- Examples of security alerts include:
- Securely authenticate attempts to access services.
- To configure a stronger authentication mechanism that matches your organization’s requirements, use a custom Authentication Service.
- To build authenticated custom REST services, use a custom Service Package that employs a suitable authentication mechanism in line with your organization’s requirements.
- Define appropriate roles and privileges to restrict access.
- Appropriately encrypt data.
- Encryption is a method to safeguard sensitive data within your application without impacting the functionality of the Pega Platform.
- Encryption uses a cipher algorithm to transform readable text (plaintext) into an unreadable secret format (ciphertext). The ciphertext can only be decrypted using the correct encryption key.
- Review the Application Guardrails landing page weekly and make changes to keep your application Rules in compliance.
Core tasks to perform during production
Perform the following actions to define the security of your application during the production phase:
- Set the system production level to 5.
- Lock Rulesets.
- Do not deploy checked-out Rules.
- Block unnecessary roles and operators from production.
- Secure passwords.
- Configure application settings and system settings for production .
- Configure cross-site request forgery (CSRF) settings.
- Define appropriate Content Security Policies.
- Define appropriate Cross-Origin Resource Sharing (CORS) policies for REST services.
- Configure logging levels appropriately.
- Define and map authentication services to the application.
Additional tasks
The following settings do not apply to all applications, but depend on client needs and are application-specific:
- Password format policies
- CAPTCHA policies
- Session lockout policies
- Login attempt auditing policies
- Multifactor authentication
- Operator access policies
- Configuration of authentication timeouts
- Secure Database access
- Audit changes to application data
- Configuration of security event logging
Security checklist for Pega Cloud
For applications on Pega Cloud® services, you must address additional considerations when completing the Security Checklist:
- Best Practices: Adhere to the Pega Security Checklist, focusing on:
- Encryption: Use BLOB or property encryption and envelope encryption with client-managed keys.
- Authentication: Implement secure methods such as OAuth.
- Testing: Conduct various tests, in line with organizational policies.
- Certificate Management:
- Avoid certificate pinning; instead, adopt Certificate Transparency to ensure seamless connectivity.
- Regularly update applications to pin to Amazon root certificates.
- Secure File Uploads:
- Implement virus scanning and restrict file types.
- Regularly update virus checkers and ensure proper settings to prevent unauthorized file uploads.
- Development and Testing:
- Use sample data in non-production environments, ensuring that no sensitive information is present.
- Anonymize live data if necessary and securely delete it post-testing.
For more information, see Security checklist.
Check your knowledge with the following interaction:
このトピックは、下記のモジュールにも含まれています。
トレーニングを実施中に問題が発生した場合は、Pega Academy Support FAQsをご確認ください。