- Data transmission
- Data storage and deletion
- Experience scripts
- Packet capture
- Native Monitoring Points
- Audit log
- Administrative data access
AppNeta employs various methods to keep your data secure. In addition, you should make sure that you change the default password on your Monitoring Points and regularly upgrade the Monitoring Point software.
Common security-related questions include:
What is the password complexity requirements in APM?
APM passwords must contain a minimum of eight characters and must include uppercase alphabetic, numeric, and special characters. Password length and complexity requirements beyond our standards are supported through the use of SAML where password length and complexity is managed through the SAML IdP.
Does APM enforce password change frequency?
APM User Identity Management does not enforce password change frequency but end users are able to meet this requirement through the use of SAML where password expiry are managed through the SAML IdP.
Does APM enforce session timeouts? If so, for how long?
Yes. If a user session has been idle for more than 10 minutes, their session times out and they are required to re-authenticate to reactivate the session. The exception to this is on pages that stream live data updates, which do not timeout automatically.
How do you prevent brute force attacks? Do you block multiple failed attempts?
After 6 unsuccessful login attempts the message “Too many consecutive login failures, please wait a moment before trying again.” is presented.
- up to 5 attempts are allowed with no delay
- after 5 consecutive failures, a delay of 30 seconds is imposed with the above message presented
- the 30 second delay recurs after each subsequent failure
- all delays or failed attempts reset after the first success
- all delays or failed attempts reset after an hour of inactivity
TLS1.0/1.1 deprecation - APM-Public
As part of our ongoing commitment to security, all communications to APM-Public will only support TLS1.2 and higher. The migration away from TLS1.0/1.1 support will take place in two phases.
Phase 1 - November 30, 2020 - APM-Public UI and API
As of November 30, 2020, all requests to the AppNeta APM-Public UI and API must use TLS1.2 over HTTPS. Any connections over TLS1.0 and TLS1.1 will be blocked. We’re making this change to ensure security of data in transit.
Most major browsers no longer support TLS1.0 and TLS1.1 so no action is required provided you are using a recent browser version:
- Google Chrome
- Microsoft Internet Explorer
- Apple Safari
- Mozilla Firefox
See the related blog post for more details.
Phase 2 - January 31, 2021 - Monitoring Points
As of January 31, 2021, only Monitoring Points that support TLS1.2 will be able to access APM-Public. This includes the current generation of Monitoring Points (m35, m50, m70, r90, r1000, v35, CMP, and NMP). Legacy Monitoring Points (m20, m22, m30, r40, r400 and the Software Sequencer) do not support TLS1.2 and must be migrated to current generation Monitoring Points prior to January 31, 2021 as they will no longer be supported.
Please contact your AppNeta Customer Success representative if you have any questions.
TLS1.0/1.1 deprecation - APM-Private
The Q1 2021 release of APM-Private will support the ability to block all TLS1.0 and TLS1.1 connections. AppNeta will work directly with you to define a cutover date when TLS1.0/1.1 will be blocked. Prior to the cutover date, you will need to migrate all Legacy Monitoring Points (m20, m22, m30, r40, r400 and the Software Sequencer) to current generation Monitoring Points (m35, m50, m70, r90, r1000, v35, CMP, and NMP) as the older Monitoring Points only support TLS1.0/1.1.
Please contact your AppNeta Customer Success representative if you have any questions or for help with a transition plan.
Supported ciphers as of December 2, 2020:
|TLS Version||OpenSSL Name||IANA Name|
Supported ciphers as of the end of January 2021 (exact date TBD) based on Mozilla’s Intermediate recommended configuration.
|TLS Version||OpenSSL Name||IANA Name|
How does the “ssl-tunnel” program restrict data flow to ensure the data is routed into the correct customer account?
Physical and virtual Monitoring Points communicate with the APM cloud application over an SSL/TLS tunnel ensuring a secure and encrypted transfer of all information between the Monitoring Point and the cloud application infrastructure. Within the cloud application infrastructure, each unique SSL/TLS tunnel connection is identified by the GUID associated with the Monitoring Point. Since each GUID is associated with exactly one organization, we ensure that all of the telemetry data arriving on that tunnel is directed to the data store and/or scheme associated with that organization.
Which security protocols do you allow between APM and the current generation of Monitoring Points (m35, m50, m70, r90, and r1000)?
On the server side, we are configured with protocol=SSLv2_3 which means it will accept any SSL version v2, v3, TLS 1.0, or higher. That said, the current generation of modern Monitoring Points will always negotiate to the highest protocol level - TLS 1.2. Note that TLS 1.0/1.1 Monitoring Point connections are no longer supported after January 31, 2021.
With regards to encryption and TLS/SSL tunnels, which security standards are used as guidelines?
AppNeta administrators subscribe to vendor, US-CERT, and other industry related vulnerability alerts to ensure that our team remains aware of potential vulnerabilities. We also run Rapid7 vulnerability scans on all releases to ensure that no new vulnerabilities have been created. With regard to TLS/SSL tunnels, we negotiate to TLS 1.2 whenever possible. As of November 30, 2021, all browser and API client connections require TLS 1.2.
Data storage and deletion
How does AppNeta secure stored data?
AppNeta Performance Manager (APM) is hosted on Amazon Web Services. AppNeta uses industry accepted best practices to keep this installation secure. This includes Amazon security groups, firewalled ports, ssh-key based machine logins, and key rotation.
Data access is restricted solely to AppNeta employees, all of whom are under strict confidentiality agreements. Only key engineers may access production data, and then only for the purpose of debugging data-related issues as a last resort. In addition, AppNeta Support may access your web console to provide guidance as a result of specific incidents or requests.
When is data deleted?
Customer data is purged within 90 days of being decommissioned or contract termination.
How does AppNeta delete unneeded or expired data?
AppNeta utilizes NIST SP 800-88 on Data Sanitization as its guideline.
What security mechanisms are used with Experience Workflow scripts?
All Experience workflow script contents, including stored passwords, are encrypted while at rest within the APM database. Transmission of scripts and passwords between APM and the end-user browser is done through a secure channel (SSL/TLS). Password variables (identified by one of the names: “password”, “passwd”, “pwd”, or “secret”) are masked within the script editor.
What security mechanisms are used with packet captures?
APM uses standard encryption practices to ensure that the information in your packet captures is securely transmitted and stored.
Captures are uploaded to the Capture Server via SSL where they are encrypted using an AES 256-bit key prior to their transfer to Amazon S3. The symmetric key used for encryption is based on a per-Monitoring Point, user-defined passphrase. A one-way SHA-1 hash of the passphrase is stored only on the Monitoring Point.
Captures must be decrypted using the symmetric key created from the passphrase. You are prompted for a passphrase once per Monitoring Point per login session; the passphrase is cached only for the duration of the login session. The actual download is via SSL.
As part of Monitoring Point decommissioning (typically occurring when a Monitoring Point is deleted), the passphrase and packet captures that have not yet been uploaded are cleared. If the Monitoring Point is no longer being used for packet captures, but you aren’t decommissioning it, a separate clear passphrase function is available.
Native Monitoring Points
What security mechanisms are in place for communications with the NMP?
Linux-based NMP run as root and require outbound connections to APM servers to report the timing data and to download software updates. Timing data is sent back to APM via HTTPS. Software packages are downloaded from the upgrade repository via SSL. For the specific ports and protocols that are required by NMPs, see the Firewall Configuration page.
How can I tell what actions APM users performed?
The APM audit log file contains records of all actions performed on APM, when they were performed, who performed them, and where they were performed from. The .csv format audit log can be downloaded for review.
Only Organization Admins can download the audit log.
To download the audit log file:
- Navigate to > Download Audit CSV
- Specify the date and time range to download.
- Specify the organizations to download records for.
- Click Download.
- Open the downloaded .csv file.
Administrative data access
What is the access policy for AppNeta admins?
Access to systems and customer information in the AppNeta Performance Manager (APM) is controlled using a policy of need-to-know/least privilege. Access to all aspects of the application and supporting systems is reviewed quarterly to ensure access and access levels are appropriate. At the time of an employee role change or termination, access decommissioning procedures are executed as required.