Connector Security
Advanced protection for your connector credentials through encryption, Kubernetes security, and IDHub's best practices. Our approach guarantees that your data remains secure at every stage. We continuously update our security measures to adapt to emerging threats and ensure the highest level of protection.
Overview
At IDHub, we prioritize the security of your connector credentials, implementing rigorous measures to safeguard them. These credentials are securely stored within a Google Kubernetes container, with their values encrypted in a file to prevent unauthorized access. We utilize advanced encryption techniques and follow industry best practices to ensure that your data remains protected. Additionally, our security approach includes regular updates and assessments to address emerging threats and vulnerabilities. Below are the detailed security features we have implemented to ensure the safe storage and protection of your connector credentials.
Encryption Methodology
The connector credentials stored in the file is encrypted. The private key to decrypt the values is generated in back-end using passphrase (which is a random 20 alphanumeric characters). The passphrase is stored securely with in a container and is not shared with anyone.
Algorithm
We use 256-bit AES in Galois Counter Mode (GCM) which is the industry-standard encryption algorithm.
Key Derivation
We use PBKDF2 (Password-Based Key Derivation Function 2) ensuring secure derivation of encryption keys from the provided passphrases.
Initialization Vector
We use a unique 16-byte randomly generated value that prevents replay attacks and ensure that the same plaintext does not result in the same ciphertex.
Encryption and Decryption Process
Encryption
To encrypt a sensitive value, the following process is applied:
- Encryption key is internally derived using the 256-bit AES encryption with Galois Counter Mode (GCM) algorithm
- Encrypt the sensitive value using the 256-bit AES encryption with Galois Counter Mode (GCM) algorithm with the derived key and a randomly generated IV.
- Store the encrypted value securely within the application's file system
Decryption
To decrypt the encrypted value, the following process is used:
- Retrieve the encrypted value from the secure storage.
- Decrypt the encrypted value using the 256-bit AES encryption with Galois Counter Mode (GCM) algorithm with passphrase
This approach ensures that only authorized parties with the correct passphrase can access the original sensitive data.
Encryption in Transit
To protect sensitive data during network transmission, we implement HTTPS using the SSL/TLS protocol. This includes:
- SSL/TLS Protocol:
- HTTPS utilizes SSL/TLS to encrypt data in transit, preventing eavesdropping and tampering.
- Certificate Management:
- We use valid SSL/TLS certificates issued by trusted Certificate Authorities (CAs) to establish secure connections. These certificates are regularly updated to maintain security.
Network Security
Our Configurations
Automatic Updates
IDHub updates the Kubernetes control plane and worker nodes timely, ensuring the latest security patches and bug fixes.
Network Policies
IDHub enables the Kubernetes NetworkPolicy API by default, allowing us to define granular network access rules between pods.
Pod Security Policies
IDHub automatically enables Pod Security Policies, which enforce security best practices for our pod configurations.
Workload Identity
IDHub supports Workload Identity, a feature that allows Kubernetes workloads to access other GCP resources securely using workload-specific service accounts.
Securing Credential/Secrets
This section outlines supplementary security measures implemented by IDHub to fortify the protection of stored connector credentials and mitigate potential security breaches. These additional policies are designed to enhance our overall security posture and safeguard sensitive information.
Service Accounts
We have ensured that the Kubernetes workloads use the least-privileged service accounts necessary to perform the tasks.
Network Policies
We have defined network policies to control the traffic flow between our pods and external resources.
Audit Logging
We have enabled audit logging to track all actions performed on the cluster, which helps with security monitoring and incident response.
Securing Containers
The connector credentials is stored inside a container. We have ensured that even if one is able to breach the IDHub K8 cluster (which is extremely unlikely) , then in the next level one would also have to breach the containerization security as well.
Addressing Security Risks via containerization
- Reduced Attack Surface
- Containers encapsulate applications and their dependencies, minimizing the attack surface exposed to potential threats. This isolation limits the impact of vulnerabilities within a container, as they are confined to the container itself and cannot spread to the host system or other containers.
- Consistent and Predictable Environments
- Containers ensure a consistent and predictable environment, making it easier to manage and secure applications. The immutable nature of container images, combined with the ability to easily rebuild and redeploy containers, reduces the risk of configuration drift and unintended changes that can introduce security vulnerabilities.
- Improved Patch Management
- Containerization simplifies the process of applying security patches and updates. By updating the container image and redeploying the containers, we have ensured that we can quickly address known vulnerabilities without the need to manage the complete stacks.
- Separation of Concerns
- Since containers allows us to decouple the application from the underlying infrastructure, allowing for a clear separation of concerns. This separation reduces the attack surface and the potential for cross-contamination between different components of the system.
Securing Data in Containers
- Volume Abstraction
- Containers typically use volumes to manage persistent data storage, abstracted from the container's file system. This volume abstraction allows for better control and management of data, including the ability to encrypt, backup, and restore data independently of the container.
- Network Isolation
- Containers are isolated at the network level, with each container having its own network namespace. This isolation helps prevent unauthorized access and lateral movement within the container environment, limiting the potential for data breaches
- Image Scanning and Vulnerability Management
- Kubernetes (containerization platforms that we use) offer tools to scan container images for known vulnerabilities and security issues. This proactive approach helps us identify and address potential security risks before deploying containers to production environments.
Additional Security Considerations
- Passphrase Security
- The passphrases used for encryption are securely stored and not shared with unauthorized parties.
- Salt Security
- The randomly generated salt values are essential for preventing dictionary attacks.
- Connector Manager
- Only Admin user (real-admin) can login to the connector manager, and access or change the the credentials secrets of the connector using IDHub’s connector manager functionality provided. The admin user credentials to login to the connector manager is secured and can’t be easily breached. if you have realm admin access, then all the KeyCloak functions are already enabled in your tenant
- KeyCloak based Security
- In your IDHub tenant, you can access KeyCloak and configure your own authentications flows for further strengthening the security of your Connector manager credentials.
- MFA/SSO
- You can enable MFA or password less logins via KeyCloak, so that admin user can login to the connector manager using the MFA authentication protocol that you have configured in KeyCloak for your tenant. This gives you additional layer of security, since the KeyCloak provides OTP / SSO / MFA based secure access protocols, hence the risk of password breach of admin user (for connector manager) is also mitigated
Conclusion
By leveraging 256-bit AES encryption with Galois Counter Mode (GCM), we provide a high level of security for storing and managing sensitive data within our containers. This approach, combined with secure network transmission using HTTPS, helps ensure the protection of confidential information against unauthorized access and potential breaches.
Learn more...
IDHub Extras
The Cost Of IAM
Learn why IAM is so expensive and how the benefits outweigh the initial price tag in our blog post: Why is Identity Management so expensive?