Security and access overview

Applies to: StorageGuard 9 and later   /   Windows, Linux

These articles cover everything that controls access to StorageGuard: who can sign in, what each user can see, how credentials and keys are stored, and how connections are encrypted. Most organizations work through them in the order below, during deployment and before connecting production storage and backup systems.

Start here

Read this first. It explains the access model the other articles build on.

1. How access works
   How StorageGuard authenticates users, how roles and scopes decide what each user can see and do, and which settings secure each connection.

Decide who can sign in

Connect StorageGuard to your identity provider so users sign in with the accounts they already have.

2. Connect to Active Directory
   Authenticate users against Active Directory and map directory groups to StorageGuard roles.
3. Set up single sign-on with Azure AD or SAML
   Let users sign in through Azure AD or another SAML 2.0 identity provider.

Decide what each user can see

Limit users to the storage and backup systems they are responsible for.

4. Give a team access to only their systems
   Create scoped users who see only a defined set of storage and backup systems, with their findings and reports.

Protect credentials and keys

Keep passwords and API keys out of plain configuration.

5. Use a password vault for users and the database
   Retrieve user and database credentials from your password vault instead of storing them in StorageGuard.
6. Manage API keys
   Create, scope, rotate, and revoke the keys that scripts and integrations use to call the StorageGuard API.

Encrypt connections

Secure traffic to the web interface, the database, and the collectors.

7. Replace the web server certificate
   Replace the default certificate with one issued by your certificate authority.
8. Encrypt connections to the database and collectors
   Turn on TLS between the StorageGuard server, its database, and its collectors.
9. Configure web security headers and certificate validation
   Add HTTP security headers and make StorageGuard validate the certificates of the systems it connects to.

Harden the server

Finish with the checklist that ties these settings together.

10. Harden StorageGuard
    A checklist of operating system, service, and application settings that reduce the StorageGuard server's attack surface.