Security and Access Control

Securing Ridgeback and the systems that run it is fundamental to maintaining a safe and reliable network environment. This chapter outlines key aspects of Ridgeback’s security and access control measures, including managing user passwords, protecting database credentials, hardening servers and Rcore endpoints, and ensuring Ridgeback can safely coexist with users and their devices. Implementing these guidelines helps reduce the risk of unauthorized access, data breaches, and other security incidents.

User Password Management

Why It Matters: Strong user password policies ensure that only authorized individuals can access Ridgeback’s sensitive data and administrative capabilities. Without proper password management, attackers might leverage weak or default credentials to compromise accounts.

Best Practices:

1. Use Strong, Complex Passwords: Require passwords that are at least 12 characters long and include uppercase and lowercase letters, numbers, and special characters.
2. MFA Integration: Implement multi-factor authentication (MFA) to add an additional layer of security. You can combine passwords with time-based one-time passwords (TOTPs) by turning on two-factor authentication on the "Settings -> Account Security" screen.
3. Password Managers: Encourage admins and users to store passwords in reputable password managers to avoid weak or reused credentials.

Database Password Management

Why It Matters: Ridgeback stores critical network metadata and configuration data in a MySQL-compatible database. If the database credentials are leaked or weakly secured, attackers could gain unauthorized read/write access, compromising network integrity and confidentiality.

Best Practices:

1. Separate Accounts: Use distinct accounts for application access and administrative tasks. Grant only the minimum privileges needed for Ridgeback to function.
2. Strong, Unique Passwords: Just as with user passwords, ensure database credentials are long, complex, and never reused.
3. Secure Storage of Credentials: Store database passwords in the .env file with appropriate file permissions (e.g., 600 on Linux). Consider using encrypted secrets management tools like HashiCorp Vault or AWS Secrets Manager for large deployments.
4. Rotate Database Credentials: Change database passwords if a staff member with access leaves or if a potential breach is suspected.
5. TLS Encryption: Configure the database connection to use TLS/SSL, ensuring data is encrypted in transit and preventing attackers from intercepting credentials.

Hardening the Service Container Server

Why It Matters: The server running Ridgeback’s containerized services (e.g., analytics, policy, manager) is at the heart of your deployment. Compromising it could give attackers broad access to data and control over security measures.

Hardening Measures:

1. Patch Management: Keep the host operating system and container runtime (e.g., Docker) updated with the latest security patches.
2. Minimal Attack Surface: Uninstall or disable unnecessary services on the host system. Only run essential software.
3. Firewall Rules: Restrict inbound and outbound traffic. Allow only the needed ports (e.g., HTTPS ports for web access, database ports if required).
4. Endpoint Protection: Use endpoint protection software, like Windows Defender, and centralize logs for monitoring suspicious activities. Configure log retention policies aligned with your compliance requirements.
5. Regular Audits: Periodically review file permissions, running services, and user accounts. Confirm that no unauthorized users have shell or management access.

Hardening an Rcore Computer

Why It Matters: Each Rcore endpoint sits directly on the network segment you’re monitoring or protecting. If compromised, an attacker could gain insight into your network operations or potentially manipulate traffic.

Hardening Measures:

1. Lock Down the Host OS: Whether Windows, Linux, or macOS, ensure the Rcore host is fully patched and only running necessary services. Apply principle-of-least-privilege for user accounts.
2. Disable Unneeded Services: For example, on Windows, disable services like LLMNR or mDNS if not required. On Linux, consider disabling avahi or other multicast services that are not needed.
3. Strict Firewall Controls: Limit inbound connections to the Rcore host. The Rcore should typically only need outbound connectivity to the Ridgeback manager service.
4. Anti-Malware and EDR: Deploy reputable endpoint protection software or anti-malware tools on the Rcore host.

Having Ridgeback Coexist with Users

Why It Matters: Ridgeback monitors network segments that may include user devices and servers. Balancing strong security with user experience ensures operations are not hindered and helps maintain trust.

Guidelines for Coexistence:

1. User Education: Inform users that Ridgeback is monitoring network segments for anomalous traffic and explain that their normal business functions are not restricted.
2. Non-Disruptive Security: Ridgeback’s phantoms and security measures should not create latency or block legitimate traffic unnecessarily. Adjust phantom settings and policies accordingly.
3. Clear Policies and Communication: Clearly communicate acceptable use policies, so users understand what constitutes suspicious behavior. This can reduce accidental triggering of Ridgeback’s security alerts.
4. Incident Response Protocols: Ensure that IT/security teams respond swiftly and transparently if a user’s device is flagged. Offer guidance on remediation steps and explain the reasoning behind any restrictive action.