Security hardening checklist
After you install Netwrix Privilege Secure, review the settings that control how the server is exposed and how it protects secrets. Start with Replace the web console certificate, because the installer creates a self-signed certificate.
| Task | Where to find it |
|---|---|
| Replace the console certificate with one from a trusted certificate authority | Replace the web console certificate |
| Renew the JWT signing certificate | Renew the JWT signing certificate |
| Restrict the SSH algorithms that Privilege Secure offers | Configure SSH algorithms |
| Protect the encryption key in AWS Key Management Service | Protect the encryption key with AWS KMS |
| Require strong passwords for local console users | Local User Password |
| Leave the API explorer off in production | Swagger |
| Keep the Privilege Secure server off the managed domain | Security Considerations: Non-Domain-Joined Netwrix Privilege Secure Server |
| Give the SQL Server backend only the permissions it needs | Least Privilege Model for SQL Server Backend |