Security Features

Protecting your data is our top priority. We employ a variety of security measures to ensure the safe operation of the agent, modules, and email communications.

Web UI and API Encryption

The software's Web UI and API endpoints are secured with HTTPS, ensuring encrypted data transmission. The system supports TLSv1.3, the latest and most secure version of the Transport Layer Security protocol, to guarantee data confidentiality and integrity between clients and the server.

Optional HTTP Strict Transport Security

HSTS can be enabled explicitly in settings.ini for stable DNS host names whose matching certificate is trusted by every client. It is disabled by default for backward compatibility and because typical Agent installations use localhost, an IP address, or the generated self-signed localhost certificate.

HSTS is not offered for localhost or IP addresses. It should not be enabled for a self-signed certificate that users access by bypassing a browser warning. Once a browser has learned an HSTS policy through trusted HTTPS, later certificate errors normally cannot be bypassed. See HTTP Strict Transport Security (HSTS) for configuration, deployment cases, and rollback instructions.

Protection Against Framing and Clickjacking

ONEInsight Agent prevents its Web UI, documentation, Swagger pages, and API responses from being embedded in frames. Every HTTP response includes Content-Security-Policy: frame-ancestors 'none' and the legacy fallback X-Frame-Options: DENY.

The frame-ancestors directive is delivered exclusively as an HTTP response header. Browsers ignore this directive when it is placed in an HTML meta tag. Consequently, ONEInsight Agent must be opened as a top-level browser page and cannot be embedded in another portal or dashboard.

User Authentication

To access and utilize the software's agent, users are required to authenticate themselves with a username and password combination. Passwords are securely hashed by ASP.NET Core Identity. Administrators can select the Standard, Enhanced, Strict, or NistInspired password policy profile in settings.ini; the selected policy is enforced consistently for password changes and CLI password resets.

NistInspired implements a 15-character minimum without character-composition rules. It is not fully NIST-compliant because it does not include a blocklist of common or compromised passwords. Standard retains a six-character minimum for compatibility and provides a lower security level than the other product profiles.

Encrypted Database for Data Storage

The agent uses an encrypted database to securely store all sensitive data. This encryption ensures that data at rest is protected. By utilizing advanced encryption standards, the software maintains the confidentiality and integrity of stored information, providing an additional layer of security for all user data and operational records.

Email Encryption

All email communications are protected using RSA encryption with a 2048-bit key length. This encryption standard provides robust security for data in transit, safeguarding sensitive information shared through email against unauthorized access.

Module Integrity Assurance

To prevent code manipulation or injection attacks, the software exclusively runs official, vetted modules. This approach ensures that no unauthorized or potentially harmful code is introduced into the environment, maintaining the software's integrity and trustworthiness.

Time-Limited Module Authentication

The software enforces time-limited authentication for module communications. This feature allows modules to securely interact within the agent for a designated period, adding an extra layer of security by limiting the window of access and reducing the risk of unauthorized persistence in the communication flow.