Additional server configurations

There are other configurations that you need to consider on the server side.

Password and account lockout policies
You must configure your password complexity policy in your LDAP or authentication server in compliance with your organization's security policies. You must also set up your account lockout policy.
Protecting from fingerprinting servers
Displaying the version information of your software can allow an attacker to determine if and where vulnerabilities are present in the software, particularly if an outdated software version is in use with published vulnerabilities.
Configuring HTTP methods
Consider restrictions and configurations concerning security for certain HTTP methods.
Configuring the HTTP Strict Transport Security policy
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against man-in-the-middle attacks and cookie hijacking.
Configuring cookies
All cookies that are created by the Operational Decision Manager applications contain the HttpOnly and Secure properties. These options must be set to mitigate the security risk and protect the cookies.
Configuring TLS protocols and cipher suites
You can configure the Operational Decision Manager applications to comply with the Suite B security standard.
Protecting against host header injection attacks
Prevent this security vulnerability by implementing properties for whitelisting servers in the Decision Center and Rule Execution Server archives.
Protecting against CSRF attacks
You can configure Decision Center to prevent cross-site request forgery (CSRF) attacks by restricting access to designated web domains.
Known vulnerabilities and remediation
Be aware of certain vulnerabilities and how to remedy them.

Parent topic: Securing Operational Decision Manager