F. Best Practices

Security practices and customizations for your Pleasant Password Server installation.

Have Questions?  Contact Us

1. Protect the Admin account

At startup, a local admin user is created and is assigned an Administration role with system-wide permissions.

These permissions should be accessible in cases of emergency, by at least one trusted staff member, preferably two or more. Actions that entirely remove or disable the necessarry role permissions are discouraged and are not covered by standard Technical Support.

Risks to Mitigate:

Your installation could become at risk of: being unprepared for an emergency, getting locked out, or losing access to your assets.

Steps:

2. Maintain a working Local Admin account

Risks to Mitigate:

Steps:

3. Setup Database Backups & Safeguard the Encryption Keys

Risks to Mitigate:

Steps:

4. Take regular Snapshots of Server

5. Keep your Service Plan up-to-date

6. Use a trusted third-party Certificate

7. Secure & Harden your Server Environment

8. Disallow older methods of SSL encryption

9. Review the Ten Immutable Laws of Security


Law #1: If a bad guy can persuade you to run his program on your computer, it's not solely your computer anymore.
Law #2: If a bad guy can alter the operating system on your computer, it's not your computer anymore.
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
Law #4: If you allow a bad guy to run active content in your website, it's not your website any more.
Law #5: Weak passwords trump strong security.
Law #6: A computer is only as secure as the administrator is trustworthy.
Law #7: Encrypted data is only as secure as its decryption key.
Law #8: An out-of-date anti malware scanner is only marginally better than no scanner at all.
Law #9: Absolute anonymity isn't practically achievable, online or offline.
Law #10: Technology is not a panacea.