Security Considerations

ArcGIS Server:

• All ArcGIS Servers must be protected against cross-site scripting attacks by configuring the origins allowed to be accessed alongside content from ArcGIS Server. It is crucial that you follow the instructions to Restrict cross-domain requests to ArcGIS Server.

• It’s also very important to secure ArcGIS Server. See Esri’s document titled Secure your ArcGIS Server site for more details.

• ArcGIS Server is usually hosted within another HTTP stack (IIS, Apache). Follow the vendor's best practices for hardening the server against attack.

• If you install ArcGIS Web Adaptor to allow ArcGIS Server to integrate with your existing web server, you must enable HTTPS on your web server, which means you need to obtain a server certificate and bind it to the website that hosts ArcGIS Web Adaptor.

ArcGIS Portal (if using Portal for authentication):

1. Your Portal-based authentication can use Portal built-in users or Active Directory (AD)-based users.

2. Whether you use built-in users or AD-based users, you need to let traffic come from Auth0 (a hosted service that enables single sign-on) through the firewall to your portal instance.

3. Decide which groups, whether built-in or AD-based, map to which roles. We make assignments via group information from the identity provider so that group membership can be managed in a central location.

4. Follow Esri’s recommendations to secure your portal through their document About securing your portal.

Client Devices that Run the Editor XI Application:

• Editor XI provides users with access to an important asset of the organization: its GIS data. As such, it is important to secure that data against theft.

  • For Windows, refer to Microsoft's documentation on BitLocker.

  • Recommendations specifically for securing client devices:

    1. Enable full disk encryption on devices that host Editor XI.

    2. Configure screen lock timeout for a maximum of five minutes.

    3. Follow these recommendations for general Windows settings:

       • Do not grant local administrator privileges to end users.

       • Do not grant end-user account permissions to install applications.

       • Use application “allow-listing” to permit only approved applications or executables to run.

       • Use real-time endpoint protection to detect unauthorized changes to installed components.

Uninstalling the Application and Transferring Equipment:

Uninstall the application from the Control Panel. If your company intends to transfer the equipment to another user, you should follow best practices for the secured deletion of the previous user’s AppData directories.