Security

This chapter describes how to run an Axon Ivy Engine in a safe way. This is important whether you provide an Ivy engine in a secure intranet environment or you make your engine accessible via the internet. Some parts need to be implemented by your IT Operations provider:

  1. Run the Axon Ivy Engine behind a fully patched reverse proxy server (like NGINX, Apache HTTP Server or IIS).

  2. Disable direct access to the Axon Ivy Engine.

  3. Only allow access to the URLs of your application and block all other access.

  4. Run the Axon Ivy Engine with a dedicated system user and database users with limited access rights.

  5. Run the latest Axon Ivy Engine major version with all updates marked as security relevant.

  6. Only serve users via HTTPS (configured on the reverse proxy).

  7. Document and automate the server setup.

  8. Ensure that the provider performs daily backups (database, relevant engine folders) which can also be restored…


digraph overview { layout=neato; node [shape=box, height="0.8", width="2", color="#007095", style=filled, fixedsize="true", margin=0, fontname="Roboto,Helvetica Neue,Arial,sans-serif", fontcolor="white", fontsize=15 ]; /* nodes */ browser [label="Browser" pos="0,2.5!", height="0.8", width="1.5"]; reverseproxy [label="Reverse Proxy", pos="3,2.5!", height="0.8", width="1.5"]; engine [label="Axon Ivy\nEngine", pos="6,2.5!", height="0.8", width="1.5", color="#C7D426", fontcolor="black"]; systemdb [label="System\nDatabase" pos="9,2.5!", height="0.8", width="1.5"] /* edges */ browser -> reverseproxy; reverseproxy -> engine; engine -> systemdb; /* edge labels */ browser_reverseproxy [label="HTTPS\n \n ", pos="1.4,2.5!", shape=none, fillcolor=none, fontcolor=black, fontsize=11]; reverseproxy_engine [label="HTTP\n \nHTTPS", pos="4.4,2.5!", shape=none, fillcolor=none, fontcolor=black, fontsize=11]; engine_systemdb [label="JDBC\n \n ", pos="7.4,2.5!", shape=none, fillcolor=none, fontcolor=black, fontsize=11]; }


Read more about other security tweaks which you can apply to your Axon Ivy Engine: