|
| 1 | +--- |
| 2 | +title: "Security Best Practices for Mendix Workstation" |
| 3 | +linktitle: "Security Best Practices" |
| 4 | +url: /mendix-workstation/security/ |
| 5 | +description: "Provides information about best-practice security configuration for the Mendix Workstation." |
| 6 | +weight: 15 |
| 7 | +--- |
| 8 | + |
| 9 | +## Introduction |
| 10 | + |
| 11 | +Security is one of the most important aspects of a deployment, because misconfiguration or failing security can have large consequences. The Mendix Workstation Client gives many configuration options for permissions that can have an impact on the security of your deployment. |
| 12 | + |
| 13 | +This document describes the common aspects you should consider when deploying the Mendix Workstation Client in production. |
| 14 | + |
| 15 | +## Assigning Workspace Roles {#workspace-roles} |
| 16 | + |
| 17 | +Workspace roles should be assigned following the Principle of Least Privilege. Always grant users the minimum permissions necessary for them to successfully complete their tasks. Roles can be reassigned at any time if responsibilities change. To help maintain a secure deployment, consider the following guidelines: |
| 18 | + |
| 19 | +- Assign the View Only role to untrusted users |
| 20 | +- Use caution when granting the Workspace Admin role |
| 21 | + - Workspace Admins can unintentionally disrupt production, for example by deleting an app or modifying its public key |
| 22 | + - Workspace Admins can allow Workstation Clients to access malicious apps |
| 23 | +- Conduct regular permissions audits to make sure that temporary privilege elevations are reverted once they are no longer necessary |
| 24 | + |
| 25 | +## Setting up Stations {#setup-stations} |
| 26 | + |
| 27 | +Setting up stations involves a variety of options, some of which have important security implications. To help ensure a secure deployment, follow these best practices: |
| 28 | + |
| 29 | +- Keep stations lean by disabling unused apps and deleting unused devices |
| 30 | + - Any unused device represents a potential attack surface (e.g., a forgotten card reader that leaks a token, or a tcp device that exposes a device on the network) |
| 31 | + - Any unused but enabled app may gain unintended access to devices that were not meant to be exposed to it |
| 32 | +- Verify that all devices configured on a station are safe for all enabled applications |
| 33 | + - Devices are shared across all applications in a station. If a device should not be accessible by a particular app, it should not be present on that station. |
| 34 | +- Configure File devices carefully |
| 35 | + - File devices are powerful and can pose security risks if misconfigured |
| 36 | + - Restrict the allowed folder and permissions as much as possible. The Workstation Client enforces these restrictions within the allowed folder and its subfolders. |
| 37 | + |
| 38 | +## Restricting Configuration Folder Access {#config-access} |
| 39 | + |
| 40 | +By default, the Windows global installer for the Workstation Client grants the BUILTIN\Users group read and write access to the ProgramData/Mendix Workstation folder. This configuration is safe in most cases. However, for highly sensitive environments, you may want to restrict write access for the built-in Users group and instead delegate permissions to a different group. |
| 41 | + |
| 42 | +### Why Restrict the Users Group? |
| 43 | + |
| 44 | +The BUILTIN\Users group includes all standard user accounts on the system. Restricting its write access helps prevent the following: |
| 45 | + |
| 46 | +- Compromised accounts from modifying configuration files |
| 47 | +- Unauthorized users from deregistering the station, temporary halting production |
| 48 | + |
| 49 | +By delegating permissions to a more tightly controlled group, you ensure that only authorized accounts have the ability to modify the configuration and to use the Workstation Client. |
| 50 | + |
| 51 | +### Configuring Permissions |
| 52 | + |
| 53 | +1. Open C:\ProgramData\Mendix Workstation\ in Windows Explorer |
| 54 | +2. Right-click the folder, select Properties, and navigate to the Security tab |
| 55 | +3. Click Edit → Add… |
| 56 | +4. Enter the name of your custom group and select Check Names |
| 57 | +5. Assign this group the same permissions currently held by the Users group |
| 58 | +6. Remove the Users group or adjust its permissions as needed |
0 commit comments