Maximo

 View Only

  • 1.  Maximo Open to the World?

    Posted Wed September 21, 2022 08:02 AM
    Does anyone know of any White Paper like documents that detail how Maximo is secured? I have a client that needs to open the maximo-x app up to the world with Guest access and we have concerns about what vulnerability this may expose their core Maximo database to? I am also concerned about if it protects against DNS attacks or such?

    Opening ports and the app in the clients firewall has many risks and we need to know what IBM does to protect it. We opened a ticket with IBM asking and they were no help. It seems like they are certified secure by Federal Government so I would have thought this had to be documented to get such certification.

    Any help would be greatly appreciated.

    Thanks,

    ------------------------------
    David Miller
    Managing Partner - Maximo Consultant
    Enterprise Integration Partners LLC
    ------------------------------

    #Maximo
    #AssetandFacilitiesManagement


  • 2.  RE: Maximo Open to the World?

    Posted Thu September 22, 2022 10:53 AM
    Hi David,

    I'm not aware of any white papers on this topic, some of what you're asking are beyond simple WebSphere config (DDoS/DNS attacks).

    I would recommend the WebSphere STIG checklist from NIST (National Institute of Standards and Technology) as a starting point for hardening WebSphere. There are definitely some checklist items that could break Maximo or impact performance, so obviously you want to start this on a Dev environment.

    The other thing I'd recommend you consider is something like Microsoft's Azure AD Application Proxy. The short description is that it uses a software agent to proxy on-prem apps out to the public Internet. This allows Microsoft's cloud to serve as a buffer between clients and your web server, protecting you against DDoS attacks. You also have the option to require users authenticate (using Azure AD) before any sort of traffic hits your web server.

    Hopefully that's helpful. Happy to discuss further.

    ------------------------------
    Tim Ferrill
    Solutions Consultant
    Intelligent Technology Solutions
    tferrill@webuildits.com
    www.webuildits.com
    @tferrill/@webuildits
    ------------------------------

    Original Message


  • 3.  RE: Maximo Open to the World?

    Posted Mon September 26, 2022 07:52 AM
    Thanks for your reply...

    ------------------------------
    David Miller
    Managing Partner - Maximo Consultant
    Enterprise Integration Partners LLC
    ------------------------------

    Original Message


  • 4.  RE: Maximo Open to the World?

    IBM Champion
    Posted Tue September 27, 2022 08:03 PM
    Hi David,

    I am not across any white paper suggesting Maximo is secure in the open internet.
    Still, I know a number of clients who have internet accessible Maximo.
    I will suggest using CDN and WAF services from different cloud providers or software as a layer of protection against DDOS and Web attacks. Using a proxy server as suggested by Tim  also adds security in the customer's firewall configuration.
    CDNs will also enable you to restrict the access to a particular geography.

    Thanks,

    ------------------------------
    Biplab Choudhury
    IBM Champion 2022
    Senior Consultant
    BPD Zenith
    Melbourne
    ------------------------------

    Original Message


  • 5.  RE: Maximo Open to the World?

    Posted Wed September 28, 2022 04:19 AM
    It sounds as though your greatest challenge is that you want to allow Guest access from the world.  Our environment is open to the world but we use Azure AD SSO authentication (+ some MDM stuff for our mobile devices).  We use the Azure proxy service as Tim mentions for other internal applications, but again this is based on a userid/password secured by Azure AD.  Advice from Tim and Biplab sound like a great start to try to secure your end point(s), but I too would be concerned about what vulnerabilities you may expose doing this yourself.  Would certainly recommend getting some penetration testing done prior to opening it up fully.

    Regards,

    ------------------------------
    Scott Taylor
    Specialist Business Systems
    Port Waratah Coal Services
    ------------------------------

    Original Message