-
Update ARCGIS ANTIVIRUS GUIDANCE document
Hello, Would it be possible to update the ArcGIS Antivirus Guidance document to integrate a specific paragraph about Windows Exploit Protection, as ArcGIS Enterprise 11.3 and the new ArcGIS Pro licensing system introduce interference (crash) with Exploit Protection…
-
Attend Security, Privacy & Compliance Sessions & Get Your Questions Answered at Esri UC 2025
The 2025 Esri User Conference is right around the corner, and we are excited to connect with you. UC is filled with many presentations and events, with hundreds of topics covered. To help you get the most out of your experience, we’ve created a custom agenda for Security, Privacy & Compliance. We hope these sessions will…
-
Using WebSockets with ArcGIS
Hey My company has a websocket compliance that requires the application to use CSFR tokens. Is there already an approach from Esri to integrate these tokens? Thanks in advance Cheers, Max
-
Email alerts for new blogs on ArcGIS Blog - Administration
I do not see a place to sign up for email alerts when Esri releases a new blog article, particularly about administration blogs. Does anyone know how to sign up for these as email alerts? This would be helpful, especially about the blog posts like SAML updates for AGOL and Security Patch 2 for Portal that recently came…
-
ArcGIS Enterprise and Antivirus Software
I am looking for a new Antivirus Solution for ArcGIS Enterprise. Let me know what you are using!
-
OVAL repo - Image scanning - CVE - ArcGIS on Kubernetes
With regard to the esri statement: "In order to maintain code stability and compatibility, Esri usually does not rebase packages to entirely new versions. Instead, we backport fixes to an older version of the software we distribute. This can result in some security scanners that only consider the package version to report…
-
secure the server/admin endpoint
Hi folks, I am having a discussion with our security department as I should not expose admin capabilities via our reverse proxy. Serving data via this reverse proxy (like hosted feature services, services and so on) is totally fine. even the server manager might be cool. But when it comes to the arcgis/admin endpoint my…
-
FedRAMP 3rd Party Pentest and Audit Materials
Good Day The company I work for is busy conducting a cloud risk assessment of AGO and requires the FedRAMP pen test and audit reports. We have been requesting these reports via our local ESRI office since November 2023 with no success. It is my understanding that these reports are available based on the information…
-
The curious case of an ArcGIS Pro "Add Content" ailment...
The Case: Our team was recently asked to assist with troubleshooting an odd set of failures when adding data hosted on ArcGIS Online to ArcGIS Pro. When adding ArcGIS Online hosted feature services to the ArcGIS Pro project, the customer received error 499: Invalid token. They were already signed into ArcGIS Online, so it…
-
Scanning of Compact Cache File
We are recieving a large number of compact cache file from an external source and i would like to scan the content of the files before they enter our environment. Is there a way to unpack the .bundle files to run them through a scanner.
-
CVE-2019-17267 - FasterXML Jackson-databind
Our IT department came across CVE-2019-17267 related to fasterxml jackson-databind and believe it is linked to GeoEvent Server. This also shows up in our dev environment, ArcGIS Server, and ArcGIS for Portal environments. I should also note we no longer use GeoEvent Server. Has there been any patches or updates to address…
-
Hosted feature service vulnerability? Enterprise 10.9.1
Hello, I have a hosted feature service in arcgis enterprise 10.9.1, this hosted feature service do not have activated the edit option in portal. When I open arcgis pro and connect to my portal and i select that hosted feature services with no edit option activated, i am able to edit this service from pro, arcgis pro do not…
-
Unable to switch ESRI accounts on a tablet
I'm using a Galaxy Tab A8, Android version 11, One UI Core version 3.1 and using Workforce (App version 22.0.1, Build 300). I'm trying to switch from one user to another, and while I am able to logout from the app, I am given two options: "Sign in with ArcGIS Online" and "Sign in with ArcGIS Enterprise". I press the first,…
-
ArcGIS and CVE-2021-44228 Apache Log4j 2
Regarding the recently announced 0 day CVE-2021-44228 (aka Log4Shell aka LogJam): Details regarding a new security vulnerability identified as CVE-2021-44228 (aka Log4Shell aka LogJam) were released on December 30. This issue is generating considerable media attention, and is currently Esri Product Security Incident…
-
Esri.com Administrative Access Request from marlon.silva6
Did anyone else receive a request from marlon.silva6 with an email address of admin@esri.com to get access to their Esri.com account? We opened a ticket on our end and reached out to our account rep. Customer Service says that this account attempted several other accounts that were considered to be Esri internal and we…
-
IIS Allow Unlisted File Name Extensions
Does Esri maintain a list of file name extensions that must be allowed in order for GIS services (e.g. map, feature, geocode, etc.) to function properly? My organization now requires certain IIS hardening settings to improve security. One requirement is to disable "allow unlisted file name extensions" under request…
-
Publishing from ArcGIS Pro triggers Azure WAF mandatory rule.
We have a base ArcGIS Enterprise deployment behind an Azure Application Gateway with WAF enabled using the OWASP 3.1 ruleset. We have run this in detection mode for a few months while we build the exceptions for valid requests. We have managed to build the exceptions for all of our valid requests except one that is…
-
How to update lastUpdatedThumbnailUrlByWab for HTTP Check
Hello everyone. I have been updating links related to my organization's web applications and other ArcGIS Online content. I have been using the HTTP Check tool within ArcGIS Security Advisor. I have been successful at switching most link locations from http to https except for lastUpdatedThumbnailUrlByWab. The analysis…
-
ArcGIS GeoDev Presentation: Beyond Checking the Boxes - A guide to Understanding ArcGIS Online Security and Privacy
A few weeks back we had the opportunity to participate in an Esri GeoDev webinar, where we went into detail about technical and non-technical controls to help #ArcGISOnline be more secure, respect privacy, and prevent propagation of "fake news". We explain ArcGIS Online configuration options and best practices, explore the…
-
New Technical Paper: Considerations for configuring antivirus software for ArcGIS Enterprise hosts
Esri Software Security and Privacy has recently released a new technical paper: Considerations for configuring antivirus software for ArcGIS Enterprise hosts This document augments the existing kB: FAQ: Which ArcGIS Enterprise directories should be excluded for security or antivirus software? And is a valuable resource for…
-
GDPR: Which technical data of smartphone is transfered to Survey123
I'm building a survey in Survey123 in order to collect data about floodings by volunteers. The idea is that volunteers anonymously complete a survey via Survey123 while sharing a (GPS)-location and eventually a photo (of the flooding). In order to comply to the GDPR (EU-regulation 2016/679), I request from the volunteers…
-
Subscribe to Technical Support articles?
Hello! Our company was bamboozled today by the following change... Esri Support https_only I'd like to ensure that such announcements make it to my mailbox. Can someone confirm if there is a mailing list I should have been signed up on to get the above article and if so, which mailing list is that? If that exists, I will…
-
Are you ready for the HTTPS-Only enforcement with the ArcGIS Platform?
HTTPS, short for Hypertext Transfer Protocol for Secure communication, allows for the secure transmission of data, both incoming and outgoing, between a client, such as a web browser, and the server. Esri is making the HTTPS-Only change in a phased approach. Esri customers must act now to be ready for this change. *…
-
Discovering and Limiting Access to Public ArcGIS Survey123 Results
The Esri Software Security and Privacy Team is proud to announce the newest in our white paper series: Discovering and Limiting Access to Public ArcGIS Survey123 Results! Written for Survey Authors, admins, and privacy professionals and specifically intended to provide targeted guidance for public health initiatives, this…
-
Coronavirus Downloadable Malware Map App Clarification
A new Windows-based application has been created by a malicious individual or group that uses the the online map posted by John Hopkins University at https://coronavirus.jhu.edu/map.html as a decoy for installing Malware.Michael Young has written a blog describing this issue. Bottom-line, you are fine browsing the…
