Latest Contributions by RandallWilliams

Check out this blog from Michael Young‌ discussing upcoming security improvements revolving around TLS in the ArcGIS Platform, including insight into what's coming after the ArcGIS Online TLS updates coming in February. 2019 ArcGIS Transport Security Improvements  Take-away's include: February 2019 – ArcGIS Online TLS 1.0 & 1.1 deprecation Upcoming ArcGIS Enterprise 10.7 – TLS 1.0, 1.1, and HTTP disabled by default June 2019 – ArcGIS Online HTTP deprecation + HSTS enforcement And MORE! --Randall ... View more

Important Update for ArcGIS and TLS Esri is committed to providing strong security for the ArcGIS platform by using the latest industry standards and best practices for security protocols. To meet these industry expectations, we are making an important update to ArcGIS Online on April 16, 2019 that is likely to affect most ArcGIS software and custom solutions. With this change, we are enforcing the use of TLS (Transport Layer Security) version 1.2 only and will remove support for earlier TLS versions 1.0 and 1.1.   More details about Esri’s support for TLS, including patches and instructions for updating software, can be found by visiting support.esri.com/en/tls.   Who is affected? Users of most ArcGIS software or custom solutions using Esri technology may be affected by this planned update to TLS protocol v1.2.   What do I need to do now? Go to the Esri TLS Support page for more information and specific actions you may need to take in advance of this update. Visit the GeoNet ArcGIS Platform and Transport Layer Security (TLS 1.2) Forum‌ to ask questions, view additional information and connect with Esri staff subject matter experts.    ... View more

Our team is frequently asked questions regarding privacy in our software.  Recently, a student asked a question regarding ArcGIS Maps for Power BI. Specifically, his organization required a risk assessment to be completed to understand what, if any, data is transmitted to ArcGIS Online.  Happily, Scott Ball‌ provided a thorough answer to this question in his blog here: FAQ - Data Security in ArcGIS Maps for Power BI As this space matures, we'll be aggregating similar privacy and security resources from various Esri Teams and referencing them via this space.  --Randall ... View more

What is Multi-Factor Authentication (MFA)? Multi-Factor Authentication (or MFA/2FA) is a feature that allows a user to provide two distinct pieces of evidence to a software solution to prove that you are who you say you are. Evidence includes supplying two of three factors at login time: something you know (like a password), something you have (like a smart card or soft token supplied via an app) or something you are (like a fingerprint or some other biometric marker). Credentials must be from two of these three factors – for example, providing two passwords is not considered MFA. In ArcGIS.com, multifactor authentication is implemented by requesting a verification code in addition to an ArcGIS Online organization name and password at login time. Why should my organization use MFA? Multi-Factor Authentication helps protect you and your organization by adding an additional layer of security to the login process, making it substantially more difficult for an unauthorized user to impersonate an authorized user when logging into ArcGIS Online. When MFA is enabled and configured, an unauthorized user needs to have both your username and password combination, and also access to your mobile device (which is assumed also requires a PIN or some biometric marker to access). Security Experts report that MFA is considered one of the top five best online security practices currently available. Using MFA can help prevent unauthorized access or changes to your ArcGIS Online organization, and can also help to prevent unauthorized modification or deletion of your organization’s content. How is MFA implemented in ArcGIS Online? Organizations can take advantage of this additional authentication and configure their organization to allow members to enable multifactor authentication on their ArcGIS Online accounts. To use this feature, organization members need to have an ArcGIS account and a mobile device with a supported authentication app installed on it. In ArcGIS Online, two administrators must exist in the organization to configure MFA. This requirement is to help support the potential use case of an administrator themselves losing access to their own device and authentication app. It is strongly recommended that ArcGIS Online administrators enable MFA for their accounts, if not for all ArcGIS Online organization accounts.     https://www.nist.gov/itl/tig/back-basics-multi-factor-authentication https://www.usenix.org/system/files/conference/soups2015/soups15-paper-ion.pdf ... View more

On November 2, 2018, ArcGIS Online's signing and encryption certificates have been updated.  ArcGIS Online has a new SAML signing and encryption certificate available. This certificate is necessary when an organization has enabled signed requests or encrypted assertions. The previous SAML signing and encryption certificate is due to expire on November 14th, 2018 and it is necessary to take action to ensure that your organization can continue to use your Enterprise Identity Provider (IDP). SAML enterprise logins that use the old certificate for signed requests or encrypted assertions will continue to work until Nov 13, 2018. Action: Users who have enabled the advanced options 'Enable Signed Requests' and/or 'Encrypt Assertion' will need to obtain the new ArcGIS Online Service Provider metadata file and associate it with their Identity Provider before November 14, 2018. Customers using these advanced options who do not upload the updated ArcGIS Online metadata file containing the new certificate before this date will receive an IDP specific error when they attempt to sign into ArcGIS Online with an Enterprise account. To obtain the updated metadata file: a. Login to www.arcgis.com with your administrative credentials b. Click on "Organization" then "Settings" then "Security" c. Scroll down to "Enterprise Logins" then click the "Get Service Provider" button.    - This action will download the metadata needed for your IDP. An email containing the following text has already been sent to ArcGIS Online Organization Administrators: "ArcGIS Online will be updating its SAML signing and encryption certificates on November 13th, and we need you to take action to ensure your organization can continue to use your Enterprise Identity Provider (IDP). This certificate is necessary when an Organization has enabled signed requests or encrypted assertions. To enable your IDP to discover our new certificates, you will need to re-register ArcGIS Online as your trusted services provider. The process for this varies by the SAML identity provider used, but tutorials on how to do this can be found in our documentation within the section titled 'Register ArcGIS Online as the trusted service provider'. Esri has documented this process for these popular Identity Providers: ADFS NetIQ Okta OpenAM Shibboleth SimpleSAML If you have any questions, please contact technical support." Esri Support Services has released a KB article describing this issue. See: Problem: ArcGIS Online SAML Authentication signing and encryption certificate renewal  ... View more