Home
Security
Configure different security features to adequately protect business assets and resources in the data model when using BigFix Inventory.
Flow of data
There are several different interactions that occur between the components of the BigFix Inventory infrastructure and between the user and tool.

Security
Configure different security features to adequately protect business assets and resources in the data model when using BigFix Inventory.
- Flow of data
  There are several different interactions that occur between the components of the BigFix Inventory infrastructure and between the user and tool.
- Security configuration scenarios
  Check what security options need to be enabled on the BigFix server and the BigFix Inventory server to achieve each of the supported security scenarios.
- Configuring secure communication
  To ensure secure communication, BigFix Inventory uses public key cryptography, which is based on algorithms that use two separate keys, a private key and a public key. This key pair is used to encrypt and decrypt communication.
- Assuring compliance with federal encryption standards
  You can configure BigFix Inventory to be compliant with the Federal Information Processing Standard requirements that are related to encryption.
- Authenticating users with LDAP
  BigFix Inventory supports authentication through a Lightweight Directory Access Protocol server. To use this feature, you must configure the BigFix Inventory server.
- Configuring and enabling single sign-on
  Available from 9.2.1. You can now use the two-factor authentication and use single sign-on to log on to BigFix Inventory and maintain login consistency with other applications in the enterprise. You can configure BigFix Inventory to use two-factor authentication with single sign-on based either on the exchange of Security Assertion Markup Language (SAML 2.0) token and Microsoft™ Active Directory Federation Services as Identity Provider or you can use the IBM Lightweight Third-Party Authentication (LTPA) technology and IBM Security Access Manager for Web as the authentication service.
- Configuring passwords and encryption mechanisms
  To improve the application security, define a security policy for user passwords. You can also configure passwords and encryption mechanisms for the keystore in which the passwords are stored, and the BigFix Inventory database.
- Configuring user account lockout
  Available from 9.2.8. By default, user account is locked for 5 minutes after the user attempts to log in to BigFix Inventory more than 10 times within 5 minutes. You can change the default settings or disable the user account lockout.
- Configuring VM Manager Tool to accept trusted VM manager certificates
  By default, the VM Manager Tool accepts all VM manager certificates regardless of whether they are trusted or not. You can change the default behavior to ensure that only trusted certificates are accepted by the VM Manager Tool.
- Relays
  Relays lighten both upstream and downstream burdens on the server. Rather than communicating directly with a server, clients can instead be instructed to communicate with designated relays, considerably reducing both server load and client and server network traffic.

Flow of data

There are several different interactions that occur between the components of the BigFix Inventory infrastructure and between the user and tool.

Diagram illustrating the flow of data within BigFix Inventory

BigFix Inventory domain

This table describes the flow of data for the BigFix Inventory domain. There are four columns and two rows. Each row is divided in to two rows from column three.
Interaction	Type	Connection	Description
A	Web browser data traffic	Port	By default, the web browser connects to the BigFix Inventory server using port 9081 (HTTPS). You can disable the SSL/TLS connection tunnelling.
A	Web browser data traffic	Origination	The web browser connects to the BigFix Inventory server.
B	REST API data traffic	Port	By default, the web browser connects to the BigFix Inventory server using port 9081 (HTTPS). You can disable secure connection.
B	REST API data traffic	Origination	A client that uses REST API connections.

BigFix domain

This table describes the flow of data for the BigFix domain. There are four columns and two rows. Each row is divided in to two rows from column three.
Interaction	Type	Connection	Description
C	BigFix Console data traffic	Port	Consoles connect to root server using HTTPS 52311 for all interactions
		Origination	The BigFix console connects to the RootServer service.
		Network controls:	There is a "refresh rate" for each BigFix console user (default 15 seconds)
D	Gather, post, download	Port	Port 52311 is configurable by the BigFix administrator at installation time.
		Origination	The BigFix client initiates the request to the BigFix relay or server.
		Network controls:	Configurable bandwidth throttling to BigFix relay or clients Configurable gather interval. The default is `1` per day per fixlet site. Configurable minimum time to wait between posts. The default is `15` seconds. Configurable temporal distribution (spread out downloads over time) per action The ability to set "policy" to prevent computers from downloading files if they are not pointed at the proper BigFix relay
E	UDP new information message	Port	Port 52311 is configurable by the BigFix administrator at installation time.
		Origination	The UDP messages are sent from the BigFix clients' immediate parent, which can be either a BigFix relay or server.
		Network controls:	Configurable limit of the number of UDP messages sent at one time from a BigFix relay Configurable limit of the amount of time to wait after sending UDP messages from a BigFix relay
F	Relay selection	Port	The ICMP protocol does not use a port.
		Origination	Each BigFix client sends progressive rounds of ICMP packets to each relay with increasing TTLs until a BigFix relay responds. For example, in a network of 2 relays, one 1 hop away and one 2 hops away, the BigFix client sends an ICMP message to both with TTL 1 and receives 2 time exceeded messages from the local router. The BigFix client then sends an ICMP message to both relays with TTL 2 and receives one time exceeded message and one reply message. The BigFix client then chooses the relay that is one hop away.
		Network controls	Relay auto-selection can be disabled. Configurable interval for when the BigFix clients perform auto-selection Configurable limit on the maximum number of ICMP packets to send out in a time interval Configurable limit on the maximum number of rounds to send out during relay auto-selection
G	New data download from external BigFix fixlet servers	Port	80 (typically); possibly 21, 443
		Origination	The BigFix server connects to the BigFix fixlet servers
		Network controls	There is a configurable interval that the BigFix server checks for new fixlet messages.

The following database protocols are used:

ODBC
JDBC