Skip to content

Security Best Practices for HySecure Deployment and Maintenance

The recommendations on this page reflect Accops' experience supporting HySecure deployments across a wide range of production environments. They are provided as guidance to help administrators make informed security decisions during deployment and ongoing maintenance.

Every deployment is different. These recommendations may not apply equally to all environments, and some may require adaptation to meet the organization's specific requirements. For guidance tailored to a specific deployment, contact Accops Support.

Platform Integrity

Dedicated Appliance

HySecure runs on a security-hardened, purpose-built Linux distribution. Accops recommends treating the gateway appliance (whether physical or virtual) as a dedicated security appliance rather than a general-purpose server.

Software and Workload Isolation

Accops recommends against installing third-party software on the HySecure appliance or virtual machine. This includes antivirus agents, monitoring clients, backup tools, and custom scripts that are not part of the HySecure distribution. Third-party software introduces unvalidated dependencies and expands the attack surface in ways that Accops cannot test for or support.

We also recommend against running non-HySecure workloads on the same host. If additional services are required, deploy them on separate, dedicated infrastructure.

Network Architecture

Gateway placement. Accops recommends deploying the HySecure Gateway in a DMZ (demilitarized zone), a network segment accessible from the internet but isolated from the internal LAN. This limits exposure if the gateway is attacked.

Management Console access. We recommend that the Management Console should not be directly accessible from the internet. Access should be restricted to the internal management network or routed through a dedicated jump host. Refer to Configure Administration Access Restrictions for guidance on restricting Console access by IP address.

Cluster nodes. For cluster deployments, Accops recommends placing all cluster nodes within the same subnet, with no firewall between them.

Administration and Access Control

HySecure provides distinct administrative roles: Security Officer, Administrator, L1 Support, and Monitor. Accops recommends assigning roles based on the principle of least privilege. Each administrator should hold only the access required to perform their specific function.

We recommend against using a single full-privilege account for all administrative activities. Separating day-to-day configuration (Administrator) from security policy management (Security Officer) reduces the risk of unintended changes to critical policies.

For cluster environments, Accops recommends that all cluster administration be performed from the Active node.

Authentication Hardening

Accops strongly recommends enforcing multi-factor authentication for all users via HyID policies. A HySecure deployment that relies on password-only authentication in production does not take advantage of the security controls the gateway is designed to provide.

Additional recommendations:

  • Device ID policies: We recommend enabling Device ID policies to restrict access to trusted devices. This prevents unauthorized devices from establishing sessions even when valid credentials are presented.
  • Account Lockout: We recommend enabling Account Lockout Access Controls to limit repeated authentication attempts and reduce exposure to brute-force attacks.
  • Password policy: Accops recommends applying a strong password policy for all native (local) users. Refer to Password Policy for configuration details.

Endpoint Security

Host Scan policies. Accops recommends enabling Host Scan policies on all production setups. Granting access to unmanaged or non-compliant endpoints undermines the endpoint security posture that HySecure is designed to enforce.

Endpoint Protection. We also recommend enabling Endpoint Protection policies to define the security requirements for connecting devices.

Continuous re-evaluation (CARTA). For high-security environments, Accops recommends continuous EPS re-evaluation (CARTA), introduced in HySecure Gateway 7.3 SP1. This capability re-evaluates endpoint compliance throughout the session, not only at login. A device that becomes non-compliant during an active session is detected and disconnected before it can continue accessing resources.

Refer to Configure Continuous Re-Evaluation for Endpoint Security for configuration details.

Certificate Management

HySecure uses a self-signed certificate by default. Accops recommends replacing the default certificate with one signed by a trusted Certificate Authority (CA) before going live in a production environment. Self-signed certificates trigger browser security warnings and can condition users to dismiss them, a pattern that weakens security awareness over time.

We recommend monitoring certificate expiry proactively and initiating renewal well before the expiration date. Refer to SSL Certificate for the process of installing a CA-signed certificate.

SSH Hardening

SSH access to the HySecure gateway is enabled by default. Accops recommends disabling SSH when remote shell access is not operationally required. The SSH server state can be controlled from the Management Console under Settings > Service Config > SSH Server.

If SSH access is operationally necessary, we recommend restricting it to specific, known IP addresses. Leaving SSH access open to broad network ranges in a production environment unnecessarily increases exposure.

Backup and Recovery

Accops recommends configuring both User Backup and System Backup, with backup files delivered to an FTP server or via email using the Auto Backup feature, to protect against configuration loss and support disaster recovery.

Backup Types

HySecure supports two (2) backup types:

  • User Backup: Covers ACL policies, HyID configurations, authentication server settings, and user and device data. User certificates are not included in this backup type.
  • System Backup: Covers certificates (including user certificates) and system-level configuration.

Off-appliance Storage

Accops recommends running both backup types regularly and storing backup files on a host separate from the appliance. Files stored only on the gateway are not available if the gateway itself fails or needs to be rebuilt from scratch.

Note

User backups can be restored only on the same version or a later version of HySecure Gateway. Refer to the release notes for version compatibility details.

Patch and Firmware Management

Apply Hotfixes Promptly

Accops releases security hotfixes and firmware updates regularly. We recommend applying security hotfixes within a reasonable timeframe after release, particularly those that address vulnerabilities relevant to the deployment's threat profile. Security hotfix release notes, including addressed vulnerabilities and affected versions, are published on the Accops HySecure Security Hotfix Release Notes page.

Stay Informed

Accops notifies registered customers of security advisories and new releases via email. We recommend keeping administrator contact details registered with Accops up to date so that notifications reach the right people promptly.

Plan Upgrade Windows

For firmware upgrades, Accops recommends scheduling upgrades during a planned maintenance window, preferably during off-peak hours, to minimize disruption to active users. Refer to Upgrading HySecure Cluster for the recommended upgrade procedure.

Monitoring, Alerting, and Audit

Alert Manager

Accops recommends enabling the Alert Manager and configuring thresholds for CPU, RAM, disk, swap space, and license utilization. Configure email delivery to Security Officers and Administrators so that resource or compliance issues are brought to attention promptly.

The Alert Manager is accessible under Settings > Logs > Alert Manager.

Log Forwarding

Accops recommends forwarding gateway logs to the Accops Reporting Server (ARS) or an external Syslog or SIEM server. Logs stored only on the gateway appliance may be unavailable during an incident that involves the appliance itself. Additionally, HySecure's built-in log archival policy retains only a limited number of log files per log type, as configured in the log archival settings, and local storage alone is not suitable for a long-term audit trail. Log forwarding is configured under Settings > Logs > Syslog.

Admin Log Review

We recommend reviewing Admin Logs regularly to detect unauthorized or unintended configuration changes. Admin Logs are available under Reports > Logs > Admin.

Event Notifications

Accops recommends configuring email notifications for the following critical events:

  • Account lockout
  • Access Control expiry

User and Access Hygiene

Stale User Management

When users are removed from Active Directory or LDAP, their HySecure policies and registered profiles are not automatically revoked. Accops recommends enabling the Stale User Management feature and running scans on a regular schedule. This ensures that former employees or contractors do not retain access through stale HySecure profiles.

Stale User Management is available under Diagnose > Maintenance.

Access Device Cleanup

We recommend configuring Access Device Cleanup Policies to remove stale Access Devices over time. Devices that are no longer in active use should not remain registered against user accounts indefinitely. Refer to Configure Access Device Cleanup Policies for configuration details.

ACL Review

Accops recommends auditing Access Control Lists periodically. Rules that reference users, groups, or applications that are no longer active should be identified and removed. ACL configurations that accumulate over time without review become increasingly difficult to audit and are more likely to contain unintended access grants.

Turbo Tunnel Considerations

ACL Enforcement

For deployments that use Turbo Tunnel, Accops recommends verifying that ACL enforcement is explicitly enabled before deploying in a production environment. When ACL enforcement is inactive, Turbo session traffic is not restricted by access rules. This configuration setting should be verified before go-live rather than assumed.

IP Address Pool Design

We also recommend designing the Turbo IP address pool so that it does not overlap with any existing network range in the environment, including LAN segments, DMZ networks, and application server subnets. An overlapping pool can cause unpredictable connectivity behavior during Turbo sessions.

Refer to Turbo Tunnel: When and Why to Use It for guidance on ACL enforcement and IP pool design.

Need Guidance for a Specific Deployment?

The recommendations on this page are based on general best practices drawn from Accops' experience across production HySecure deployments. Individual environments may have specific requirements that call for a different approach.

For questions about applying these recommendations to a specific setup or for assistance with configuration, contact Accops Support.

Support Portal: https://www.accops.com/support