Protecting a System with SGNL

Introduction

Protected Systems are applications, services, or infrastructure that you want to protect with SGNL. Protected Systems will commonly have a SGNL SDK, Proxy, or some other logic embedded in or near to them that will make an access request to SGNL.

Protected Systems need not know about the policies, data sources, or any of the data in SGNL - they simply need to know and pass to SGNL:

  • Who/What is requesting the access (The Principal)
  • (Optional) What is attempting to be accessed (The Asset)
  • (Optional) What operation is being attempted on the asset (The Action)
  • An access token that ensures the Integration is a legitimate caller into SGNL

Prerequisites

  • A SGNL Client
  • A SGNL User Account with Admin privileges
  • At least 1 data source integrated to SGNL, containing principals and (optionally) assets that will be evaluated in access evaluations
  • (Optional) 1 or more policies that you want assigned to the integration

Creating an Integration

  1. Log-In to your SGNL Client with an Admin Account

  2. From the left navigation pane, select Protected Systems and Add an Integration, or simply click Add from the SGNL Dashboard

    SGNL - Protected Systems

  3. Give your integration a descriptive display name and description

  4. Specify the Default Policy to be applied to your integration

    • Allow: If no policies provide a decision for an access request, SGNL will respond to the access request with an Allow decision
    • Deny: If no policies provide a decision for an access request, SGNL will respond to the access request with a Deny decision

    SGNL - Add Integration

  5. Next, you’ll need to configure which identifier the Integration will use to describe a principal

    • This may be an email address or Username that can be found in your IdP, or an EmployeeID in your HRIS system
  6. You’ll also need to configure the types of Assets that exist in the system, that will be sent from the integration

    • This might be customer identifiers found in your CRM system, or labels found in your DLP solution

    SGNL - Integration Settings

  7. Once configured, click Continue to save your Integration and move on to other configuration steps

Assigning Policies

  1. Once the Integration is created, you can start assigning versions of Policies to the integration - to get started, select Policies from the tabs in your newly created integration

    SGNL - Policies

  2. Select ‘Assign Policies’

  3. Select:

    • The Policies you want to apply to the integration with the check box
    • The version of the Policy you want applied

    SGNL - Select Policies

  4. Click Next once you have the Policies and Versions configured as is appropriate

  5. Select the Enforcement mode for the Policies you chose in the previous step

    • Simulated: Policy Versions that are being simulated will only log their access decision in the SGNL logs and will not impact the access decision that SGNL hands back to an integration. Simulated policies are useful for performing what-if analysis of new policy versions as well as debugging policy changes.

      Note: It’s considered best practice to start with policies in Simulated mode, to verify that policies have been created an applied as expected

    • Enforced: Policy Versions that are being enforced will impact the access decisions that SGNL hands back to an integration. Enforced Policies will determine access for an integration

    SGNL - Set Enforcement

  6. Select your desired Enforcement mode and select Assign

  7. Versions of Policies will now be Assigned to your integration

    SGNL - Policy Assignments

Configuring Authentication

  1. Authentication ensures that only authorized integrations can make requests into SGNL, as well as verifying the identity of an integration in order to effectively evaluate Policies - to access Authentication settings, open your Integration and select the Authentication tab

    SGNL - Authentication

  2. Click Generate Token

  3. Give your Token a descriptive name so that you know how it’s being used in the future and click to Generate Token

    SGNL - Generate Token

  4. On the next screen, copy the token - this will be used in your integration to make access requests to SGNL using the SGNL Access Service API

    Note: The value of this token is not available again after this screen, so ensure you securely store it

    SGNL - Token