Security: Secure Sensitive Data Management
SSD Properties
Cisco 350XG & 550XG Series 10G Stackable Managed Switches
471
21
SSD Properties
SSD properties are a set of parameters that, in conjunction with the SSD rules,
define and control the SSD environment of a device. The SSD environment
consists of these properties:
•
Controlling how the sensitive data is encrypted.
•
Controlling the strength of security on configuration files.
•
Controlling how the sensitive data is viewed within the current session.
Passphrase
A passphrase is the basis of the security mechanism in the SSD feature, and is
used to generate the key for the encryption and decryption of sensitive data.
Devices of type 350 and 550 that have the same passphrase are able to decrypt
each other's sensitive data encrypted with the key generated from the
passphrase.
A passphrase must comply with the following rules:
•
Length—Between 8-16 characters.
•
Character Classes—The passphrase must have at least one upper case
character, one lower case character, one numeric character, and one special
character e.g. #,$.
Default and User-defined Passphrases
All devices come with a default, out-of-the box passphrase that is transparent to
users. The default passphrase is never displayed in the configuration file or in the
CLI/GUI.
If better security and protection are desired, an administrator should configure
SSD on a device to use a user-defined passphrase instead of the default
passphrase. A user-defined passphrase should be treated as a well-guard secret,
so that the security of the sensitive data on the device is not compromised.
A user-defined passphrase can be configured manually in plain text. It can also be
derived from a configuration file. (See
Sensitive Data Zero-Touch Auto
). A device always displays user-defined passphrases encrypted.
