Application Server Security Recommendations

When configuring SSL on the PPM application server, keep your keystore in a private directory with restricted access. The keystore is password protected. Although the Java keystore is password protected, it is vulnerable as long as the password was not changed from its default value of changeit.

• Always change default passwords.

• Always encrypted the password in the server configuration. See Configure secure PPM pages.

• Since the default admin user password is documented in PPM, it is strongly recommended to change the admin user’s password.
• Always change the default password when creating a database schema.
• Always use the minimal possible permissions when installing and running PPM.

See Administer Project and Portfolio Management to learn the minimal permission requirements.