Can I have confidence that my data is safe on an appliance?

Field Effect appliances are physical devices installed on a client network that, owing to their privileged location within the client environment, can establish specific connections inside and outside of a client network. These connections are necessary for the proper operation and management of the appliance and to provide value-added security and defense in-depth. 

Here are some points around the security considerations for the appliance: 

Remote Access: Most of the “day-to-day” operation of the appliance is entirely autonomous and does not require human interaction or intervention. Once the appliance establishes the OpenVPN connection between a client site and Field Effect's operational network, telemetry such as logs and metrics passes through an SSH tunnel within the VPN, and Field Effect uses it for monitoring and alerting. Automated tasks that run through the established tunnel perform appliance configuration. In rare cases, a member of the Field Effect operational team may require remote access to an appliance. If an operator does need to connect to an appliance, there is an audit trail indicating which individual logged into which appliance at what time.

Appliance Security: At the Operating System level, Field Effect leverages iptables for fine-tuned network control and AppArmor for application security.AppArmor confines programs to a specific set of resources, and Field Effect uses it on appliances to enhance the security of programs such as mysql, named, rsyslog, tcpdump, and others. System level services that are not required and that do not directly contribute to the function of Field Effect are disabled by default. By default, the appliance encrypts all data at rest and all data in transit to and from it. 

Agent Tasking: The Field Effect appliance exposes an API that allows specific, privileged members of Field Effect to issue commands through the Field Effect agent running on endpoint machines. This requires specific role-based access that is limited to select users with signed keys that can issue signed commands. In such cases there is, again, an audit trail which user issued what command and when. 

Exploit Vectors: A threat actor could theoretically gain access to an appliance to establish a foothold in a client environment. As highlighted throughout, Field Effect has put various processes and protection in place to significantly reduce the viability of an actor to gain such a foothold. For example, a threat actor would need to compromise private SSH keys, on the operational network, and connect in through the VPN to gain access to an appliance. Assuming an actor does gain access to an appliance, the following holds true: 

1. An attacker cannot communicate with or task an endpoint agent on the client network. 
2. An appliance requires SSH out to the client-specific relay, nowhere else. SSH “fact of” connections are logged and stored in the same manner as audit logs. 
3. An attacker with access to an appliance could run tcpdump on an interface to view client traffic that the appliance captures. 
4. Lateral movement within a client network from a Field Effect appliance would not be possible with the limited tools available on the system. This type of activity would also be highly anomalous, and Field Effect monitoring would likely detect it.