# Security and AccessControl **URL:** \ **Category:** Elasticsearch\ **Created:** [October 4, 2012, 3:30pm UTC](https://discuss.elastic.co/t/security-and-accesscontrol/9241 "2012-10-04T15:30:21Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![TheOutlander\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theoutlander_2/32/2614_2.png) [@TheOutlander\_2](https://discuss.elastic.co/u/TheOutlander_2)\ **Post date:** [October 4, 2012, 3:30pm UTC](https://discuss.elastic.co/t/security-and-accesscontrol/9241/1 "2012-10-04T15:30:21Z")
1. Is ElasticSearch PCI DSS compliant? 2. What is the recommended strategy for access control? Is it fail-safe? Thanks, Nick -- ---
**Author:** ![drewr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drewr/32/7803_2.png) [@drewr](https://discuss.elastic.co/u/drewr)\ **Post date:** [October 4, 2012, 4:03pm UTC](https://discuss.elastic.co/t/security-and-accesscontrol/9241/2 "2012-10-04T16:03:32Z")
TheOutlander wrote: > 1. Is Elasticsearch PCI DSS compliant? > > 2. What is the recommended strategy for access control? Is it > fail-safe? ES is currently not secure in any way. It is meant to be a highly available, low-level data store. You should hide it in your infrastructure behind something that complies with your security model. If you'd like a modest level of access control for the REST endpoints, have a look at the Jetty plugin: [GitHub - sonian/elasticsearch-jetty](https://github.com/sonian/elasticsearch-jetty) And by modest I mean really modest. It only adds basic auth to the HTTP interface (by replacing the Netty HTTP layer). Someone could still speak directly to internal transport channels if the cluster wasn't protected. Improving this story is something that's on the radar for ES, although I don't know of any timeline for it. -Drew -- ---
**Author:** ![TheOutlander\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theoutlander_2/32/2614_2.png) [@TheOutlander\_2](https://discuss.elastic.co/u/TheOutlander_2)\ **Post date:** [October 5, 2012, 10:28am UTC](https://discuss.elastic.co/t/security-and-accesscontrol/9241/3 "2012-10-05T10:28:42Z")
Thanks! I'm going to check their security standards documentation[https://www.pcisecuritystandards.org/documents/pci\_dss\_v2.pdf](https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf), but does anyone know if that means we will fail a PCI DSS audit? -Nick On Thursday, October 4, 2012 9:03:32 AM UTC-7, Drew Raines wrote: > TheOutlander wrote: > > > 1. Is Elasticsearch PCI DSS compliant? > > > > 2. What is the recommended strategy for access control? Is it > > fail-safe? > > ES is currently not secure in any way. It is meant to be a highly > available, low-level data store. You should hide it in your > infrastructure behind something that complies with your security > model. > > If you'd like a modest level of access control for the REST > endpoints, have a look at the Jetty plugin: > > [GitHub - sonian/elasticsearch-jetty](https://github.com/sonian/elasticsearch-jetty) > > And by modest I mean really modest. It only adds basic auth to the > HTTP interface (by replacing the Netty HTTP layer). Someone could > still speak directly to internal transport channels if the cluster > wasn't protected. > > Improving this story is something that's on the radar for ES, > although I don't know of any timeline for it. > > -Drew -- ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [October 5, 2012, 4:25pm UTC](https://discuss.elastic.co/t/security-and-accesscontrol/9241/4 "2012-10-05T16:25:41Z")
There is no security/authorization/authentication in Elasticsearch, so I would assume it will fail most types of audits. The HTTP/REST protocol is plain-text and the Java/binary protocol is not encrypted in anyway. Storage is in the Lucene format, which also has no security. That said, Elasticsearch is working just fine at numerous companies. The cluster should live behind a firewall, and if REST is needed, a proxy can be used to filter requests. -- Ivan On Fri, Oct 5, 2012 at 3:28 AM, TheOutlander [theoutlander@gmail.com](mailto:theoutlander@gmail.com) wrote: > Thanks! I'm going to check their security standards documentation[https://www.pcisecuritystandards.org/documents/pci\_dss\_v2.pdf](https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf), > but does anyone know if that means we will fail a PCI DSS audit? > > -Nick > > On Thursday, October 4, 2012 9:03:32 AM UTC-7, Drew Raines wrote: > > > TheOutlander wrote: > > > > > 1. Is Elasticsearch PCI DSS compliant? > > > > > > 2. What is the recommended strategy for access control? Is it > > > fail-safe? > > > > ES is currently not secure in any way. It is meant to be a highly > > available, low-level data store. You should hide it in your > > infrastructure behind something that complies with your security > > model. > > > > If you'd like a modest level of access control for the REST > > endpoints, have a look at the Jetty plugin: > > > > [https://github.com/sonian/\*\*elasticsearch-jetty](https://github.com/sonian/**elasticsearch-jetty)[https://github.com/sonian/elasticsearch-jetty](https://github.com/sonian/elasticsearch-jetty) > > > > And by modest I mean really modest. It only adds basic auth to the > > HTTP interface (by replacing the Netty HTTP layer). Someone could > > still speak directly to internal transport channels if the cluster > > wasn't protected. > > > > Improving this story is something that's on the radar for ES, > > although I don't know of any timeline for it. > > > > -Drew > > -- -- ---
**Author:** ![cocowalla](https://avatars.discourse-cdn.com/v4/letter/c/e36b37/32.png) [@cocowalla](https://discuss.elastic.co/u/cocowalla)\ **Post date:** [October 12, 2012, 11:09am UTC](https://discuss.elastic.co/t/security-and-accesscontrol/9241/5 "2012-10-12T11:09:04Z")
There is no easy answer to this - like everything, these answer is 'maybe'. It will depend on who your QSA is, how elasticsearch is configured, how you are using it, and where it resides in your network. For example, if it is located outside of your 'card holder environment', then your auditor will be far more lenient about restrictions. PCI DSS also allows for 'compensating controls' - so it's not always the case that everything has to be followed to the letter. For example, elasticsearch operates over unsecured, plain-text protocols - but you can use firewalls to mitigate various risks, and you could build your own secure service layer through which the elasticsearch API is accessed indirectly. So... there are no easy answers to this question, and I can only suggest you consult your QSA. Sorry 🙂 On Thursday, October 4, 2012 4:30:21 PM UTC+1, TheOutlander wrote: > 1. Is Elasticsearch PCI DSS compliant? > > 2. What is the recommended strategy for access control? Is it fail-safe? > > Thanks, > Nick -- ---
**Author:** ![TheOutlander\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theoutlander_2/32/2614_2.png) [@TheOutlander\_2](https://discuss.elastic.co/u/TheOutlander_2)\ **Post date:** [October 19, 2012, 1:09am UTC](https://discuss.elastic.co/t/security-and-accesscontrol/9241/6 "2012-10-19T01:09:59Z")
Thanks for your response. It's certainly helpful. It sounds like it is possible to make the infrastructure around ES more secure and be compliant. We plan on getting it audited externally. For now, we plan on using Mongo for that particular project. Thanks, Nick On Friday, October 12, 2012 4:09:04 AM UTC-7, cocowalla wrote: > There is no easy answer to this - like everything, these answer is 'maybe'. > > It will depend on who your QSA is, how elasticsearch is configured, how > you are using it, and where it resides in your network. For example, if it > is located outside of your 'card holder environment', then your auditor > will be far more lenient about restrictions. > > PCI DSS also allows for 'compensating controls' - so it's not always the > case that everything has to be followed to the letter. For example, > elasticsearch operates over unsecured, plain-text protocols - but you can > use firewalls to mitigate various risks, and you could build your own > secure service layer through which the elasticsearch API is accessed > indirectly. > > So... there are no easy answers to this question, and I can only suggest > you consult your QSA. Sorry 🙂 > > On Thursday, October 4, 2012 4:30:21 PM UTC+1, TheOutlander wrote: > > > 1. Is Elasticsearch PCI DSS compliant? > > > > 2. What is the recommended strategy for access control? Is it fail-safe? > > > > Thanks, > > Nick -- ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 3:07am UTC](https://discuss.elastic.co/t/security-and-accesscontrol/9241/7 "2017-07-06T03:07:58Z")