Passphrase; Default And User-Defined Passphrases; Local Passphrase - Cisco SF500-24 Administration Manual

23
447

Passphrase

A passphrase is the basis of the security mechanism in the SSD feature, and is
used to generate the key for the encryption and decryption of sensitive data.
Sx200, Sx300, Sx500, and SG500X/ESW2-550X series switches that have the
same passphrase are able to decrypt each other's sensitive data encrypted with
the key generated from the passphrase.
A passphrase must comply with the following rules:
• Length—Between 8-16 characters.
• Character Classes—The passphrase must have at least one upper case
character, one lower case character, one numeric character, and one special
character e.g. #,$.

Default and User-defined Passphrases

All devices come with a default, out-of-the box passphrase that is transparent to
users. The default passphrase is never displayed in the configuration file or in the
CLI/GUI.
If better security and protection are desired, an administrator should configure
SSD on a device to use a user-defined passphrase instead of the default
passphrase. A user-defined passphrase should be treated as a well-guard secret,
so that the security of the sensitive data on the device is not compromised.
A user-defined passphrase can be configured manually in plain text. It can also be
derived from a configuration file. (See
Configuration). A device always displays user-defined passphrases encrypted.

Local Passphrase

A device maintains a local passphrase which is the passphrase of its Running
Configuration. SSD normally performs encryption and decryption of sensitive data
with the key generated from the local passphrase.
The local passphrase can be configured to be either the default passphrase or a
user-defined passphrase. By default, the local passphrase and default
passphrase are identical. It can be changed by administrative actions from either
the Command Line Interface (if available) or the web-based interface. It is
Cisco 500 Series Stackable Managed Switch Administration Guide Release 1.3
Security: Secure Sensitive Data Management
Sensitive Data Zero-Touch Auto
SSD Properties