Hi Everyone,
I'm excited to share a comprehensive technical guide I've put together to address a dual-challenge many of us face daily: securing our Broadcom SiteMinder infrastructure while simultaneously using SiteMinder to protect downstream web applications against modern web vulnerabilities.
With the release of the OWASP Top 10:2025 standards, it's critical that our access management configurations keep pace with the evolving threat landscape. This guide acts as a direct prevention mapping, translating OWASP risks into specific SiteMinder 12.9 configuration controls and hardening steps.
- Document: Securing Broadcom SiteMinder and Web Applications Against the OWASP Top 10:2025
- Article ID: 453392
- Last Updated: August 24, 2026
Key Areas Covered in the Hardening Guide
1. A01:2025 - Broken Access Control
- Deny-by-Default: Ensuring all realms default to "Protected" and only permitting resources explicitly via policy.
- Step-Up & Re-authentication: Implementing higher Protection Levels (1-1000) for sensitive areas, forcing step-up challenges, and using the Validate Identity setting to require re-authentication for critical actions.
- URL Protection: Turning on the
SecureApps ACO parameter to prevent attackers from bypassing access controls by appending fake extensions (e.g., trying to access /scripts/myapp/junk.jpg).
2. A02:2025 - Cryptographic Failures & Protocol Hardening
- Modern TLS Standards: Moving to TLS v1.2/v1.3 and fully removing deprecated TLS v1.1 protocols and CBC-mode ciphers in favor of GCM ciphers (such as
TLS_ECDHE_RSA_With_AES_256_GCM_SHA384).
- Secure Session Cookies: Configuring
UseSecureCookies=Yes to ensure SMSESSION cookies are never transmitted in cleartext, and leveraging OpenSSL 3.0 standards (requiring at least 2048-bit certificate keys in FIPS-only environments).
- JWT Client Auth: Upgrading from legacy client secrets to cryptographically robust methods like
PRIVATE_KEY_JWT via the External Authentication Service Template.
3. A03:2025 - Injection and XSS Mitigation
- Secure Templates: Standardizing on the
smpolicy-secure.xml template (rather than the default smpolicy.xml) to block dangerous characters out-of-the-box.
- Character Filtering: Tuning parameters like
BadCSSChars, BadQueryChars, BadUrlChars, and enabling canonical check controls (DisallowUTF8NonCanonical=Yes) to stop evasion attempts.
4. Infrastructure & Administrative Security Hardening
- Isolate the Policy Server: Keeping Policy Servers safely behind your internal firewall and allowing access only from registered Web Agent/Access Gateway hosts.
- External Admin Stores: Moving away from legacy internal policy store administrators and migrating the Admin UI to use corporate directories (like Microsoft Active Directory) with MFA enforced via Access Gateway and Symantec VIP.
- API Abuse Prevention: Placing an API Gateway (such as the Broadcom Layer 7 API Gateway) in front of authentication and administrative REST APIs to enforce rate limiting, throttling, and IP whitelisting.
Accessing the Document
The full technical guide is available on the Broadcom Support Portal - https://knowledge.broadcom.com/external/article?articleId=453392