The agent may initiate communication to Workload Security or it may be contacted by
Workload Security if the computer object is set to operate in bi-directional mode.
Workload Security treats all connections to agents in a similar way. If the agent
has not been activated, a limited set of interactions are possible. If the agent has
been activated (either by an administrator or via the agent-initiated activation feature),
the full set of interactions are enabled. Workload Security acts as an HTTP client
in all cases, regardless of whether it was the client when forming the TCP connection.
Agents cannot ask for data or initiate operations themselves. Workload Security requests
information such as events and status, invokes operations, or pushes configuration
to the agent. This security domain is highly controlled to ensure that agents have
no access to Workload Security or the computer that it is running on.
Both the agent and Workload Security use two different security contexts to establish
the secure channel for HTTP requests:
Procedure
- Before activation, the agent accepts the bootstrap certificate to form the SSL or TLS channel.
- After authentication, mutual authentication is required to initiate the connection.
For mutual authentication, the Workload Security certificate is sent to the agent
and the agent's certificate is sent to Workload Security. The agent validates that
the certificates come from the same certificate authority (which is Workload Security)
before privileged access is granted.Once the secure channel is established, the agent acts as the server for the HTTP communication. It has limited access to Workload Security and can only respond to requests. The secure channel provides authentication, confidentiality through encryption, and integrity. The use of mutual authentication protects against man-in-the-middle (MiTM) attacks where the SSL communication channel is proxied through a malicious third party. Within the stream, the inner content uses GZIP and the configuration is further encrypted using PKCS #7.