{"id":330112,"date":"2018-12-20T18:00:36","date_gmt":"2018-12-21T02:00:36","guid":{"rendered":"http:\/\/www.esri.com\/arcgis-blog\/?post_type=blog&p=330112"},"modified":"2019-01-02T11:18:32","modified_gmt":"2019-01-02T19:18:32","slug":"changes-to-organization-security-settings","status":"publish","type":"blog","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/product\/administration\/changes-to-organization-security-settings","title":{"rendered":"Changes to organization security settings"},"author":5721,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","meta":{"_acf_changed":false,"_searchwp_excluded":""},"categories":[37501],"tags":[42641,24941,239942,24071,220392],"industry":[],"product":[],"class_list":["post-330112","blog","type-blog","status-publish","format-standard","hentry","category-administration","tag-arcgis-online","tag-https","tag-organization-administration","tag-security","tag-whats-new-september-2018"],"acf":{"short_description":"The September 2018 ArcGIS Online release introduces several changes to organization security settings. ","flexible_content":[{"acf_fc_layout":"content","content":"

An ArcGIS Online update earlier this year introduced a couple of changes to the security settings available for your ArcGIS Online organization. The changes are related to the\u00a0Allow access to the organization through HTTPS only <\/strong>and Allow only standard SQL queries <\/strong>security settings. <\/strong>To help ensure a secure platform for your organization\u2019s hosted resources, we\u2019ve made a few changes to these settings. \u00a0If your organization already has these options enabled, you\u2019re set! You will no longer see them as configurable options in your organization\u2019s settings. If you have one or both options disabled, you will see a Warning banner with a recommendation that you enable these options for your organization. These changes are part of a larger commitment to providing a secure platform. In 2019, you will see additional security enhancements to the ArcGIS platform. Esri’s Chief Information Security Officer, Michael Young, detailed these enhancements in a recent blog post,\u00a02019 ArcGIS Transport Security Improvements.<\/a><\/p>\n

 <\/p>\n"},{"acf_fc_layout":"image","image":{"ID":347712,"id":347712,"title":"Security Settings","filename":"SecuritySettings1.jpg","filesize":73188,"url":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/SecuritySettings1.jpg","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/product\/administration\/changes-to-organization-security-settings\/securitysettings1","alt":"ArcGIS Online security policies","author":"5721","description":"","caption":"ArcGIS Online security policies","name":"securitysettings1","status":"inherit","uploaded_to":330112,"date":"2018-10-26 22:17:24","modified":"2018-10-26 22:17:53","menu_order":0,"mime_type":"image\/jpeg","type":"image","subtype":"jpeg","icon":"https:\/\/www.esri.com\/arcgis-blog\/wp-includes\/images\/media\/default.png","width":975,"height":683,"sizes":{"thumbnail":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/SecuritySettings1.jpg","thumbnail-width":213,"thumbnail-height":149,"medium":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/SecuritySettings1.jpg","medium-width":373,"medium-height":261,"medium_large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/SecuritySettings1.jpg","medium_large-width":768,"medium_large-height":538,"large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/SecuritySettings1.jpg","large-width":975,"large-height":683,"1536x1536":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/SecuritySettings1.jpg","1536x1536-width":975,"1536x1536-height":683,"2048x2048":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/SecuritySettings1.jpg","2048x2048-width":975,"2048x2048-height":683,"card_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/SecuritySettings1.jpg","card_image-width":664,"card_image-height":465,"wide_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/SecuritySettings1.jpg","wide_image-width":975,"wide_image-height":683}},"image_position":"center","orientation":"horizontal","hyperlink":""},{"acf_fc_layout":"sidebar","content":"

What is HTTPS?<\/strong><\/h3>\n

HTTPS<\/a>, short for Hypertext Transfer Protocol for secure communication (and commonly referred to as TLS or SSL), provides a layer of security for data transmission over the Internet. When HTTPS is used, incoming and outgoing communication between your browser\u00a0and the server providing the data is encrypted, which secures the information while in transit. Anyone monitoring\u00a0the traffic between you and the\u00a0layer is not able to see the information being transmitted.<\/p>\n

One of the main drawbacks for using HTTPS has been that it is not as fast as HTTP. However, advances in web technology have closed the gap, specifically with the introduction of HTTP\/2<\/a>.\u00a0 In many cases, HTTPS is now faster than HTTP. <\/em>HTTPS has become the internet standard, with the majority of the most popular websites and internet traffic overall using HTTPS. It is recommended that all communication over the internet use HTTPS.<\/p>\n","image_reference":{"ID":347732,"id":347732,"title":"HTTP vs HTTPS","filename":"HTTP-vs-HTTPS.png","filesize":14862,"url":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/HTTP-vs-HTTPS.png","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/product\/administration\/changes-to-organization-security-settings\/http-vs-https","alt":"HTTP vs HTTPS","author":"5721","description":"","caption":"","name":"http-vs-https","status":"inherit","uploaded_to":330112,"date":"2018-10-26 22:36:05","modified":"2018-10-26 22:36:17","menu_order":0,"mime_type":"image\/png","type":"image","subtype":"png","icon":"https:\/\/www.esri.com\/arcgis-blog\/wp-includes\/images\/media\/default.png","width":648,"height":330,"sizes":{"thumbnail":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/HTTP-vs-HTTPS.png","thumbnail-width":213,"thumbnail-height":108,"medium":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/HTTP-vs-HTTPS.png","medium-width":464,"medium-height":236,"medium_large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/HTTP-vs-HTTPS.png","medium_large-width":648,"medium_large-height":330,"large":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/HTTP-vs-HTTPS.png","large-width":648,"large-height":330,"1536x1536":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/HTTP-vs-HTTPS.png","1536x1536-width":648,"1536x1536-height":330,"2048x2048":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/HTTP-vs-HTTPS.png","2048x2048-width":648,"2048x2048-height":330,"card_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/HTTP-vs-HTTPS.png","card_image-width":648,"card_image-height":330,"wide_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/09\/HTTP-vs-HTTPS.png","wide_image-width":648,"wide_image-height":330}},"layout":"image","image_reference_figure":"","snippet":"","spotlight_name":"","section_title":"","position":"Right","spotlight_image":false},{"acf_fc_layout":"content","content":"

Why HTTPS matters for your organization<\/strong><\/h3>\n

HTTPS helps secure your organization\u2019s assets. For instance, when you view data (as part of a layer, map, or app) or collect data (as part of a survey, for example), HTTPS helps ensure nobody can see the data aside from the people you share it with. Many government agencies, especially at the federal level, have stringent requirements for how data must be secured. Esri has done a considerable amount of work to meet these requirements (adhering to guidelines from FedRamp, FISMA, and GDRP to name a few), and will continue to enhance security for ArcGIS Online and the ArcGIS platform overall. See ArcGIS Trust Center<\/a> for more information regarding Esri\u2019s compliance with these initiatives.<\/p>\n

When the HTTPS only setting is enabled for your organization, your data hosted in ArcGIS Online can only be accessed over HTTPS. HTTP is effectively disabled. Any communication between you (or anyone else) and your ArcGIS Online organization is only over HTTPS, whether that is through a browser, device or desktop application.<\/p>\n

With a cloud-based SaaS such as ArcGIS Online, using HTTPS for\u00a0communication over the internet is one of the most important steps you can take to secure sensitive information.<\/p>\n

Additionally, the main browsers (Google Chrome, Mozilla Firefox, Microsoft Edge \/ Internet Explorer 11, and Apple Safari) are becoming increasingly strict with HTTP traffic, with browser updates frequently introducing tighter controls that either alert you to security issues with\u00a0websites or block you from visiting websites the browser deems unsafe.<\/p>\n

See Why should my organization use HTTPS only?<\/a> for more information.<\/p>\n"},{"acf_fc_layout":"content","content":"

How to upgrade your organization to HTTPS only<\/strong><\/h3>\n

To enable the HTTPS only setting for your organization, go to the settings tab of your organization page and select Security. In the Policies section, you will see Allow access to the organization with HTTPS only under the Warning banner. If you don\u2019t see this option or the option is enabled, your organization is already enabled for HTTPS only!<\/p>\n

Here are a few items to consider when enabling the HTTPS only setting for your organization.<\/p>\n