Skip to main content

Security

This section covers how Breeze Agent is secured: least‑privilege execution, artifact integrity, authentication, and data handling.

Key Controls​

  • Mutual authentication — the agent presents a certificate issued by Breeze Server; the server presents its own certificate, which the agent validates before exchanging data.
  • Transport security — all Breeze Agent ↔ Breeze Server communications use HTTPS with FIPS‑compliant algorithms.
  • Signed operations — requests and responses are cryptographically signed to ensure integrity and prevent tampering.
  • Auditing — Breeze Server logs agent communications for security auditing and troubleshooting.

Change Control & Release Roles​

Cloudaware maintains strict separation of duties for Breeze components:

  • Separate teams for server, installer, and plugin development.
  • Security review engineers perform code review and static analysis (for example, SAST) but cannot commit code.
  • CA Trust Team signs plugins, installers, and server releases based on review outcomes.

Plugin Types​

  • Discovery (read‑only): collect facts (users, packages, services, hardware, cloud metadata, etc.) without modifying the host.
  • Security & management: install/uninstall software, configure services, and enforce desired state (for example, vulnerability management, IDS, monitoring agents, OS patching, TunHub and other integrations).

Permissions & Least Privilege​

Use Permissions & Least Privilege to decide how much access Breeze Agent should have on a host.

This guide covers discovery-only deployments, elevated privileges for management plugins, file system access, scheduler configuration, and outbound network exposure.

Signing & Integrity​

Use Signing & Integrity to review how Breeze Agent protects trust in installers, updates, plugin operations, and agent-server communication.

This guide explains installer authenticity, mutual authentication, transport security, and signed payload validation.

Data Handling​

Use Data Handling to understand what Breeze Agent collects, what it avoids collecting, and how Breeze-derived data is protected after ingestion.

This guide also explains how CMDB access controls apply to the data Breeze contributes.