NetCrunch Security Features
How NetCrunch protects access to the console and the credentials it holds — multi-factor authentication, a master key for stored secrets, encrypted backups, and restricted access to the data folder.
A monitoring system is a high-value target. It holds credentials for much of the estate it watches, and it can reach machines that nothing else can reach. The features below protect the two things worth protecting: who can get in, and what they would find if they did.
This set grows with each release. What follows is what is available now.
mfa
Multi-Factor Authentication
Signing in can require a second factor in addition to the account password, in both the Web Console and the Desktop Console.
It applies to every connection type — the encrypted TCP connection the Desktop Console uses, a browser or console arriving over HTTPS, and connections relayed through the NetCrunch Connection Cloud. There is no route into a console that skips it. See NetCrunch Connections for the connection types themselves.
The second factor is a time-based code from an authenticator app. There is no SMS or email option.
Turning It On
Multi-factor authentication is a property of the user profile, not a global switch: each profile carries a Requires Multi Factor Authentication option. You can require it of the accounts that matter — the ones that can change monitoring configuration or read stored credentials — without imposing it on everyone.
Enrolment
There is no separate enrolment step to chase users through. The next time a user with the requirement signs in, they are taken through setup before they can continue: NetCrunch shows a QR code to scan with an authenticator app, or a key to enter by hand for authenticators that do not scan.
From then on, each sign-in asks for the current code from that app.
A user who has not enrolled cannot bypass the requirement by ignoring it. Setup is presented at sign-in and must be completed to reach the console.
When a User Loses Their Second Factor
A lost or replaced phone does not lock anyone out permanently. An administrator resets the enrolment by disabling Requires Multi Factor Authentication on that user's profile.
Turning the requirement back on puts the user through setup again at their next sign-in, with a fresh QR code — the same forced-enrolment path a new user takes. Nothing has to be recovered or transferred from the old device.
The reset is an administrative action on the profile, which means the ability to reset someone's second factor is itself a privilege worth restricting. An account that can edit user profiles can remove the second factor from any account, including its own — so the profiles that grant that right deserve the same scrutiny as the ones that read stored credentials.
advanced-data-security
Advanced Data Security
SettingsNetCrunch SystemServerAdvanced Data Security
NetCrunch holds credentials on your behalf — monitoring credentials, SNMP profiles, integration profiles, user profiles. All of it is stored encrypted, and the encryption is anchored to a master encryption key.
Every installation has one. What differs is what protects it.
The Default
Out of the box the master key is protected with a built-in system password. Your data is encrypted, and the installation is portable: a backup taken on one machine restores on another and the credentials come with it, because the restoring server already knows how to open the key.
That convenience is also the exposure. Anyone who obtains the backup obtains the credentials inside it.
Enabling Advanced Data Security
Enabling the feature replaces the built-in protection with a master password of your own, and changes two things together:
- The master encryption key is protected with your master password
- All backups are encrypted with AES-256 using that password
Advanced Data Security is available in the Enterprise Edition only.
The master password must be at least 12 characters and include a lowercase letter, an uppercase letter, a number, and a special character.
It can be changed later — enabling the feature is not a one-way door. Changing it re-protects the master key and applies to backups written from then on.
Record the master password somewhere safe and separate from the backups it protects.
It cannot be recovered if lost. NetCrunch has no bypass, which is the entire point of the feature. The master password is what is required to restore a backup or decrypt stored credentials.
Backups and Other Machines
With Advanced Data Security enabled, a backup is no longer freely portable. Restoring or importing data from another machine has three outcomes:
- The data was protected with the built-in system password
- It opens as before, with no extra step.
- The data was protected with a master password
- You are asked for that password, and the credentials are restored once it is supplied.
- The key cannot be decoded
- The restore still proceeds, but without credentials. Nodes, views, monitoring configuration and history all come back intact, and only the stored secrets have to be re-entered.
That last case is a deliberate design decision rather than a failure: losing the password costs you the credentials, not the atlas.
See Backup for how backups are made.
fips
FIPS Compatibility
On Windows, FIPS mode is a system-wide policy, not a per-application setting:
Local Security PolicySecurity OptionsSystem cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing
NetCrunch has no FIPS switch of its own and does not need one. Components that call the Windows cryptographic provider inherit approved mode from the host when that policy is enabled.
NetCrunch is not built on a single cryptographic stack, so it is worth being precise about which parts that covers.
- Protection of the master encryption key
- Uses the Windows CNG cryptographic provider — AES-256 with HMAC-SHA256. On a host with FIPS mode enabled, this runs inside Microsoft's validated cryptographic module in its approved mode. This does not depend on Advanced Data Security: CNG is used either way. What Advanced Data Security changes is which password protects the key.
- Backup archives
- Encrypted to the WinZip AES-256 standard by the archive component rather than through CNG. The Windows FIPS policy does not affect this path.
- Components built on Node.js
- The Web Console's HTTPS and TLS, sensors, SNMPv3 and the MCP Server use OpenSSL rather than CNG. OpenSSL has its own FIPS provider mechanism and does not consult the Windows policy, so the host setting does not reach these components.
If your environment requires FIPS mode, enable it on the Windows host — that is where the setting lives.
NetCrunch as a whole is not a FIPS-validated product. The breakdown above states which parts use validated modules and which do not, so that a compliance assessment can be made against what is actually there.
file-acl
Data Folder Permissions
The NetCrunch data folder holds the master encryption key and the credential database, so the whole tree carries an access control list rather than relying on whatever it inherited from ProgramData.
Full control is granted to SYSTEM and BUILTIN\Administrators, and to the service account when the NetCrunch service does not run as LocalSystem. BUILTIN\Users is granted nothing — every writer under the data tree is the service itself, so ordinary users have no reason to read it.
The installer applies this to the data root during setup. The server then normalizes the rest of the tree in the background after it has started, which is what brings an upgraded installation into line without making setup look like it has hung on a folder holding millions of trend and log files.
If you have deliberately customized the permissions on the data root, NetCrunch leaves them alone — the background pass runs only when the root matches what the installer wrote, so a considered change is never silently reverted.