{"id":71967,"date":"2022-04-05T16:25:34","date_gmt":"2022-04-05T14:25:34","guid":{"rendered":"https:\/\/nextcloud.com\/cifrado\/"},"modified":"2022-10-20T16:20:03","modified_gmt":"2022-10-20T14:20:03","slug":"cifrado","status":"publish","type":"page","link":"https:\/\/staging.nextcloud.com\/es\/cifrado\/","title":{"rendered":"Cifrado"},"content":{"rendered":"
\r\n\t
\r\n\t\t
\r\n\t\t\t
\r\n\t\t\t\t

Encryption and hardening<\/h1>

Providing optimal security for your data and communication<\/p>\t\t\t<\/div>\r\n\t\t<\/div>\r\n\t<\/div>\r\n<\/div>\r\n<\/section>

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Security is key for Nextcloud users<\/h1>\n

To protect your data, Nextcloud is designed with military-grade encryption and a
\nlarge number of advanced security protections. To support the admin,
\nautomated checks warn of security problems.<\/p>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\t<\/div>\n<\/section>

\r\n\t
\r\n\t\t

Security advice<\/center><\/h2><\/div><\/div><\/div>
<\/div><\/div><\/div>

Automated checks and tips<\/h3>
<\/div><\/div><\/div>

Nextcloud detects issues with its installation and warns when it finds unknown or modified files. Administrators can find security tips and warnings in the configuration screen.<\/p>\n

Administrators can set password quality policies enforced by Nextcloud as well as limit or disable sharing, enforce expiration dates and passwords on shares, disable preview generation and more.<\/p>\n

You can find more information on hardening your Nextcloud installation in our extensive hardening guide<\/p>\n

We provide the Nextcloud Security Scanner to check the security of your private cloud server.<\/p>\n<\/div><\/div><\/div>\t<\/div>\r\n<\/section>

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Server-side encryption<\/h2>

Download our free whitepaper.<\/p>\nDescargar ahora<\/a>\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\t<\/div>\n<\/section>\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Cifrado<\/h1>\n
\n

Employ encryption for the highest degree of privacy and security<\/p>\n<\/div>\n

\n
\"\"\n<\/div>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\t<\/div>\n<\/section>
\r\n\t
\r\n\t\t
\r\n\t\t\t
\r\n\t\t\t\t
\r\n\t\t\t\t\t\t\t\t\t<\/div>\r\n\t\t\t<\/div>\r\n\t\t<\/div>\r\n\t\t
\r\n\t\t\t
\r\n\t\t\t\t
\"\"\/

Encrypted data transfer<\/h4>

Nextcloud employs industry-standard TLS to encrypt data in transfer. Usage of Object Storage like Amazon S3 or other external storage systems can be secured through Server Side Encryption.<\/p>\n<\/div><\/div>

\"\"\/

Encrypt data at rest<\/h4>

Server Side Encryption can also be used on local storage. However, inherent to the concept of server side encryption, encryption keys will be present in memory of the Nextcloud server during the time a user is logged in and could be retrieved by a determined attacker. We take care to ensure keys are not stored unencrypted on permanent storage and at rest keys are encrypted using a strong cipher.<\/p>\n<\/div><\/div>

\"\"\/

Encrypt from client to client<\/h4>

End-to-end Encryption client-side is available from Nextcloud desktop client 3.0 and newer as a folder-level option to keep extremely sensitive data fully secure even in case of a full server breach. The server facilitates key exchange for syncing between devices and sharing but has Zero Knowledge, that is, never has access to any of the data or keys in unencrypted form. Learn more here.<\/p>\n<\/div><\/div><\/div>\t\t\t<\/div>\r\n\t\t<\/div>\r\n\t<\/div>\r\n<\/section>

\r\n\t
\r\n\t\t
<\/div><\/div><\/div>

Threat models and attack trees<\/h3>
<\/div><\/div><\/div>

There is a number of important decisons to be made about encryption in Nextcloud. The various solutions come with advantages and downsides. Read our blog linked below to find out more about the properties of each solution.<\/p>\nEncryption in Nextcloud<\/a><\/div><\/div><\/div>

<\/div><\/div><\/div>

Server-side encryption with flexible key handling<\/h3>
<\/div><\/div><\/div>

Nextcloud supports pluggable encryption key handling. If you have an external key server or Hardware Security Module, these can be made to work with Nextcloud.<\/p>\n

Our default encryption key handling enables administrators to set a system wide recovery key for encrypted files,. This ensures that, even when users lose their password, files can always be decrypted. Encrypted files can be shared but after changing encryption settings, shares will have to be re-shared. Using our command line tools, data can be encrypted, decrypted or re-encrypted when needed.<\/p>\n

If you face a regulatory or compliance need to encrypt data at rest but do not need to actually secure this data, locally encrypting data using our built in key management may satisfy compliance requirements.<\/p>\nM\u00e1s informaci\u00f3n<\/a><\/div><\/div><\/div>

<\/div><\/div><\/div>

Seamless end-to-end encryption on the clients<\/h3>
<\/div><\/div><\/div>

Nextcloud features an enterprise-grade, seamlessly integrated solution for end-to-end encryption. It enables users to pick one or more folders on their desktop or mobile client for end-to-end encryption. Folders can be shared with other users and synced between devices but are never readable by the server.<\/p>\n

This solution is easy to use yet extremely secure thanks to its Zero-Knowledge server design and Cryptographic Identity Protection. It does not compromise security by using a browser to encrypt or decrypt files with code coming from the server and is not an all-or-nothing affair: any number of folders can be end-to-end encrypted. Sharing is secure without a need to exchange passwords and files don’t need to be re-encrypted and re-uploaded when access rights for other users are changed.<\/p>\n

Our solution is enterprise ready with support for a Hardware Security Module for issuing certificates, giving access to a full audit log and optionally allowing administrators to create an offline master recovery key.<\/p>\nM\u00e1s informaci\u00f3n<\/a><\/div><\/div><\/div>\t<\/div>\r\n<\/section>

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

cifrado punto a punto<\/h2>

Download our free whitepaper.<\/p>\nDescargar ahora<\/a>\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\t<\/div>\n<\/section>\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Passive security measures<\/h1>\n

Besides active security measures like authentication and encryption, Nextcloud
\nprotects your data without any need for administrator action<\/p>\n

\"\"<\/p>\n

 <\/p>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\t<\/div>\n<\/section>

\n\t
\n\t\t\t\t
<\/a><\/div>

Brute force protection<\/h4>\n

Brute Force Protection logs invalid login attempts and slows down multiple attempts from a single IP address (or IPv6 range). This feature is enabled by default and protects against an attacker who tries to guess a password from one or more users.<\/p>\n

Password reset tokens are invalidated when critical information like user email has been changed to protect against phishing attacks.<\/p>\n

Nextcloud will ask system administrators for password confirmation on security critical actions.<\/p>\n

Rate limiting<\/h4>\n

Rate Limiting allows a developer to specify how often an IP range or a user may send a request in a specific time period. This can be useful for expensive API calls, to prevent users from accessing too much data in a smaller attempt of time or harden bruteforce stuff further. It is used by Nextcloud apps to protect users from spam and overloading.<\/p>\n

Learn more about these protections in our blog.<\/a><\/p>\n

Machine learning based suspicious login detection<\/h4>\n

Nextcloud includes a machine learning technology which trains a neural network on successful logins on the instance and uses it to classify login attempts. Should it detect a login classified as suspicious by the trained model, it will notify the user and store an entry in the log for the system administrator.<\/p>\n

When the user is notified, they can terminate the suspicious session, and proceed to set a new password. The administrator can also take action, like disabling user accounts or forcing users to pick a new password.<\/p>\n

Of course, the solution is designed to protect privacy and all data remains on your server!<\/p>\n

Learn more in our\u00a0announcement blog<\/a><\/p>\n<\/div><\/div>

<\/a><\/div>

Security hardening<\/h4>\n

Nextcloud employs a wide variety of extra security hardening capabilities, including:<\/p>\n