An internal audit reveals that an agent has been compromised. What action must be taken to re- secure the agent?

The agent.properties file contains the bootstrap configuration for a PingAccess agent, including a unique agent ID and a one-time shared secret. This secret is used to establish initial trust with the PingAccess engine. If an agent is compromised, its identity and security credentials are no longer considered secure. The standard remediation procedure is to create a new agent configuration in the PingAccess administrative console. This action generates a new identity and a new agent.properties file with a new shared secret. Applying this new file to the agent host and restarting the agent re-establishes a new, secure trust relationship with the engine.

A. Change the agent.engine.configuration.shared.secret value in the agent.properties file: Manually changing the shared secret on the agent side will cause authentication to fail, as the PingAccess engine will still expect the original, compromised secret.

B. Select a new Agent Trusted Certificate: This action occurs on the PingAccess engine to trust agents, but it does not address the compromised agent's specific identity, private key, or bootstrap credentials.

C. Reinstall the agent: Reinstalling the agent's software binaries does not resolve the issue. The new installation would still use the old, compromised agent.properties file unless it is explicitly replaced.

1. Ping Identity Documentation - PingAccess 7.3, Agent configuration: In the section "Configuring an agent," the process of creating an agent and downloading the agent.properties file is detailed. It states, "The agent uses the shared secret in this file to authenticate to PingAccess and download its configuration." This highlights that the file is the source of the agent's initial identity and trust. To re-establish trust, a new file must be generated.

2. Ping Identity Documentation - PingAccess 7.3, Security > Agent protocol: This section describes the agent bootstrap process. "The agent uses the shared secret from its properties file to authenticate to the bootstrap endpoint... Upon successful authentication, PingAccess returns the agent's configuration, including its private key and a certificate signed by the PingAccess engine." This confirms that a compromise necessitates a new bootstrap with a new identity, which is achieved by creating a new agent configuration and downloading its corresponding properties file.