Bitrix Software Security


Published on

Web Application Firewal protects the system from most known web attacks. The filter recognizes dangerous threats in the incoming requests and blocks intrusions. Proactive Filter is the most effective way to guard against possible security defects in the web project implementation (XSS, SQL Injection, PHP Including etc.). The filter analyzes entirely all data received from visitors in variables and cookies.

Published in: Technology, News & Politics
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Bitrix Software Security

  1. 1. Bitrix Software Security Bitrix Intranet Portal Bitrix Site Manager
  2. 2. Site. Portal. Image. Reputation. Your web site is a part of the Corporate Infrastructure. More than 50% of attacks are done through the Web . Corporate site hacks hit the reputation and image of a company. What is more, the loss of data and client information leads to sheer material losses .  The more solid and famous the name and products of a company, the more substantial can be the risks and losses caused by a corporate site hack. Which to choose?
  3. 3. Security at All Stages <ul><li>Security policy – set of rules restricting user authorization in order to ensure a certain level of security </li></ul><ul><li>Unified authorization system – all permissions in the system are distributed among user groups only </li></ul><ul><li>Unified user account for all modules </li></ul><ul><li>Two-level system of access permission distribution </li></ul><ul><li>Access control system and page business logic independency </li></ul><ul><li>Strong password rules </li></ul><ul><li>Stored authorization </li></ul><ul><li>Site u pdate s y stem </li></ul><ul><li>System event log </li></ul>My Site is My Castle During the development of the Bitrix Site Manager software particular attention is paid to the security issues at all stages of developing and testing.
  4. 4. New Approach to Security <ul><li>Highlights: </li></ul><ul><li>Security Panel with security levels </li></ul><ul><li>Web Application FireWall </li></ul><ul><li>One-time Password Technology (OTP) </li></ul><ul><li>Authorized Sessions Protection </li></ul><ul><li>Activity Control </li></ul><ul><li>Intrusion Log </li></ul><ul><li>IP-based Control Panel pages </li></ul><ul><li>Stop Lists </li></ul><ul><li>Script Integrity Monitor </li></ul><ul><li>Phishing Protection </li></ul>Proactive Protection is the latest security technology combining technical and organizational measures that allow combating malicious programs that have undergone modifications and those that are still unknown ! Proactive Protection Armed Castle
  5. 5. Security Panel with Security Levels With the Proactive Protection module, you can significantly improve the security of your site . You need only to select and configure one of the module security levels. <ul><li>Security Levels: </li></ul><ul><li>Basic - assigned to all web projects running without the Proactive Protection module </li></ul><ul><li>Standard: </li></ul><ul><li>Web application Fire Wall (for the entire site) </li></ul><ul><li>Weekly Intrusion log </li></ul><ul><li>Activity Control </li></ul><ul><li>High security level for Administrators </li></ul><ul><li>CAPTCHA protected registration procedure </li></ul><ul><li>Errors logging (errors only) </li></ul><ul><li>High – Standard plus: </li></ul><ul><li>Kernel module event logging </li></ul><ul><li>Control Panel protection </li></ul><ul><li>Storing sessions in the database </li></ul><ul><li>Session ID change </li></ul><ul><li>Highest – High plus: </li></ul><ul><li>One-time password technology </li></ul><ul><li>Control script integrity verification </li></ul>
  6. 6. Web Application FireWall (Proactive Filter) The Proactive Filter is the most effective way to protect sites against possible security defects in the web project implementation ( XSS , SQL Injection , PHP Including, and others). <ul><li>Protection against most known Web attacks </li></ul><ul><li>Application s creening from the most importunate attacks </li></ul><ul><li>Filter exclusion list (with wildcards) </li></ul><ul><li>Recognition of most dangerous threats </li></ul><ul><li>Blocking of site intrusions </li></ul><ul><li>Protecting from possible security errors </li></ul><ul><li>Keeping of attacks log </li></ul><ul><li>Informing the administrator of invasions </li></ul><ul><li>Configuring options of the firewall reaction to intrusion attempts: </li></ul><ul><ul><ul><li>Make data safe </li></ul></ul></ul><ul><ul><ul><li>Wipe unsafe data </li></ul></ul></ul><ul><ul><ul><li>T emporarily add attakers’ IP address es to the stop lis t </li></ul></ul></ul>
  7. 7. One-time Password Technology (OTP) The concept of one-time passwords empowers the standard authorization scheme and significantly reinforces web project security. The one-time password system requires a physical hardware token (device) (e.g., Aladdin eToken PASS) or special OTP software. What OTP gives you? Confidence that only a user to whom a token was issued can authorize on the site. Password interception loses meaning in this case, as a password * can be used only once. A token is a hardware physical device that generates unique passwords only when a token button is being clicked. It means that a token owner is unable to tell the password to a third party to allow them authorize as well. * the password = your password + unique numerical combination
  8. 8. Authorized Session Protection Most web attacks are purposed to steal the authorized user session data. Enabling Authorized Session Protection makes session hijacking senseless. <ul><li>Session protection methods: </li></ul><ul><li>Limited session lifetime (minutes) </li></ul><ul><li>Recurring session ID relay </li></ul><ul><li>Network mask to associate a session with a specific IP </li></ul><ul><li>Storing session data in the module database </li></ul><ul><li>Eliminate errors in: </li></ul><ul><li>Virtual hosting and OS configuring </li></ul><ul><li>Temporary folder permissions settings </li></ul><ul><li>And more… </li></ul>
  9. 9. Activity Control <ul><li>Protection from profusely active users </li></ul><ul><li>Protection from bots </li></ul><ul><li>Protection from DDoS-attacks </li></ul><ul><li>Preventing password brute force attempts </li></ul><ul><li>Setting the maximum possible visitor (human) activity quota </li></ul><ul><li>Registering an excess of activity rate in the intrusion log </li></ul><ul><li>Blocking visitors exceeding the activity quota </li></ul><ul><li>Showing a special information page to a blocked visitor </li></ul>You can set maximum user activity for your site (for example, number of queries per second).
  10. 10. Intrusion Log All events occurring in the system, including the unusual or malicious, are logged . You can view entries in the log immediately after they are generated. The log is updated in real time so you can view the events as soon as they have been registered. This feature enables you to discover attacks and intrusion attempts while they occur, so you can riposte immediately and even prevent attacks . <ul><li>Immediate registration all system events </li></ul><ul><li>Filter for malicious events </li></ul><ul><li>Real-time viewing and analyzing of events </li></ul><ul><li>Immediate reaction to malicious events </li></ul>
  11. 11. IP-based Control Panel Pages This type of protection strictly regulates secure networks from which the users are allowed to access Control Panel. All you have to do is specify the legal IP addresses (or a range). No need to worry about not adding yourself to this list: the system will check your IP automatically. What effect would this protection produce? Any XSS/CSS attacks become ineffective, interception of authorization data – absolutely useless.
  12. 12. Stop Lists The stop list contains parameters used to restrict access to a site and possibly redirect to a specified page. Any visitor matching the stop list criteria (e.g. an IP address), will be blocked. <ul><li>Redirects visitors matching the stop list entries </li></ul><ul><li>Blocks visitors by their IP addresses </li></ul><ul><li>Manages stop list entry </li></ul><ul><li>Collects the statistics on visitors matching the stop list criteria </li></ul><ul><li>Allows you to specify the ban duration for users, IP addresses, network masks, UserAgent’s, and the referrer links </li></ul><ul><li>Shows a customizable message to a blocked visitor. </li></ul>
  13. 13. Script Integrity Monitor File integrity control Verification of the file integrity control script <ul><li>Tracks file system changes </li></ul><ul><li>Verifies kernel integrity </li></ul><ul><li>Verifies system area integrity </li></ul><ul><li>Verifies public files integrity </li></ul><ul><li>Verifies the file integrity control script for changes </li></ul><ul><li>Protects the script using the keyword and password pair </li></ul>
  14. 14. Phishing Protection Phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords , and credit card details by masquerading as a trustworthy entity in an electronic communication. <ul><li>Two methods exist to prevent redirect phishing: </li></ul><ul><li>D etect malicious redirects by the lack of the referring page </li></ul><ul><li>in the HTTP header </li></ul><ul><li>S ign links with a digital signature and verify them upon redirect attempt </li></ul><ul><li>The following can be used as protection: </li></ul><ul><li>Show a redirection warning to a visitor </li></ul><ul><li>Unconditionally redirect a visitor s to a surely safe site </li></ul>
  15. 15. Under Development In the nearest future Transmission channel encryption using SSL Recommendations on configuration Update monitor
  16. 16. Permanent Updates Audit Bitrix has assigned a treaty of permanent update security audits with Positive Technologies. Each time a new set of updates is released through the SiteUpdate system, minute security work is done by the Positive Technologies company. Thanks to this work, the level of product security is always high .
  17. 17. <ul><li>The Proactive Protection module is included in all the Bitrix Software: </li></ul><ul><li>Bitrix Site Manager (except for the Start Edition) </li></ul><ul><li>Bitrix Intranet Portal </li></ul>
  18. 18. Have a question? E-mail to: [email_address] [email_address]
  19. 19. Download the Free 30-Day Trial: http:// www.b Test Online: http:// www.b
  20. 20. USA Toll Free Number (US only) +1-888-5BITRIX (+1-888-524-8749) Telephone Number: +1.703.740.8301 Postal address 901 N. Pitt str, Suite 325 Alexandria, VA 22314 Sales Department: [email_address] ; [email_address] Web Site : http:// Contact Information