Security
 |
Bitrix Site Manager provides maximum protection from thousands of threats in the Internet. Every day your website could be attacked many times and it may harm your information. Why should I protect my website?
|
Proactive Protection
Solutions Provided by Proactive Protection
The Proactive Protection system is really an essential supplement to the Bitrix standard security policy. More importantly, up now it comes integrated and is being offered within the Bitrix software products with no extra charges applied! The Proactive Protection includes a great number of technically advanced security mechanisms for web applications. Multiple security levels introduced within the Proactive Protection system eneble you to detect and combat almost all known hack techniques making your internet projects unsusceptible to most present-day web threats.
 |  | |||
| ||||
 |  |
The module offers the following protection features:
 Control panel to set the protection level
Proactive filter (Web Application FireWall)
One Time Password technology
Protection of authorized sessions
Activity control
Phishing protection
Intrusion log
IP based Control Panel protection
Stop lists
Script integrity control
|
Industry Vulnerability Chart
Percentage of websites susseptible to security vulnerability, sorted by industry.
Source: White Hat Security, "Website Security Statistics" by Trey Ford.
 | More than six hundred Russian hackers have been trying to evade the Bitrix brand new Proactive Protection system as part of the "Bitrix Real-Time Hack Competition". The crash test was organized during the "Chaos Constructions CC9 Festival" in the end of August 2009. During the competition hours there have been registered and repulsed more than 25.000 attacks by the Proactive Protection security mechanism, proving its superb reliability. Read more... |
| | ||
| |||
| |
.ppt
.zipFeatures
Proactive filter (Web Application FireWall)
Web Application Firewal protects the system from most known web attacks. The filter recognizes dangerous threats in the incoming requests and blocks intrusions. Proactive Filter is the most effective way to guard against possible security defects in the web project implementation (XSS, SQL Injection, PHP Including etc.). The filter analyzes entirely all data received from visitors in variables and cookies.
* Note that some harmless actions a visitor may perform can be suspicious and cause the filter to react.
|
|
|
Control panel to set the protection level
Any Bitrix Site Manager based web site is always preconfigured for the basic protection level. However, you can improve the site security significantly by selecting one of the Proactive Protection module presets: standard, high or highest. The system will show you hints about any parameter you may need to configure.
|
|
|
Intrusion log
The intrusion log registers all events occurring in the system including uncommon, suspicious and malicious events. The log is updated in real time so you can view the events as soon as they have been registered. This feature enables you to discover attacks and intrusion attempts while they occur, so you can riposte immediately and even prevent attacks.
|
|
|
One-time passwords
The Proactive Protection module supports one-time passwords for any site users. 
These passwords are especially recommended to be used by the site administrators since they significantly improve security of the “Administrators” user group.
The concept of one-time passwords empowers the standard authorization scheme and significantly reinforces the web project security. The one-time password system requires a physical hardware token (device) (e.g., Aladdin eToken PASS) or special OTP software.
This technology gives you confidence that only a user to whom a token was issued can authorize on the site. Password theft or interception is absolutely senseless because a password can be used only once. A token is a hardware physical device that generates unique passwords only when a token button is being clicked. Effectively, it means that a token owner is unable to tell the password to third party to allow them authorize as well.
|
|
|
File integrity control
File integrity control helps an administrator reveal maliciously or mistakenly modified system files. Anytime you can check the integrity of the system kernel, other system or public files.
|
|
|
Verification of the file integrity control script
Before checking the system integrity, the file integrity control script has to be verified for possible changes. When running the script for the first time, enter a desired password containing at least 10 characters (letters and digits), and any keyword (other than the password), and click “Set New Key”.
|
|
|
Control Panel protection
This type of protection strictly regulates secure networks from which the users are allowed to access Control Panel. All you nave to do is specify the legal IP addresses (or a range). No need to worry about not adding yourself to this list: the system will check your IP automatically.
What effect would this protection produce? Any XSS/CSS attacks become ineffective, interception of authorization data – absolute useless.
|
|
|
Session protection
Most web attacks are purposed to steal the authorized user session data. Enabling the session protection makes session hijacking senseless. Furthermore, speaking of an administrator’s authorized session, we can say that guarding it using session protection is one of the most essential security efforts.
In addition to the conventional session protection options existing in the user group parameters, the session protection mechanism includes some special, even unique features.
Storing session data in the module database prevents data from being stolen by running scripts on other virtual servers which eliminates virtual hosting configuration errors, bad temporary folder permission settings and other operating system related problems. It also reduces file system stress by offloading operations to the database server.
|
|
|
Activity control
Activity Control allows to protect the system from profusely active visitors, obtrusive bots, some DDoS attacks, and prevent password brute force attempts. You can set the maximum allowed activity for your site (e.g. number of requests per second a user can perform).
User activity control is build around the Web Analytics module mechanisms and requires this module to be installed.
|
|
|
Stop list
The stop list contains parameters used to restrict access to a site and possibly redirect to a specified page. Any visitor matching the stop list criteria (e.g. an IP address), will be blocked.
|
|
|
Phishing Protection
Phishing - is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.
Two methods exist to prevent redirect phishing:
- Detect malicious redirects by the lack of the referring page in the HTTP header
- Sign links with a digital signature and verify it upon redirect attempt
- Show redirection warning to a visitor
- Unconditionally redirect a visitor to a surely safe site
Certificates
Certificates
Bitrix company practices permanent audit and testing of the system protection mechanisms. In order to make these tests unbiased and objective, Bitrix company recruits third-party expert companies for unprejudiced audit in addition to tests performed internally, by the Bitrix engineers. The certificates obtained from the security audit companies confirm the quality of the protection mechanisms and ensure their conformance to information security requirements.
 | |
|
|
"Protected Web Application"
The certificate is issued by Positive Technologies company which has performed the audit of the new security features in Bitrix Intranet Portal. The built-in security fully meet the requirements of Web Application Firewall Evaluation Criteria as established by Web Application Security Consortium.
|
