Proactive Protection is the latest security technique combining technical and organizational measures to combat malicious programs that have undergone modifications and those that are still unknown.
The Proactive Protection technology significantly increases security of web-based applications.
The Web Application Firewall protects the system from most known web attacks. The filter recognizes dangerous threats in incoming requests and blocks intrusions. Proactive Filter is the most effective way to guard against possible security defects in a web project implementation (XSS, SQL Injection, PHP Including etc.). The filter fully analyzes all data received from visitors in variables and cookies.
* Note that some harmless actions which a visitor may perform can be considered suspicious and cause the filter to react.
protects from most known web attacks;
screens a web application from the most persistent attacks;
filter exclusion list (with wildcards);
recognizes most dangerous threats;
blocks site intrusions;
protects from possible security errors;
keeps an attack log;
informs administrator about intrusions;
configurable options for firewall reaction to intrusion attempts:
make data safe;
delete unsafe data;
temporarily add the attacker’s IP address to the stop list.
Control panel to set protection level
Any website based on Bitrix Site Manager is preconfigured with the basic protection level. However, you can improve the site security significantly by selecting one of the Proactive Protection module presets: standard, high or highest. The system will show you tips about any parameter you may need to configure.
basic level – assigned to all web projects running without the Proactive Protection module;
standard level – enables the most common proactive protection features:
the proactive filter (site wide);
weekly intrusion log;
high security level for administrators;
CAPTCHA protected registration procedure;
error logging (errors only).
high level is the recommended security level which can be applied to any projects conforming the standard level requirements. This level adds the following features:
Kernel module event logging;
Control Panel protection;
storing sessions in the database;
change of session identifier.
highest level includes special protection tools essential for sites keeping confidential user information (web shops etc.). This level is empowered with the following functions:
one time passwords;
control script integrity verification.
The intrusion log registers all events occurring in the system including uncommon, suspicious and malicious events. The log is updated in real time so you can view the events as soon as they have been registered. This feature enables you to discover attacks and intrusion attempts while they occur, so you can riposte immediately and even prevent attacks.
immediately registers all system events;
logs attacks detected by the proactive filter:
filter for malicious events;
view and analyze events in real time to prevent attacks in future;
immediate reaction to malicious events.
The Proactive Protection module supports one-time passwords for any site users. These passwords are especially recommended to be used by the site administrators since they significantly improve security of the “Administrators” user group.
The concept of one-time passwords empowers the standard authorization scheme and significantly reinforces the web project security. The one-time password system requires a physical hardware token (device) (e.g., Aladdin eToken PASS) or special OTP software.
This technology gives you confidence that only a user to whom a token has been issued can authorize on the site. Password theft or interception is absolutely excluded because a password can be used only once. A token is a hardware device that generates a unique password only when a token button is clicked. Effectively, this means that a token owner is unable to tell the password to third party to allow them authorize as well.
empowers web project security;
extended OTP authentication: a user must append a one-time password to their normal password;
authorization using a login and a compound password;
uses two consecutive OTP passwords generated by a token;
synchronizes the token and server generator counters whenever synchronization is lost.
Bitrix One-Time Password App
File integrity control
File integrity control helps an administrator reveal maliciously or mistakenly modified system files. You can check the integrity of the system kernel and other system or public files files any time.
tracks file system changes;
verifies kernel integrity;
verifies system area integrity;
verifies integrity of public files.
Control Panel protection
This type of protection strictly regulates secure networks from which the users are allowed to access Control Panel. All you need to do is specify the legal IP addresses (or a range). No need to worry about not adding yourself to this list: the system will check your IP automatically.
What effect will this protection produce? Any XSS/CSS attacks become ineffective, and interception of authorization data becomes absolute useless.
restricts access to Control Panel from any IP’s except those on the white list;
recognizes the user’s IP address automatically;
a user can manually supply the allowed IP addresses and the address ranges.
Most web attacks are intended to steal an authorized user’s session data. Enabling the session protection makes session hijacking impossible. Furthermore, concerning an administrator’s authorized session, use of session protection is one of the most effective and necessary security measures.
In addition to the conventional session protection options that are available in the user group parameters, the session protection mechanism includes some special, even unique, features.
Storing session data in the module database prevents data from being stolen by running scripts of other projects on the same server. This approach excludes virtual hosting configuration errors, bad temporary folder permission settings, and other operating system-related errors. Additionally, it reduces file system stress by loading the database server with these operations.
various protection methods:
limited session lifetime (minutes);
recurring session ID relay;
network mask to associate a session with a specific IP;
storing session data in the module database.
eliminates virtual hosting and OS configuration errors;
eliminates bad temporary folder permission settings;
reduces file system stress;
makes session ID hijacking impossible.
Activity Control lets you protect the system from profusely active visitors, obtrusive bots, some DDoS attacks, and password brute force attacks on passwords. You can also set the maximum allowed activity for your site (e.g. number of requests per second a user can perform).
User activity control is built around the Web Analytics module's mechanisms and requires this module to be installed.
protects from profusely active users;
protects from bots and DDoS attacks;
prevents brute force attacks on passwords;
allows setting of a maximum possible visitor (human) activity quota;
registers activity quota violations as events in the intrusion log;
blocks visitors exceeding the activity quota;
shows a special information page to a blocked visitor.
The stop list contains parameters used to restrict access to a site and possibly redirect to a specified page. Any visitor matching the stop list criteria (e.g. an IP address), will be blocked.
redirects visitors matching the stop list entries;
blocks visitors by their IP addresses;
stop list entry management;
collects statistics on visitors matching the stop list criteria;
allows specification of the ban duration for users, IP addresses, network masks, UserAgent’s and referrer links;
shows a customizable message to a blocked visitor.
Phishing - is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.
Two methods exist to prevent redirect phishing:
Detect malicious redirects by the lack of a referring page in the HTTP header
Sign links with a digital signature and verify it upon a redirect attempt
The following can be used as protection:
Show a redirection warning to a visitor
Unconditionally redirect visitors to site known to be safe
Recommended for the high security level.
Download the Bitrix Software Security presentation in .ppt or .zip.