Security

Bitrix Intranet Portal provides maximum protection from the thousands of threats on the Internet. Every day your website could be attacked many times and damage the integrity of your site.

Why should I protect my website?

82% of websites had at least one security issue in 2008;
E-commerce databases are most likely to be attacked by hackers;
Security breaches cost USD 90 to USD 305 per lost record;
More than 90,000 calls to the top 20 US banks were made after each phishing attack;
More than 200 new hacking techniques have appeared in the last 3 years;
Avoid damage to the enterprise business image due to data leak.

PRO+PRO™ Framework

The PRO+PRO™ security framework provides a unique set of tools for proacive protection of your web projects. More importantly, now it comes integrated in Bitrix software products with no extra charges applied! The PRO+PRO™ framework includes a number of technically advanced security technologies. Multiple security levels allows to detect and combat almost all known hacking techniques making your internet projects invulnerable to most modern web threats.

"Bitrix Intranet Portal is a highly secure business tool. Your personal data will always be safe and protected because Bitrix Intranet Portal uses a brand new security technology – PRO+PRO™ framework. It has already been tested on thousands of websites and Intranet portals."

-Sergey Rizhikov, CEO, Bitrix, Inc.

The module offers the following protection features:

Control panel to set the protection level

Proactive filter (FireWall Web Application)

One Time Password technology

Protection of authorized sessions

Activity control

Phishing protection

Intrusion log

IP-based Control Panel protection

Stop lists

Script integrity control

Learn More

Industry Vulnerability Chart
Percentage of websites susceptible to security threats, by industry.

Source: White Hat Security, "Website Security Statistics" by Trey Ford.

More than six hundred Russian hackers tried to invade the brand-new Bitrix PRO+PRO™ security framework as part of the "Bitrix Real-Time Hack Competition". The test was organized during the "Chaos Constructions CC9 Festival" in August 2009. During the competition, more than 25.000 attacks on the Proactive Protection security mechanism were repulsed, proving its superb reliability. Read more...

Learn more in our Bitrix Software Security presentation! Download now in

.ppt or

.zip.

Features

Control panel to set protection level

Proactive filter (Web Application FireWall)

One Time Password technology

Protection of authorized sessions

Activity control

Phishing protection

Intrusion log

IP based Control Panel protection

Stop lists

Script integrity control

Proactive Filter (Web Application FireWall)

The Web Application Firewall protects the system from most known web attacks. The filter recognizes dangerous threats in the incoming requests and blocks intrusions. Proactive Filter is the most effective way to guard against possible security defects in a web project implementation (XSS, SQL Injection, PHP Including etc.). The filter analyzes entirely all data received from visitors in variables and cookies.

* Note that some harmless actions which a visitor may perform can be suspicious and cause the filter to react.

protects from most known web attacks;
screens a web application from the most persistent attacks;
filter exclusion list (with wildcards);
recognizes most dangerous threats;
blocks site intrusions;
protects from possible security errors;
keeps an attack log;
informs administrator about intrusions;
configurable options for firewall reaction to intrusion attempts:
- make data safe;
- delete unsafe data;
- temporarily add the attacker’s IP address to the stop list.
latest updates.

Control Panel to Set Protection Level

Any website based on Bitrix Intranet Portal is preconfigured with the basic protection level. However, you can improve the site security significantly by selecting one of the Proactive Protection module presets: standard, high or highest. The system will show you tips about any parameter you may need to configure.

basic level – assigned to all web projects running without the Proactive Protection module;
standard level – enables the most common proactive protection features:
- the proactive filter (site wide);
- weekly intrusion log;
- activity control;
- high security level for administrators;
- CAPTCHA protected registration procedure;
- error logging (errors only).
high level is the recommended security level which can be applied to any projects conforming the standard level requirements. This level adds the following features:
- Kernel module event logging;
- Control Panel protection;
- storing sessions in the database;
- change of session identifier.
highest level includes special protection tools essential for sites keeping confidential user information (web shops, etc.). This level is empowered with the following functions:
- one time passwords;
- control script integrity verification.

Intrusion Log

The intrusion log registers all events occurring in the system including uncommon, suspicious and malicious events. The log is updated in real time so you can view the events as soon as they have been registered. This feature enables you to discover attacks and intrusion attempts while they occur, so you can riposte immediately and even prevent attacks.

immediately registers all system events;
logs attacks detected by the proactive filter:
- SQL injection;
- XSS attack;
- PHP including.
filter for malicious events;
view and analyze events in real time to prevent attacks in future;
immediate reaction to malicious events.

One-Time Passwords (OTP)

The PRO+PRO system supports one-time passwords (OTP) for any site users.

These passwords are especially recommended to be used by the site administrators since they significantly improve security of the “Administrators” user group.

The concept of one-time passwords empowers the standard authorization scheme and significantly reinforces the web project security. The one-time password system requires a physical hardware token (device) (e.g., Aladdin eToken PASS) or special OTP software.

This technology gives you confidence that only a user to whom a token has been issued can authorize on the site. Password theft or interception is absolutely excluded because a password can be used only once. A token is a physical hardware physical device that generates a unique password only when the token button is clicked. Effectively, this means that a token owner is unable to tell the password to third party to allow them authorize as well.

empowers web project security;
hardware tokens;
software OTP;
extended OTP authentication: a user must append a one-time password to their normal password;
authorization using a login and a compound password;
uses two consecutive OTP passwords generated by a token;
synchronizes the token and server generator counters whenever synchronization is lost.

File Integrity Control

File integrity control helps an administrator reveal maliciously or mistakenly modified system files. You can check the integrity of the system kernel and other system or public files any time.

tracks file system changes;
verifies kernel integrity;
verifies system area integrity;
verifies integrity of public files.

Verification of the File Integrity Control Script

Before checking the system integrity, the file integrity control script has to be verified for possible changes. When running the script for the first time, enter a desired password containing at least 10 characters (letters and digits), and any keyword (other than the password), and click “Set New Key”. The system then

verifies the file integrity control script for changes;
protects the script using the keyword and password pair.

Control Panel Protection

This type of protection strictly regulates secure networks from which the users are allowed to access Control Panel. All you need to do is specify the legal IP addresses (or a range). No need to worry about not adding yourself to this list: the system will check your IP automatically.

What effect will this protection produce? Any XSS/CSS attacks become ineffective and interception of authorization data becomes absolute useless.

restricts access to Control Panel from any IP’s except those on the white list;
recognizes the user’s IP address automatically;
a user can manually supply the allowed IP addresses and the address ranges.

Session Protection

Most web attacks are intended to steal an authorized user's session data. Enabling the session protection makes session hijacking impossible. Furthermore, concerning an administrator’s authorized session, use of session protection is one of the most effective and necessary security measures.

In addition to the conventional session protection options that are available in the user group parameters, the session protection mechanism includes some special, even unique features.

Storing session data in the module database prevents data from being stolen by running scripts of other projects on the same server. This approach excludes virtual hosting configuration errors, bad temporary folder permission settings, and other operating system-related errors. Additionally, it also reduces file system stress by loading the database server with these operations.

various protection methods:
- limited session lifetime (minutes);
- recurring session ID relay;
- network mask to associate a session with a specific IP;
- storing session data in the module database.
eliminates virtual hosting and OS configuration errors;
eliminates bad temporary folder permission settings;
reduces file system stress;
makes session ID hijacking impossible.

Activity Control

Activity Control lets you protect the system from profusely active visitors, obtrusive bots, some DDoS attacks, and prevent brute force attacks on passwords. You can also set the maximum allowed activity for your site (e.g. number of requests per second a user can perform).

User activity control is built around the Web Analytics module's mechanisms and requires this module to be installed.

protects from profusely active users;
protects from bots and DDoS attacks;
prevents brute force attacks on passwords;
allows setting of a maximum possible visitor (human) activity quota;
registers activity quota violations as events in the intrusion log;
blocks visitors exceeding the activity quota;
shows a special information page to a blocked visitor.

Stop List

The stop list contains parameters used to restrict access to a site and possibly redirect to a specified page. Any visitor matching the stop list criteria (e.g. an IP address), will be blocked.

redirects visitors matching the stop list entries;
blocks visitors by their IP addresses;
stop list entry management;
collects statistics on visitors matching the stop list criteria;
allows specification of the ban duration for users, IP addresses, network masks, UserAgents and the referrer links;
shows a customizable message to a blocked visitor.

Phishing Protection

Phishing - is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

Two methods exist to prevent redirect phishing:

Detect malicious redirects by the lack of a referring page in the HTTP header
Sign links with a digital signature and verify it upon a redirect attempt

The following can be used as protection:

Show a redirection warning to a visitor
Unconditionally redirect visitors to a site known to be safe

Recommended for the high security level.

Certificates

Bitrix carries out constant auditing and testing of the system protection mechanisms. In order to make these tests unbiased and objective, Bitrix recruits third-party expert companies for unbiased auditing in addition to tests performed internally by the Bitrix team. The certificates obtained from security audit companies confirm the quality of the protection mechanisms and ensure their conformity to information security requirements.

Positive Technologies Certificate

"Protected Web Application"
(Bitrix Intranet Portal 8)

This certificate is issued by Positive Technologies which has performed an audit of the new security features in Bitrix Intranet Portal. The built-in security features fully meet the requirements of the Web Application Firewall Evaluation Criteria as established by the Web Application Security Consortium.

The built-in quality of the Bitrix Intranet Portal protection mechanisms give users confidence not only in the system kernel reliability, but also in any solution developed on this platform including add-ons and modifications done by the authorized Bitrix partners.

.
.
.
Follow us on:
	Our Blogs	Dailymotion
	Twitter	YouTube
	Facebook	Vimeo
	Linked In	SlideShare
.
.
.