| Proactive Protection |
 |
Proactive Protection is the latest security technique combining technical and organizational measures to combat malicious programs that have undergone modifications and those that are still unknown.
The Proactive Protection technology significantly increases security of web-based applications. |
|
|
| |
| Main Features |
PRO+PRO Main Features |
 |
Security Panel with security levels |
|
Web Application FireWall |
|
One-Time Password technology |
|
Authorized Sessions Protection |
|
Activity Control |
|
Intrusion Log |
|
IP-based Control Panel pages |
|
Stop Lists |
|
Script Integrity Monitor |
|
Web Antivirus |
|
|
| |
Proactive filter (Web Application FireWall) |
| The Web Application Firewall protects the system from most known web attacks. The filter recognizes dangerous threats in incoming requests and blocks intrusions. Proactive Filter is the most effective way to guard against possible security defects in a web project implementation (XSS, SQL Injection, PHP Including etc.). The filter fully analyzes all data received from visitors in variables and cookies. |
| |
* Note that some harmless actions which a visitor may perform can be considered suspicious and cause the filter to react. |
| |
| |
| |
 |
| |
|
protects from most known web attacks; |
|
screens a web application from the most persistent attacks; |
|
filter exclusion list (with wildcards); |
|
recognizes most dangerous threats; |
| |
blocks site intrusions; |
|
protects from possible security errors; |
|
keeps an attack log; |
|
informs administrator about intrusions; |
|
configurable options for firewall reaction to intrusion attempts: |
| |
|
make data safe |
|
delete unsafe data; |
|
temporarily add the attacker’s IP address to the stop list. |
|
|
latest updates. |
|
| |
Control panel to set protection level |
| Any website
based on Qtellwebdesign Site Manager
is preconfigured with the basic
protection level. However, you
can improve the site security
significantly by selecting one
of the Proactive Protection module
presets: standard, high or highest.
The system will show you tips
about any parameter you may need
to configure. |
| |
| |
 |
|
basic level – assigned to all web projects running without the Proactive Protection module; |
|
standard level – enables the most common proactive protection features: |
| |
|
the proactive filter (site wide); |
|
weekly intrusion log; |
|
activity control; |
|
high security level for administrators; |
|
CAPTCHA protected registration procedure; |
|
error logging (errors only). |
|
|
high level is the recommended security level which can be applied to any projects conforming the standard level requirements. This level adds the following features: |
| |
|
Kernel module event logging; |
|
Control Panel protection; |
|
storing sessions in the database; |
|
change of session identifier. |
|
|
highest level includes special protection tools essential for sites keeping confidential user information (web shops etc.). This level is empowered with the following functions: |
| |
|
one time passwords; |
|
control script integrity verification. |
|
|
| |
| |
Intrusion log |
| The intrusion log registers all events occurring in the system including uncommon, suspicious and malicious events. The log is updated in real time so you can view the events as soon as they have been registered. This feature enables you to discover attacks and intrusion attempts while they occur, so you can riposte immediately and even prevent attacks. |
| |
 |
| |
|
immediately registers all system events; |
|
logs attacks detected by the proactive filter: |
| |
|
SQL injection; |
|
XSS attack; |
|
PHP including. |
|
|
filter for malicious events; |
|
view and analyze events in real time to prevent attacks in future; |
|
immediate reaction to malicious events. |
|
| |
One-time passwords |
 |
The Proactive Protection module supports one-time passwords for any site users. These passwords are especially recommended to be used by the site administrators since they significantly improve security of the “Administrators” user group. |
|
The concept of one-time passwords empowers the standard authorization scheme and significantly reinforces the web project security. The one-time password system requires a physical hardware token (device) (e.g., Aladdin eToken PASS) or special OTP software.
This technology gives you confidence that only a user to whom a token has been issued can authorize on the site. Password theft or interception is absolutely excluded because a password can be used only once. A token is a hardware device that generates a unique password only when a token button is clicked. Effectively, this means that a token owner is unable to tell the password to third party to allow them authorize as well.
|
 |
|
| |
 |
|
tracks file system changes; |
|
verifies kernel integrity; |
|
verifies system area integrity; |
|
verifies integrity of public files. |
|
| |
| |
Verification of the file integrity control script |
| Before checking the system integrity, the file integrity control script has to be verified for possible changes. When running the script for the first time, enter a desired password containing at least 10 characters (letters and digits), and any keyword (other than the password), and click “Set New Key”. |
| |
 |
| The system then: |
|
verifies the file integrity control script for changes; |
|
protects the script using the keyword and password pair. |
|
| |
| |
Control Panel protection |
| |
| This type of protection strictly regulates secure networks from which the users are allowed to access Control Panel. All you need to do is specify the legal IP addresses (or a range). No need to worry about not adding yourself to this list: the system will check your IP automatically. |
| |
| What effect will this protection produce? Any XSS/CSS attacks become ineffective, and interception of authorization data becomes absolute useless. |
 |
|
restricts access to Control Panel from any IP’s except those on the white list; |
|
recognizes the user’s IP address automatically; |
|
a user can manually supply the allowed IP addresses and the address ranges. |
|
| |
| |
Session protection |
| Most web attacks are intended to steal an authorized user’s session data. Enabling the session protection makes session hijacking impossible. Furthermore, concerning an administrator’s authorized session, use of session protection is one of the most effective and necessary security measures. |
| |
In addition to the conventional session protection options that are available in the user group parameters, the session protection mechanism includes some special, even unique, features.
|
| |
| Storing session data in the module database prevents data from being stolen by running scripts of other projects on the same server. This approach excludes virtual hosting configuration errors, bad temporary folder permission settings, and other operating system-related errors. Additionally, it reduces file system stress by loading the database server with these operations. |
 |
|
various protection methods: |
| |
|
limited session lifetime (minutes); |
|
recurring session ID relay; |
|
network mask to associate a session with a specific IP; |
|
storing session data in the module database. |
|
|
eliminates virtual hosting and OS configuration errors; |
|
eliminates bad temporary folder permission settings; |
|
reduces file system stress; |
|
makes session ID hijacking impossible. |
|
| |
Activity control |
| Activity Control lets you protect the system from profusely active visitors, obtrusive bots, some DDoS attacks, and password brute force attacks on passwords. You can also set the maximum allowed activity for your site (e.g. number of requests per second a user can perform). |
| |
| User activity control is built around the Web Analytics module's mechanisms and requires this module to be installed. |
| |
 |
|
protects from profusely active users; |
|
protects from bots and DDoS attacks; |
|
prevents brute force attacks on passwords; |
|
allows setting of a maximum possible visitor (human) activity quota; |
|
registers activity quota violations as events in the intrusion log; |
|
blocks visitors exceeding the activity quota; |
|
shows a special information page to a blocked visitor. |
|
| |
| |
| Stop list |
| The stop list contains parameters used to restrict access to a site and possibly redirect to a specified page. Any visitor matching the stop list criteria (e.g. an IP address), will be blocked. |
| |
 |
|
redirects visitors matching the stop list entries; |
|
blocks visitors by their IP addresses; |
|
stop list entry management; |
|
collects statistics on visitors matching the stop list criteria; |
|
allows specification of the ban duration for users, IP addresses, network masks, UserAgent’s and referrer links; |
|
shows a customizable message to a blocked visitor. |
|
| |
| |
Phishing Protection |
| Phishing - is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication. |
| |
 |
| Two methods exist to prevent redirect phishing: |
|
Detect malicious redirects by the lack of a referring page in the HTTP header |
|
Sign links with a digital signature and verify it upon a redirect attempt |
| The following can be used as protection: |
|
Show a redirection warning to a visitor |
|
Unconditionally redirect visitors to site known to be safe |
| Recommended for the high security level. |
|
