Identifying and mitigating security risks
2 Tasks
20 mins
Scenario
MDC's Delivery Service application prepares to go live. A security review is necessary before promoting the application to production, and any discovered security risks need to be reviewed.
Conduct a security review of MDC's Delivery Service application using the security checklist. Offer recommendations to enhance the application's security.
You can implement some changes directly in the development environment, while others require configuration after promoting the application to the production environment. Compile a list of configuration tasks for changes that the development environment cannot implement, to be carried out after promoting the application to other environments.
The following table provides the credentials you need to log in to the Delivery Service application. However, this challenge is mainly meant for evaluating the design options, and there are no specific implementation tasks.
| Role | User name | Password |
|---|---|---|
| Admin | admin@deliveryservice | rules |
Detailed Tasks
1 Tasks to perform on the development environment
- Deactivate unnecessary out-of-the-box operators.
- Change passwords for active out-of-the-box operators.
- Address any issues identified by the security analyzer.
- Fix any security issues in the Guardrail report.
- Ensure that timeouts at the application server level, requestor level, and Access Group level have suitable durations.
- Add the
<env name="alerts/suppressalerts" value="true" />setting to the prconfig.xml file to ensure that sensitive property values, such as customer account numbers and Social Security numbers, do not appear in the Alert log. - In each ruleset version, on the Security tab, select the Lock this Version checkbox and enter a password.
- In each ruleset rule, on the Security tab, select the Use checkout? checkbox and enter three distinct passwords to limit the ability to add versions, update versions, and update the ruleset rule itself.
- Ensure that properties are of the correct type (for example, integers and dates, not just text).
- Apply privileges across all the relevant rules (flow actions, reports, flows).
- Review the Unauthenticated access group to ensure that it has the minimum required access to rules.
- Ensure that connectors and services have suitable security measures.
- If the application allows document uploads, ensure that a virus checker is installed.
- Ensure that file types are restricted.
2 Tasks to perform outside of the development environment
- Set the production level to an appropriate value in the System record. Set the production level to 5 for the production environment.
- Update Configuration Sets.
- Update prconfig settings.
- Update dynamic system settings.
- Remove any unnecessary resources or servlets from the web.xml file. Rename default servlets where applicable, particularly PRServlet and PRAuth.
- If using https, ensure that testing environments are available to test with SSL enabled.
- Ensure that the system has been set up using a JDBC connection pool through the application server, rather than the database being set up in the prconfig.xml file.
- Rename and redeploy the prweb.war for each node.
- Enable security policies.
Confirm your work
Available in the following mission:
Want to help us improve this content?