Reporting - Security Reports - Revision history

Philip Lacey: /* Web applications */

2015-12-31T14:29:12Z

‎Web applications

Philip Lacey: /* Web applications */

2015-12-31T14:28:56Z

‎Web applications

Philip Lacey: /* Module Access Report */

2015-10-13T15:31:31Z

‎Module Access Report

Philip Lacey at 15:29, 13 October 2015

2015-10-13T15:29:13Z

Philip Lacey at 12:22, 4 May 2015

2015-05-04T12:22:35Z

Philip Lacey at 12:35, 7 January 2015

2015-01-07T12:35:36Z

Philip Lacey at 12:20, 7 January 2015

2015-01-07T12:20:44Z

Philip Lacey at 12:20, 7 January 2015

2015-01-07T12:20:26Z

Philip Lacey: Created page with "= Overview = The primary interface security reports are available through ''Main Menu > System Access Management > Security Reports'' These reports are collectively referr..."

2015-01-07T12:18:49Z

Created page with "= Overview = The primary interface security reports are available through ''Main Menu > System Access Management > Security Reports'' These reports are collectively referr..."

New page

= Overview =

The primary interface security reports are available through ''Main Menu > System Access Management > Security Reports''

These reports are collectively referred to as Security - Application Level reports.

They can be viewed under a number of categories.

= Report Types =

== Password Attacks ==

Passwords and their maintenance is a responsibility of the bxp client. There are a number of reports to facilitate easier user management.

''Main Menu > System Access Management > Security Reports >''

* Security - Password Strength [[Security_-_Password_Strength_Report]]
* Login Report - Last Login [[Security_-_Last_Login_Report]]
* Login Report - All Logins
* Login Report - Failed Logins
* Login Report - Failed Logins - IP Restricted

== Maintaining Access ==

Ensuring that bxp is available is a complex task when you consider is the Infrastructure, Network and Application are available.

The primary test is that the login page of your system is available https://ww3.allnone.ie/client/client_XXX/main/login.asp responds. The demo system can be used to ensure IP address restrictions are not being applied https://ww3.allnone.ie/client/client_express/main/login.asp

Where a system check is required, there is an engine available through the BEAPI for heartbeat checking. https://ww3.allnone.ie/client/client_xxx/cti/userCTI_Alive.asp It is also possible to use the Demo system for independent checking https://ww3.allnone.ie/client/client_express/cti/userCTI_Alive.asp

bxp has been 100% available since October 2008

Outages, security changes and information updates are available through the bxp Client Dashboard [[bxp_Client_Dashboard_Report]]

== Reverse Engineering ==

The output of bxp is XHTML 1.0, CSS and JavaScript (including AJAX, JSON, jQuery and other JavaScript libraries). Client side rendered information is easily viewable. Server side code is written in Classic ASP and VBScript with DOS and VBScript scripting supporting server processes. Microsoft IIS Server maintains the security of not delivering server side code to the client browser.

Error messages generated from IIS are communicated in the form of Hamsters. [[Meet_the_Hamsters]]. A Hamster report is also available through the [[bxp_Client_Dashboard_Report]] for bxp client review and management.

At the bottom of every page is a "Debug Information" link. This link mirrors back to the user all the information their browser is transmitting for client side reverse engineering.

== Stress Testing ==

Stress testing is performed internally on a client request basis. The results of stress tests are made available through the bxp Client Dashboard [[bxp_Client_Dashboard_Report]]

== Vulnerability Analysis ==

The primary vulnerability at an application level for security is improper user account management. There are a number of mechanisms to support management of this area

''Main Menu > System Access Management > Security Reports >''

The primary report is Security - User Status [[Security_-_User_Status]] This provides an overview of all users, including individual users by department.

It is important to understand the difference between Function and Content [[Function_Vs._Content]].

Function: This can be reviewed on a user by user basis using ''Main Menu > System Access Management > User Administration > Edit User - Security Details > Lookup the user > Select the user > '' It is possible to see what modules and sections are allocated to the user.

Content: This can be reviewed using ''Main Menu > System Access Management > Security Reports > Security - User Profile - By Lookup > Lookup the user > Select the user > '' which shows what content is available on a user by user basis.

If vast amounts of content are added or removed it is important for the bxp client to track these details. ''Main Menu > System Access Management > Security Reports > System Reports - System Profile'' provides a benchmark profile of the system.

There are various security events that occur in the system such as user adding, editing, etc. These are all audit-able through ''Main Menu > System Access Management > Security Reports > Security - System Event Audit Trail'' [[System_Access_Management_-_Security_-_System_Events_Audit_Trail]]

System level identified vulnerabilities are communicated the bxp Client Dashboard [[bxp_Client_Dashboard_Report]]

== Web applications ==

All n One generate security reviews of client applications on behalf of the client as a paid service. [[Client_security_reports]] These reports are delivery back to the client through the bxp Client Dashboard. [[bxp_Client_Dashboard_Report]]

← Older revision		Revision as of 14:29, 31 December 2015
Line 122:		Line 122:


−	All n One generate security reviews of client applications on behalf of the client as a paid service. [[~~bxp~~ - ~~Client_security_reports~~]] These reports are delivery back to the client through the bxp Client Dashboard. [[bxp_Client_Dashboard_Report]]	+	All n One generate security reviews of client applications on behalf of the client as a paid service. [[Bxp_-_Client_Security_Report]] These reports are delivery back to the client through the bxp Client Dashboard. [[bxp_Client_Dashboard_Report]]

← Older revision		Revision as of 14:28, 31 December 2015
Line 122:		Line 122:


−	All n One generate security reviews of client applications on behalf of the client as a paid service. [[Client_security_reports]] These reports are delivery back to the client through the bxp Client Dashboard. [[bxp_Client_Dashboard_Report]]	+	All n One generate security reviews of client applications on behalf of the client as a paid service. [[bxp - Client_security_reports]] These reports are delivery back to the client through the bxp Client Dashboard. [[bxp_Client_Dashboard_Report]]

@@ Line 28: / Line 28: @@
 Select the module and sections that are required and submit the page.
-The page lists off any users, modules and if the user has access to them.
+The page lists off all users and modules selected, and if the user has access to them.
 [[File:AccessReport_Screen.jpg]]
 == Password Attacks ==

← Older revision		Revision as of 15:29, 13 October 2015
Line 12:		Line 12:

	= Report Types =		= Report Types =
		+
		+
		+
		+	== Module Access Report ==
		+
		+
		+	The module access report shows what modules a user has access to in the system.
		+
		+	''Main Menu > System Access Management > Security Reports > Security - Group User - Access Report''
		+
		+	The first step is to limit by user, if no user is selected all users will be shown.
		+
		+	The next step is to limit by module and section.
		+
		+	Select the module and sections that are required and submit the page.
		+
		+	The page lists off any users, modules and if the user has access to them.
		+
		+
		+	[[File:AccessReport_Screen.jpg]]
		+

@@ Line 107: / Line 107: @@
-[[Category:Security]]
+[[Category:Topic:Security]]
-[[Category:Reporting]]
+[[Category:Topic:Reporting]]
 [[Category:Module Specific:System Access Management]]

← Older revision		Revision as of 12:35, 7 January 2015
Line 58:		Line 58:


−	At the bottom of every page is a "Debug Information" link. This link mirrors back to the user all the information their browser is transmitting for client side reverse engineering.	+	At the bottom of every page is a "Debug Information" link. This link mirrors back to the user all the information their browser is transmitting for client side reverse engineering of browser output.

← Older revision		Revision as of 12:20, 7 January 2015
Line 104:		Line 104:

	All n One generate security reviews of client applications on behalf of the client as a paid service. [[Client_security_reports]] These reports are delivery back to the client through the bxp Client Dashboard. [[bxp_Client_Dashboard_Report]]		All n One generate security reviews of client applications on behalf of the client as a paid service. [[Client_security_reports]] These reports are delivery back to the client through the bxp Client Dashboard. [[bxp_Client_Dashboard_Report]]
		+
		+
		+
		+	[[Category:Security]]
		+	[[Category:Reports]]
		+	[[Category:Module Specific:System Access Management]]