Download to read offline
![26www.nbs-system.com 26www.nbs-system.com Securing recent flaws Example with Magmi (using Apache) RewriteCond %{REQUEST_URI} ^/(index.php/)?magmi/ [NC] RewriteCond %{REMOTE_ADDR} !^192.168.0.1 RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L] Example with Magmi (using Nginx) location ~* ^/(index.php/)?magmi { allow 192.168.0.1; deny all; location ~* .(php) { include fastcgi_params; } }](https://image.slidesharecdn.com/magentosecurity-151015163259-lva1-app6891/75/Magento-security-best-practices-2015-25-2048.jpg)
![27www.nbs-system.com 27www.nbs-system.com Protect your backoffice & updater Example using Apache <Location /wp-admin> AuthType Basic AuthName "Restricted Area" AuthUserFile /etc/apache2/access/htpasswd Require valid-user Order deny,allow Allow from [MY_IP] Satisfy any </Location> Then, just add a user: htpasswd –c /etc/apache2/access/htpasswd [user]](https://image.slidesharecdn.com/magentosecurity-151015163259-lva1-app6891/75/Magento-security-best-practices-2015-26-2048.jpg)
Uploaded byPhilippe Humeau
Magento security best practices 2015
The document outlines Magento security best practices, emphasizing the high risk of e-commerce sites to cyber attacks and the importance of regular updates and secure configurations. Key recommendations include updating to the latest versions of Magento and PHP, employing strong passwords, and utilizing security measures like HTTPS and firewalls. Additionally, it highlights common mistakes and urges businesses to maintain a vigilant security posture through regular reviews and adherence to security policies.
Magento security best practices 2015
- 1. 1www.nbs-system.com 1 Magento Security Bestpractices 2015 Q4 2015 Grow your business safely http://goo.gl/MFpBWS
- 2. 2www.nbs-system.com 2www.nbs-system.com e-Commerce: the60% rules • >60% of web traffic is non-human • >60% of attempts to steal databases target e-Commerce sites • >60% of growth for identity theft over three years • A 2012 study showed Retailer websites are at risk 328 days/year • An IP address is scanned around 40 times per day
- 3.
- 4. 5www.nbs-system.com 5www.nbs-system.com A differenttime scale Seconds Minutes Hours Days Weeks Months Years Time between compromising and discovery of it Time between attack launch and compromising Statistics made based on large corporations in 2012 (Verizon Databreach report)
- 5. 6www.nbs-system.com 6 A *very*bad year www.nbs-system.com
- 6.
- 7. 8www.nbs-system.com 8www.nbs-system.com It allstarted with a big #fail (Shoplift)#@%
- 8. 9www.nbs-system.com 9www.nbs-system.com It allstarted with a big #fail (RSS orders)#@%
- 9. 10www.nbs-system.com 10www.nbs-system.com It allstarted with a big #fail (Magmi)#@%
- 10.
- 11.
- 12. 13www.nbs-system.com 13 But therewere other before www.nbs-system.com
- 13. 14www.nbs-system.com 14www.nbs-system.com Did youtook care of the previous ones?#@%
- 14. 15www.nbs-system.com 15www.nbs-system.com Did youtook care of the previous ones?#@%
- 15. 16www.nbs-system.com 16www.nbs-system.com Did youtook care of the previous ones?#@% The PayPal / Magento integration flaw (by NBS)
- 16. 17www.nbs-system.com 17www.nbs-system.com NBS Systemwill release a new vulnerability soon
- 17. 18www.nbs-system.com 18www.nbs-system.com Or eventhe one that were not Magento specific?#@%
- 18. 19www.nbs-system.com 19www.nbs-system.com PHP: twoversions behind, really? 88% are outdated and not supported anymore… No security fixes. (and +12% to +40% performances to gain) PHP versions in use, in our parc:
- 19. 20www.nbs-system.com 20 Easily exploitablethings beyond classical vulnerabilities www.nbs-system.com
- 20. 21www.nbs-system.com 21www.nbs-system.com Magento Supportgiving dangerous advices • “Chmod 777 your document root…” *REALLY* ? • “Magento is not compatible with Reverse proxies.” *Woot* ? • “Give me your root password so we can look” *NO KIDDING*? • Etc… When Magento support is being creative… Don’t go to a car dealer to fix a bad tooth…
- 21. 22www.nbs-system.com 22www.nbs-system.com Leavingyour logs accessible, especially Debug one Leaving payment gateway logs accessible to all Not hiding Magento, PHP, Apache versions Use a minimum of unaudited extensions, a lot are BAD Weak passwords, along with no locking policies are a plague Classical mistakes that cost…
- 22. 23www.nbs-system.com 23www.nbs-system.com Leavingimport/export scripts, reindexers, crontabs accessible Try calling pages that load very slowly Access directly the API to import / export Etc. Applicative level D.o.S attacks
- 23. 24www.nbs-system.com 24 Securing MagentoFlaws www.nbs-system.com
- 24. 25www.nbs-system.com 25www.nbs-system.com Securing Magentoflaws • Update to versions CE > 1.9 or EE > 1.14.1 • Use PHP 5.6 • Shoplift, Magmi, XML-RPC-XEE : filter the access with a .htaccess file (or an nginx rule)
- 25. 26www.nbs-system.com 26www.nbs-system.com Securing recentflaws Example with Magmi (using Apache) RewriteCond %{REQUEST_URI} ^/(index.php/)?magmi/ [NC] RewriteCond %{REMOTE_ADDR} !^192.168.0.1 RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L] Example with Magmi (using Nginx) location ~* ^/(index.php/)?magmi { allow 192.168.0.1; deny all; location ~* .(php) { include fastcgi_params; } }
- 26. 27www.nbs-system.com 27www.nbs-system.com Protect yourbackoffice & updater Example using Apache <Location /wp-admin> AuthType Basic AuthName "Restricted Area" AuthUserFile /etc/apache2/access/htpasswd Require valid-user Order deny,allow Allow from [MY_IP] Satisfy any </Location> Then, just add a user: htpasswd –c /etc/apache2/access/htpasswd [user]
- 27. 28www.nbs-system.com 28www.nbs-system.com Leveraging nativeMagento security • Use HTTPS in Backoffice & order tunnels access • Change your backoffice default URL • Do *NOT* use a weak password (no « tommy4242 » is not safe) • Put some limits to number of failed login attempts • Put a password expiration time and change it every 3 months • Enforce use of case sensitive password • Disable email password recovery
- 28. 29www.nbs-system.com 29 Securing Webapplication www.nbs-system.com
- 29. 30www.nbs-system.com 30www.nbs-system.com Organizational security •Get a security review • Keep track of vulnerabilities on Magento ecosystem • Have serious passwords, change them every 3 months • Do not keep informations unless they are needed • Pick a PCI/DSS certified hosting company • Use 3D secure • Keep up to date versions of Magento & PHP
- 30. 31www.nbs-system.com 31www.nbs-system.com Infrastructure security •Keep a daily backup • Use a WAF, NAXSI is opensource, free and stable • Put rate limits on your Reverse Proxies • Filter your outgoing trafic It’s the job of your managed services provider.
- 31. 32www.nbs-system.com 32www.nbs-system.com Host levelsecurity • Change default backoffice URL • Disable directory indexing • Have correct permissions : file=644, directory=755 • No follow, no index on preprod • Use the best practices mentioned before It’s the job of your managed services provider.
- 32. 33www.nbs-system.com 33 High endsecurity www.nbs-system.com
- 33. 34www.nbs-system.com Hardware Operating system Network Applicative stack Database Website Humans Motivatingwages Equipe SOC Security trainings Background checks N.A.X.S.I (web application firewall) ReqLimit (Anti applicative DoS) ExecVE killer File Upload checker PHP Suhosin V2 App scan Threadfix virtual patching MySQL Interceptor PHP Suhosin V2 Daemon hardening Anti DDoS Isolated Vlans Firewalling PAX GrSec Watch Folder PHP Malware finder Redundant hardware Redundant datacenters Redundant data storage Redundant telecom uplinks Log central Security Event Manager Flex Dynamic Firewall Ban Commander 9 CerberHost
- 34. 35www.nbs-system.com Contact Grow your businesssafely contact@nbs-system.com +33.1.58.56.60.80 www.nbs-system.com Twitter : @nbs_system www.nbs-system.com