| Current Path : /var/www/homesaver/www/bitrix/modules/main/lang/en/admin/checklist/ |
| Current File : /var/www/homesaver/www/bitrix/modules/main/lang/en/admin/checklist/QSEC0010.html |
<p>All the new releases and updates of Bitrix Framework are thoroughly tested by the IT security department. Nevertheless, the following threats may still persist.</p> <ul> <li>Coding errors committed when developing a Bitrix Framework powered solution.</li> <li>Registered users confide in easy to remember but weak passwords like <i>qwerty </i>or <i>123456</i>.</li> <li>The website administrators may also tend to use weak passwords which is significantly more dangerous.</li> <li>Attackers can be very resourceful to intercept passwords transmitted over insecure connections like wi-fi.</li> <li>Inappropriately authored system errors may reveal the web solution intrinsics.</li> <li>Server and database software may have unknown errors which attackers may exploit.</li> </ul> <p>Therefore, it is obvious that a web project requires an integrated, multilevel approach to defending its security. Relying on only one tool or software is unwise and ultimately dangerous.</p> <p>To provide a web project with an adequate level of security, select the "Standard" security option (proactive protection and activity control are enabled, administrator security level is set to "High", CAPTCHA-protected registration; no system information is included in error messages). </p> <p>To protect session data and passwords, prevent phishing and viruses, give extra protection to Control Panel set the security level to "High" or "Highest". </p> <ol> <li>Open "Settings > Proactive Protection > Protection Panel". Ensure the security level is not lower than "Standard". Otherwise, follow the Control Panel recommendations to reach this level.</li> <li>If required, follow the Control Panel recommendations to reach the "High" or "Highest" level.</li> </ol>