When using a web-based interface to a critical application such as a PIM system, ensuring the security of the data is crucial.
This page aims to outline the security considerations related to using Perfion over the Internet. It is divided into two parts:
- Part 1 will focus on a description of how Perfion is built to accommodate for a secure deployment
- Part 2 will focus on guidelines for setting up a secure web server with Perfion
Security in the Perfion Web GUI
Application components
The Perfion Web GUI is essentially a server application that interacts with individual clients or browsers :
As such, the Perfion database remains hidden without exposure to the Internet. The security surrounding the database itself is the same as it would be in a scenario without the Web GUI, and will not be discussed here.
The Perfion Web GUI is built using Angular, a TypeScript-based open-source front-end web application platform maintained by the Angular Team at Google and a wide community of contributors. Angular is widely adoped and is considered industry standard for web applications. For information regarding the built-in security of Angular, we refer to the general Angular community : https://angular.io/guide/security .
The web server is hosted by Microsoft Internet Information Services (IIS) which is also a widely recognized industry standard. IIS offers numerous configuration options, allowing it to be tailored to various needs.
Authentication
When a user connects to the web GUI, their username and password generate a token, which is used for all subsequent communication with the server.
This token is stored in the local browser storage, and is protected from injection attacks, as Angular prevents XSS attacks.
However, if an attacker obtains the username and password of a Perfion user, they would have the same access rights as the legitimate user. For this reason, Perfion encourages customers to implement and enforce their own individual password policies to enhance security.
Development guidelines and principles
Perfion's development team adheres to the general principles and best practices described on https://angular.io/guide/security .
Furthermore, the OWASP developer guide is considered (https://www.owasp.org/index.php/OWASP_Guide_Project), although no formal certification process is in place.
By following Angular’s best practices, many previously common pitfalls are avoided. For example, scripting attacks are prevented because all user inputs are treated as untrusted text and HTML/JavaScript symbols are properly escaped. A deliberate exception from this rule is the PDF viewer, where the file contents are used as-is. Perfion is not responsible for any security risks associated with the files upload by users.
Users and data access
All users of the Perfion Web GUI are created as standard users within Perfion. This means that the administrator has full control over which parts of the database the user can view or edit. For more details on how to restrict user access, please refer to the Windows Client User Guide.
Any restrictions applied in the Perfion Windows Client, are also respected and enforced in the Web GUI.
Web server security
Microsoft Internet Information Services (IIS) can be configured in various ways, depending on the usage scenario and the preferences of the organization using it.
In some cases, the IIS will only be accessible from the internal network. In these situations, certain security measures become less critical, as access is restricted to machines behind the company’s firewall.
In other cases, where Internet connectivity is necessary, a range of security measures can be implemented, from moderate to more stringent approaches. Perfion always recommends setting up the web server for HTTPS. For enhanced security, it is also possible to implement a whitelist of IP addresses or devices that are allowed to access the web server. However, addressing such configurations is beyond the scope of this page.
For more information on secure setup, here are some useful resources:
Comments
0 comments
Please sign in to leave a comment.