Danh sach kiem tra bao mat
VoicePing cong bo danh sach kiem tra bao mat thong tin chi tiet. Bang bao mat VoicePing.pdf| Loai | Hang muc danh gia | Noi dung | Tinh trang |
|---|---|---|---|
| Bao mat | Tinh trang chung nhan cong | Dat ISMS, P-Mark, v.v. | Du kien dat chung nhan ISMS (dang chuan bi) |
| Bao mat | Danh gia cua ben thu ba | Danh gia cac bien phap chong xam nhap, thao tac, lay du lieu trai phep | - |
| Bao mat | Moi truong xu ly thong tin | Han che truy cap du lieu nguoi dung | Han che theo dia chi IP cu the thong qua AWS Security Groups |
| Bao mat | Muc do ma hoa truyen thong | Do manh ma hoa truyen thong | Chi su dung TLS 1.3 |
| Bao mat | Bien phap chong virus | Quet virus | Phat hien lien tuc cac hoat dong trai phep qua AWS GuardDuty |
| Bao ve du lieu | Du lieu sao luu | Ma hoa, vi tri luu tru | Vung AWS Tokyo |
| Bao ve du lieu | Phan tach du lieu giua cac cong ty | Cach ly thong tin giua cac cong ty | Cach ly logic qua co so du lieu |
Bao ve du lieu
Ma hoa truyen thong
- Ung dung va du lieu am thanh/video chi su dung TLS 1.3
- Bat buoc truyen thong HTTPS (cau hinh qua AWS ELB)
Sao luu
- Chu ky thuc hien: Sao luu hang thang qua AWS Database
- Thoi gian luu tru: Nhat ky truy cap may chu duoc luu tru vinh vien tren S3
- Bien phap BCP: Luu tru tu xa da vung tren AWS Database
Han che truy cap du lieu
- Truy cap co so du lieu va may chu bi han che theo dia chi IP cu the thong qua AWS Security Groups
- Du lieu giua cac cong ty duoc cach ly logic qua co so du lieu
Tinh kha dung
Ty le hoat dong
- Thoi gian su dung dich vu: Nguyen tac 24 gio, 365 ngay
- SLA: 99,9% tro len
- Thanh tich: 99,99% tro len (khong co thoi gian ngung may chu vuot qua vai chuc phut ke tu khi bat dau dich vu)
Xu ly su co
- Co sao luu vi sai ma nguon va sao luu DB, cho phep rollback (phuc hoi) ngay lap tuc bat cu luc nao 24/7
- Tat ca cac quy trinh may chu va trang thai he thong duoc hien thi qua AWS CloudWatch hoac he thong canh bao rieng
- Thong bao canh bao trong truong hop co bat ky thoi gian ngung hoat dong nao
Bao tri theo ke hoach
- Cap nhat duoc len lich vao khoang 21:00 moi thu Sau, co the co gian doan ket noi vai giay
- Thong bao thoi gian thuc qua Email hoac ho tro chat van ban (Intercom) neu can cap nhat trong gio lam viec
He thong ho tro
Thong bao su co
- Phuong thuc lien he: Thong bao qua Email va dich vu chat van ban trong ung dung (Intercom)
Lien he khan cap
- Ho tro qua dich vu chat van ban (Intercom) hoac Bieu mau lien he
- Phan hoi trong vong 5 phut trong gio lam viec (9:00-18:00)
Quan ly nguoi dung
Quan ly tai khoan
- Mot tai khoan cho moi nguoi dung
- Nguoi dung co the xoa vat ly tai khoan khi nghi viec hoac chuyen doi
Quan ly mat khau
- Nguoi dung co the thay doi mat khau
- Co san xac thuc hai yeu to qua token Email
Bao mat ung dung web
VoicePing thuc hien cac bien phap bao mat sau.Phong chong SQL Injection
- Backend su dung ORM middleware cho cac thao tac co so du lieu
- Tat ca cau truc cau lenh SQL su dung placeholder
- Cap quyen phu hop cho tai khoan co so du lieu (tai khoan chi co quyen READ, WRITE can thiet)
Phong chong OS Command Injection
- Co ban khong thuc thi Shell
- Khi can logic lop gan Shell, chi thuc thi thong qua cac thu vien da duoc xac minh an toan
Phong chong Path Parameter/Directory Traversal
- Du lieu duoc luu tru tren hosting ben ngoai hoac co so du lieu
- Khong co chuc nang truy cap truc tiep tep tren may chu web
- Ten tep su dung ten ngau nhien, khong the du doan
Quan ly phien
- ID phien su dung chuoi ngau nhien khong the du doan va du dai
- ID phien duoc luu trong Cookie (khong luu trong tham so URL)
- Cookie cho truyen thong HTTPS su dung thuoc tinh Secure
- Cac trang yeu cau dang nhap duoc tach biet khoi cac trang truy cap cong khai
Phong chong Cross-Site Scripting (XSS)
- Su dung cac thu vien frontend tuong thich
- HTTPS bat buoc qua AWS ELB
- Chi dinh ma hoa ky tu (charset) trong truong Content-Type cua header phan hoi HTTP
- Them thuoc tinh HttpOnly vao Cookie
Phong chong CSRF
- Kiem soat truy cap qua phuong thuc POST phia backend
- Xac minh Referer
- Thong bao email tu dong den dia chi email da dang ky cho cac thao tac quan trong
Phong chong HTTP Header Injection
- Su dung API xuat header trong middleware backend
Phong chong Clickjacking
- Xuat truong header X-Frame-Options
- Khong the thuc thi neu khong co phien hop le
- Cac thao tac quan trong duoc thiet ke de khong the thuc hien chi bang chuot
Phong chong Buffer Overflow
- Su dung Node.js, khong cho phep truy cap bo nho truc tiep
- Kiem tra thu vien dinh ky qua GitHub, voi cac PR duoc tao cho cac thu vien co lo hong va cap nhat kip thoi
Kiem soat truy cap va uy quyen
- Xac thuc hai yeu to bang token Email kha dung cho quyen quan ly
- Thuc hien kiem soat uy quyen ngoai xac thuc, ngan nguoi dung dang nhap mao danh nguoi khac