Hardening site security checklist

To harden the security of your WebSphere Commerce site, you can enable and configure various security features. In addition, site customizations must always be made to comply with best practices as outlined in this document.

This is not an all-inclusive list of security measures for your site. This list is designed primarily to facilitate navigation of the WebSphere Commerce security section of the IBM Knowledge Center, and to highlight security considerations for WebSphere Commerce customizations and the secure configuration of other IBM products. Further security hardening might be required to ensure the security of your site. For more information about security standards, see Security Standards.

Development

• Review the securing and developing sections of the WebSphere Commerce documentation. Ensure that you are aware of all security features and development best practices that are in place before you develop additions or customizations.
• Ensure that proper access control is used in all customizations and additions. See, Implementing access control. For a closer look at how to avoid common pitfalls with access control, and for examples of correct implementation, see:
  • Hardening Site Security – Access Control and Data Beans.
  • Hardening Site Security – Implementing Access Control with Commands.
• Reduce the threat of cross-site scripting attacks by ensuring that all output is encoded using the wcf:out tag. For more information about the out tag, see Tag: out. Alternatively, the standard c:out tag can also be used.
• Enable cross-site request forgery protection to protect any sensitive actions. For more information about enabling cross-site request forgery protection, see Enabling cross-site request forgery protection.

Configuration

• Protect your merchant and payment keys by using the Key Locator Framework (KLF).
• Ensure that login timeouts are enabled for user sessions based on cookies. To enable login timeouts, see Enabling login timeout for a cookie-based session. This is even more critical if you have enabled multiple logon support.
• Reduce the risk to session cookies by enabling httpOnly mode. For instructions on how to enable httpOnly mode, see Enabling httpOnly for session cookies.
• Enable whitelist data validation for store URLs and REST calls to disallow non-conforming parameters. For information on whitelist filtering, see Enabling WhiteList data validation.
• Ensure that cross-site scripting protection remains enabled. To ensure that this feature is enabled, see Enabling cross-site scripting protection.
• Secure your WebSphere Commerce search server from unauthorized access. For instructions on securing your search server, see Securing the WebSphere Commerce search server.
• Upgrade your database encryption to a stronger standard to reduce the chance of a successful brute force attack. For instructions on upgrading your database encryption, see Migrating from Triple DES to AES-128 encryption.
• Implement business object thresholds to reduce the threat of denial of service attacks. For instructions on implementing business object thresholds, see Business Object thresholds.
• Secure the Dynamic Cache Monitor from unauthorized access. For information on securing the Dynamic Cache Monitor, see Configuring security for the Dynamic Cache Monitor.
• Use the updateua utility to assign and restrict database permissions for essential control only. For more information about the updateua utility, see Update user authorization utility.
• Ensure that password complexity rules and account lockout policies are in place. See, Setting up a password policy, and Setting up an account lockout policy.

Maintenance and operations

• Subscribe to WebSphere Commerce security bulletins, and review all published security bulletins. For more information, see Security bulletins.
• Ensure that you keep your product up to date with the latest cumulative interim fix. In addition, review and install all additional APAR interim fixes in a timely fashion. Pay particular attention to security-related APARs.
  • For fix pack interim fixes, see List of additional fix pack APAR fixes.
  • For feature pack interim fixes, see List of additional feature pack APAR fixes.
• Test your site thoroughly, and on an ongoing basis. Pay particular attention to any site customizations. Remember: Security is an ongoing process, not a product, or task that is ever complete.
• Implement an encryption key rotation schedule, and ensure that the process is secure. This process reduces the chance of a successful brute force attack, and mitigates the potential outcomes of a compromised key. For information on how to change your encryption key, see MigrateEncryptedInfo utility.
• Use the -passwordFile parameter for all command-line utilities that have such a parameter to limit the exposure of plain text passwords.

Other software

• IBM Sterling Order Management
  • Data security practices to be followed when integrating OMS with an eCommerce system.
• IBM HTTP Server
  • Review and implement all standard web server security considerations. For web server security considerations, see Web server security considerations.
  • Reduce the threat of click jacking by enabling the X-Frame-Options header. For instructions on enabling the X-Frame-Options header, see Enabling the X-Frame-Options header.
• IBM DB2
  • Review DB2 security, Part 8: Twelve DB2 security best practices.
    Note: If you remove implicit authorities and privileges from PUBLIC, ensure that the WebSphere Commerce user is granted the same rights: BINDADDAUTH, CONNECTAUTH, CREATETABAUTH, and IMPLSCHEMAAUTH.
• IBM WebSphere eXtreme Scale
  • Scenario: Securing your data grid in eXtreme Scale.