Differences

This shows you the differences between two versions of the page.

--- versago:versago_application_security [2019/07/31 12:42]
runger created
+++ versago:versago_application_security [2020/09/15 14:49] (current)
@@ Line 1: / Line 1: @@
-SSL certificates are purchased by your company. There are several companies that can provide them. The first point of contact is probably the company where your domain is registered. Major providers of SSL certificates include:
+====== Application Security ======
-  * GoDaddy (www.godaddy.com)
+The following security measures must be implemented in order to secure Versago's operation.
-  * Thawte (www.thawte.com)
-  * Symantec (www.symantec.com)
+===== HTTPS =====
-  * DigiCert (www.digicert.com)
-  * Comodo (www.comodo.com)
+HTTPS with SSL is mandatory for Versago.
+The Versago website requires the use of the SSL option. In order to use this option effectively you will need to acquire an **//[[versago:ssl_certificates|SSL Certificate]]//**. This is a tool that helps ensure secure communication between the web browser and the website.
+===== URL Rewrite =====
+Download and install the **URL Rewrite** extension to IIS which is required by Versago to operate correctly.
+The extension can be downloaded from Microsoft's **//[[https://www.iis.net/downloads/microsoft/url-rewrite|IIS site]]//**
+===== TLS Versions =====
+We recommend that protocols TLS 1.0 and 1.1 be disabled
+<WRAP center round important 80%>
+A server reboot is required after disabling these protocols.
+The protocols can remain active if other applications running on the Versago server require them
+</WRAP>
+<WRAP center round alert 80%>
+Disabling TLS 1.0 and 1.1 may create compatibility issues with Crystal reports whose DB connection is not set using the SQL Native Client 11.0.
+In order to resolve the issue, redefine the DB connections in Crystal reports using the SQL Native Client 11.0.
+This **//[[versago:crystal|article]]//** provides more details on how to redefine the Crystal report data source
+</WRAP>
+The easiest way to toggle SSL protocols is by using a utility called IISCrypto.
+  - Download the **//[[https://www.nartac.com/Products/IISCrypto/Download|IIS Crypto GUI]]//** program
+  - Run the IIS Crypto program
+  - Click on Best Practices
+  - Deselect TLS 1.0 and 1.1 for both Server and Client protocols
+  - Click Apply
+  - Reboot server
+{{ :versago:app_security03.png?600 |}}
+----
+Follow these step to **manually** disable the protocols:
+  - Open the registry editor
+  - Navigate to \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
+  - Set the DisabledByDefault entry DWORD value to 1
+  - Set the Enabled entry DWORD value to 0
+  - Navigate to \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+  - Set the DisabledByDefault entry DWORD value to 1
+  - Set the Enabled entry DWORD value to 0
+  - Repeat for TLS 1.1
+  - Reboot server
+{{ :versago:app_security01.png?600 |}}
+===== Require Server Name Indication =====
+Define a host name and set 'Require Server name Indication' in the bindings settings for the Versago site.
+  - Open IIS Manager
+  - Select the Versago Site on the left pane
+  - Go to the Actions pane to the right and select and edit Bindings
+  - set Hostname to your site's name and select Require Server Name Indication as shown below
+{{ :versago:app_security02.png?600 |}}
-There are other providers as well that can be found via a web search.
-Note that there is a cost for an SSL certificate and it must be renewed yearly.

Wiki

User Tools

Site Tools

Differences

Page Tools