1 Function description
Open Level 3 Safety Assessment
Security evaluation is mainly used for security scanning. Before security scanning, check the security evaluation items such as the upper three levels to increase the passing probability.
2 operating instructions
2.1 safety evaluation items
[Server] - [Security Configuration] - [Security Evaluation] Check the account login failure lock, the login interface does not display API, API login is prohibited, API access is prohibited, and log management is closed
Account login failure lock: login platform, account password input error 3 times, will be locked for 30 minutes
Login interface does not display API:web login interface does not display API
Prohibit API logon: Call the API logon interface and return {"result":500}
disable API access: call api to return 404 directly
Turn off log management: disable access to the platform communication log URL, access return 404
2.2 login password policy
[Server] - [Security Configuration] - [Password Configuration] Check account password strength verification, login password AES encryption
Account password strength verification: When adding account information or modifying a password, the password strength is verified. A complex password is required (the password must be 8- 16 characters in length and must contain numbers, uppercase letters, and lowercase letters).
Login password AES encryption: After checking, the password information of the account is stored in the database in AES256 encryption mode