Features & Functionality - 3.9 Security

Question 1

What is SSL and how is it set for a magento store?

Answer 1

• The store URLs are set in Stores > Configuration > General > Web >Base URLs and Base URLs (Secure).
• The Magento portion of going SSL-only involves setting the Base URL to be https://example.com.
• SSL is important as it encrypts traffic going to and from the merchant’s server.

Question 2

What is PCI-DSS?

Answer 2

PCI-DSS: Payment Card Industry Data Security Standard: this applies to an organization (merchant). It covers all aspects of payment security such as authorized employees, physical and electronic security measures, etc.

Question 3

What is PA-DSS?

Answer 3

PA-DSS: Payment Application Data Security Standard: this applies to Magento, Inc.’s products and is a component of being PCI Compliant.

Question 4

What is Patching for in Magento 2?

Answer 4

• Magento releases patches for security vulnerabilities.
• Magento includes cron scripts to automatically patch it (which seems dangerous given Magento’s history with problematic patches).
• Ideal is to review the patch, test it on staging environment, and push live.

Question 5

Does Magento offer security alerting?

Answer 5

Magento offers free security auditing services (Magento Security Center).

Question 6

Can Magento backup your site?

Answer 6

Magento can backup your website, but this will render it unavailable for a period of time.

Question 7

What are three major security features in native Magento 2 Enterprise Edition, and are the same features available in Magento 2 Community Edition?

Answer 7

• Strong data encryption (available in CE)
• Updateable database keys (available in CE)
• Standard security based on OWASP Top 10: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

Question 8

What is the data encryption / hashing key management method used in Magento 2 Enterprise Edition? Is the same method used in Magento 2 Community Edition?

Answer 8

Magento uses an encryption key to protect passwords and other sensitive data. An industry-standard Advanced Encryption Standard (AES-256) algorithm is used to encrypt all data that requires decryption. This includes credit card data and integration (payment and shipping module) passwords. In addition, a strong Secure Hash Algorithm (SHA-256) is used to hash all data that does not require decryption.