Tato bezpečnostní analýza systému pro správu elektronických dokumentů OpenText Content Server představuje přehled možných zranitelností a jejich řešení. Záměrem bylo představit jednotlivé části systému, jejich role a vliv na bezpečnost systému. A na základě těchto informací identifikovat možné zranitelnosti. Cílem bylo prozkoumat v praxi často přehlížené nebo starší části systému, jako jsou výchozí nastavení a integrované sofwarové komponenty třetích stran. Identifikované zranitelnosti, vektory útoku, taktika a techniky byly klasifikovány pomocí standardů MITRE. Výsledkem této práce je ověřený postup jak systém dodatečně zabezpečit.
Annotation in English
This Security Analysis of the OpenText Content Server Electronic Document Management System provides an overview of possible weaknesses and creates a hardening guide for their mitigation. It aims to develop a better understanding of the system components, their functional role, and how they affect system security. Such an understanding helps to recognize possible weaknesses. The focus was mainly on overlooked or legacy parts of the platform, such as default settings and integrated third-party software components. Identified weaknesses, attack vectors, adversary tactics, and techniques were classified using MITRE standards. The hardening guide with tested steps is created as an outcome of this thesis.
Keywords
OpenText, Content Server, Archive Server, Archive Center, Livelink, bezpečnostní analýza, kyberbezpečnost, podnikový
Tato bezpečnostní analýza systému pro správu elektronických dokumentů OpenText Content Server představuje přehled možných zranitelností a jejich řešení. Záměrem bylo představit jednotlivé části systému, jejich role a vliv na bezpečnost systému. A na základě těchto informací identifikovat možné zranitelnosti. Cílem bylo prozkoumat v praxi často přehlížené nebo starší části systému, jako jsou výchozí nastavení a integrované sofwarové komponenty třetích stran. Identifikované zranitelnosti, vektory útoku, taktika a techniky byly klasifikovány pomocí standardů MITRE. Výsledkem této práce je ověřený postup jak systém dodatečně zabezpečit.
Annotation in English
This Security Analysis of the OpenText Content Server Electronic Document Management System provides an overview of possible weaknesses and creates a hardening guide for their mitigation. It aims to develop a better understanding of the system components, their functional role, and how they affect system security. Such an understanding helps to recognize possible weaknesses. The focus was mainly on overlooked or legacy parts of the platform, such as default settings and integrated third-party software components. Identified weaknesses, attack vectors, adversary tactics, and techniques were classified using MITRE standards. The hardening guide with tested steps is created as an outcome of this thesis.
Keywords
OpenText, Content Server, Archive Server, Archive Center, Livelink, bezpečnostní analýza, kyberbezpečnost, podnikový
Carry out a literary search on the topic of the work.
Describe the document management system and its typical configuration.
Describe and categorize possible threats and attack vectors.
Design methods for security analysis of potential attack vectors.
Evaluate the level of risk of the identified threats.
Design appropriate solutions to eliminate threats.
Evaluate the chosen solution.
Research Plan
Carry out a literary search on the topic of the work.
Describe the document management system and its typical configuration.
Describe and categorize possible threats and attack vectors.
Design methods for security analysis of potential attack vectors.
Evaluate the level of risk of the identified threats.
Design appropriate solutions to eliminate threats.
Evaluate the chosen solution.
Recommended resources
HENRIQUES DE GUSM ΑO, Ana Paula, MENDONÇA SILVA, Maisa, POLETO, Thiago, CAMARA E SILVA, Lúcio and CABRAL SEIXAS COSTA, Ana Paula, 2018. Cybersecurity risk analysis model using fault tree analysis and fuzzy decision theory. International Journal of Information Management. 1 December 2018. Vol. 43, p. 248–260. DOI 10.1016/j.ijinfomgt.2018.08.008.
HUBBARD, Douglas W., SEIERSEN, Richard, GEER, Daniel E. and MCCLURE, Stuart, 2016. How to Measure Anything in Cybersecurity Risk. 1st edition. Wiley.
KENNEDY, David, O’GORMAN, Jim, KEARNS, Devon and AHARONI, Mati, 2011. Metasploit: The Penetration Tester’s Guide. 1st edition. No Starch Press.
REGALADO, Daniel, HARRIS, Shon, HARPER, Allen, EAGLE, Chris, NESS, Jonathan, SPASOJEVIC, Branko, LINN, Ryan and SIMS, Stephen, 2018. Gray Hat Hacking: The Ethical Hacker’s Handbook, Fifth Edition. 5th edition. McGraw-Hill Education.
WEAR, Sunny, 2018. Burp Suite Cookbook: Practical recipes to help you master web penetration testing with Burp Suite. 1st edition. Packt Publishing.
Recommended resources
HENRIQUES DE GUSM ΑO, Ana Paula, MENDONÇA SILVA, Maisa, POLETO, Thiago, CAMARA E SILVA, Lúcio and CABRAL SEIXAS COSTA, Ana Paula, 2018. Cybersecurity risk analysis model using fault tree analysis and fuzzy decision theory. International Journal of Information Management. 1 December 2018. Vol. 43, p. 248–260. DOI 10.1016/j.ijinfomgt.2018.08.008.
HUBBARD, Douglas W., SEIERSEN, Richard, GEER, Daniel E. and MCCLURE, Stuart, 2016. How to Measure Anything in Cybersecurity Risk. 1st edition. Wiley.
KENNEDY, David, O’GORMAN, Jim, KEARNS, Devon and AHARONI, Mati, 2011. Metasploit: The Penetration Tester’s Guide. 1st edition. No Starch Press.
REGALADO, Daniel, HARRIS, Shon, HARPER, Allen, EAGLE, Chris, NESS, Jonathan, SPASOJEVIC, Branko, LINN, Ryan and SIMS, Stephen, 2018. Gray Hat Hacking: The Ethical Hacker’s Handbook, Fifth Edition. 5th edition. McGraw-Hill Education.
WEAR, Sunny, 2018. Burp Suite Cookbook: Practical recipes to help you master web penetration testing with Burp Suite. 1st edition. Packt Publishing.
