Basic Concepts
Common concepts of CWPP are as follow.
- A security baseline refers to a defined set of standards and fundamental requirements that system and service security settings must comply with to fulfill security objectives. Various configuration and policy areas such as account settings, password policies, authorization controls, log management, and network configurations are assessed to determine whether a product meets the security baseline. The evaluation results provide an indication of the overall security posture of the server.
- A Trojan virus is malicious code or a backdoor program concealed within legitimate applications. It can damage or delete files, steal passwords, record keystrokes, launch DDoS attacks, and perform other harmful actions.
- A WebShell is a command execution environment embedded in webpage files like .asp, .php, .jsp, or .cgi, functioning as a type of web backdoor. Once hackers gain access to a website, they typically hide these backdoor files among the regular webpage files within the website server’s WEB directory. This allows them to access the asp or php backdoor through a browser, providing a command execution environment to control the website server.
- Host vulnerability detection is a process performed by a CWPP agent to identify vulnerabilities on a server. The vulnerability detection module operates directly on the server, either verifying or gathering information to assess the presence of security weaknesses.
- Generally, a component (or common component) at the server layer refers to a web container or software associated with a specific service or application, such as Nginx or WordPress. In contrast, a system component typically refers to non-web system software.
- A common component vulnerability (also known as a common vulnerability) primarily refers to a security flaw found in widely used components rather than in business-specific code. Examples include SQL injection in WordPress or the ShellShock vulnerability in the Bash component.
- Unauthorized access is an issue that arises from failing to meet the security baseline, primarily due to insufficient restrictions on access conditions for certain services, such as weak password settings or lack of access source controls. This allows anyone to connect to the service and perform operations, leading to security vulnerabilities.
- By gathering RDP and SSH login logs from the server, details including the source IP address, username, login time, and location are transmitted to the cloud for risk analysis, enabling real-time alerts for unauthorized login attempts.
- Isolation technology separates and contains malicious Trojan and virus files to prevent their spread.