Security - Secure Profile

Production Secure Profile Deployment Checklist

PRE-DEPLOYMENT:
□ Backup current configuration (neo-security.xml and other config files)
□ Document current security settings
□ Apply Production Secure Profile to staging/test environment
□ Run full application test suite
□ Test all critical user workflows
□ Verify file upload/download functionality
□ Test any admin or privileged operations
□ Review application logs for permission errors
□ Document any required exceptions/modifications

DEPLOYMENT:
□ Schedule during maintenance window
□ Notify stakeholders of deployment
□ Apply Production Secure Profile in administrator
□ Restart ColdFusion service (if required)
□ Verify profile applied successfully
□ Test critical application functions immediately

POST-DEPLOYMENT:
□ Monitor application logs for errors
□ Test core functionality
□ Verify no unexpected permission errors
□ Document applied profile and date
□ Update security documentation
□ Schedule regular security reviews

ROLLBACK PLAN:
□ Have configuration backup ready
□ Document rollback procedure
□ Test rollback in staging first
□ Keep previous config for quick restore

/**
 * Test if specific tags/functions are disabled by Secure Profile
 * Use this to verify production security settings
 */

// Test cfexecute
try {
    cfexecute(name="whoami", variable="result", timeout=1);
    writeOutput("⚠️ WARNING: cfexecute is ENABLED<br>");
} catch (any e) {
    writeOutput("✓ cfexecute is disabled (expected)<br>");
}

// Test cfregistry (Windows only)
try {
    cfregistry(action="list", branch="HKEY_LOCAL_MACHINE", name="regTest");
    writeOutput("⚠️ WARNING: cfregistry is ENABLED<br>");
} catch (any e) {
    writeOutput("✓ cfregistry is disabled (expected)<br>");
}

// Test Java object creation
try {
    javaObj = createObject("java", "java.lang.System");
    writeOutput("⚠️ WARNING: Java object creation is ENABLED<br>");
} catch (any e) {
    writeOutput("✓ Java object creation is restricted (expected)<br>");
}

// Test Admin API access
try {
    adminAPI = createObject("component", "cfide.adminapi.administrator");
    writeOutput("⚠️ WARNING: Admin API is accessible<br>");
} catch (any e) {
    writeOutput("✓ Admin API is restricted (expected)<br>");
}

writeOutput("<br><strong>Note:</strong> All restricted items should show as disabled in production.");

SECURITY EXCEPTION DOCUMENTATION

Exception ID: SEC-EXC-001
Date Requested: 2025-10-27
Requested By: Development Team

SECURE PROFILE EXCEPTION REQUEST
=================================

Affected Setting:
  cfexecute tag - Currently disabled by Production Secure Profile

Business Justification:
  Report generation system requires cfexecute to call external
  PDF processing tool (wkhtmltopdf) for invoice generation.
  Approximately 10,000 invoices generated monthly.
  No viable alternative found.

Security Impact Assessment:
  RISK LEVEL: Medium-High
  - Command injection possible if user input not sanitized
  - Limited to specific directory via sandbox
  - Only specific executable allowed

Mitigation Measures:
  ✓ Sandbox security restricts cfexecute to /reports directory only
  ✓ Only whitelisted executable allowed: /usr/local/bin/wkhtmltopdf
  ✓ All user input validated/sanitized before execution
  ✓ Command arguments built using parameterization
  ✓ Execution logging enabled
  ✓ Monitoring alerts for unusual execution patterns

Implementation:
  1. Enable cfexecute in Administrator
  2. Configure sandbox for /reports directory
  3. Whitelist only required executable
  4. Enable audit logging
  5. Deploy monitoring alerts

Approved By: Security Team (Jane Doe)
Date Approved: 2025-10-27
Review Date: 2026-01-27 (quarterly review)

QUARTERLY REVIEW CHECKLIST:
□ Is this exception still required?
□ Have alternative solutions become available?
□ Have there been any security incidents?
□ Are mitigation measures still effective?
□ Update review date for next quarter