Mattermost

Security Overview

Add Comment

Mattermost 5.33 <ul> <li>Overview<ul> <li>Product Overview</li> <li>Security Overview<ul> <li>Security Features<ul> <li>Private Cloud Deployment with Secure Mobile Apps</li> <li>Centralized Security and Administration</li> <li>Transmission Security</li> <li>Integrity and Audit Controls</li> <li>Authentication Safeguards</li> <li>Access Control Policy</li> </ul> </li> <li>Security Updates</li> <li>Security Policies</li> <li>HIPAA compliance</li> <li>FINRA compliance</li> </ul> </li> <li>Integrations Overview</li> <li>Licensing and Subscription</li> <li>Mattermost Cloud Overview</li> <li>Corporate Directory Integration</li> <li>Certifications and Compliance Overview*</li> <li>Frequently Asked Questions (FAQ)</li> </ul> </li> <li>Cloud Administrator's Guide</li> <li>Self-Managed Administrator's Guide</li> <li>User's Guide</li> <li>Integration Guide</li> <li>Developer's Guide</li> </ul> Mattermost <ul> <li>Docs »</li> <li>Mattermost Overview »</li> <li>Security Overview</li> <li> Edit </li> </ul> Security Overview¶ Security in Mattermost software is continually reviewed by developers, IT administrators, and security researchers accountable for deploying the software in their organizations. Multiple rounds of penetration testing and security analysis, in addition to internal reviews, have produced a long list of safeguards, processes, policies, and compliance features: Contents <ul> <li> Security Overview <ul> <li> Security Features <ul> <li> Private Cloud Deployment with Secure Mobile Apps </li> <li> Centralized Security and Administration </li> <li> Transmission Security </li> <li> Integrity and Audit Controls </li> <li> Authentication Safeguards </li> <li> Access Control Policy </li> </ul> </li> <li> Security Updates </li> <li> Security Policies </li> <li> HIPAA compliance </li> <li> FINRA compliance </li> </ul> </li> </ul> To expand on each: Security Features¶ Mattermost offers a host of features to help keep your private cloud communications secure. Private Cloud Deployment with Secure Mobile Apps¶ <blockquote> <ul> <li> Mattermost can run entirely behind your firewall as a single Linux binary with MySQL or PostgreSQL. </li> <li> Mattermost mobile apps can be deployed to an internal Enterprise App Store by using source code available for Mattermost mobile apps and push notification service. Optionally VPN clients on PC and mobile devices can be used outside your private network. </li> <li> Optionally, Mattermost mobile apps can run without a VPN by opening standard ports on your Mattermost server, such as 80 or 443. In this configuration, you have the option of using compiled iOS and Android applications in iTunes and Google Play provided by Mattermost, Inc. (E10, E20), as well as enabling multi-factor authentication (E10, E20). </li> <li> User sessions across web, PC, and mobile can be remotely revoked through account settings, or via the System Console by deactivating accounts. </li> <li> Mattermost apps can be packaged into leading Enterprise Mobility Management solutions including AirWatch and Blackberry through AppDome. </li> </ul> </blockquote> Centralized Security and Administration¶ <blockquote> <ul> <li> Manage users, teams, access control, and system settings in a web-based System Console user interface. </li> </ul> </blockquote> Transmission Security¶ <blockquote> <ul> <li> Mattermost supports TLS encryption using AES-256 with 2048-bit RSA on all data transmissions between Mattermost client applications and the Mattermost server across both LAN and internet. </li> <li> Connections to Active Directory/LDAP can be optionally secured with TLS or stunnel (E10). </li> <li> Encryption-at-rest is available for messages via hardware and software disk encryption solutions applied to the Mattermost database, which resides on its own server within your infrastructure. To enable end user search and compliance reporting of message histories, Mattermost does not offer encryption within the database. </li> <li> Encryption-at-rest is available for files stored via hardware and software disk encryption solutions applied to the server used for local storage or storage via MinIO. </li> <li> Encryption-at-rest is available for files stored in Amazon’s proprietary S3 system using server-side encryption with Amazon S3-managed keys (E20) when users choose not to use open source options. </li> <li> Option to exclude message contents from push notifications to comply with strict compliance policies, such as US HIPAA standards. </li> <li> Ability to exclude or include the contents of messages in push notifications to avoid disclosure on locked mobile screens, and via relay servers from Apple and Google when sending notifications to iOS or Android mobile apps (relevant to compliance standards such as HIPAA). </li> </ul> </blockquote> Integrity and Audit Controls¶ <blockquote> <ul> <li> By default, Mattermost stores a complete history of messages, including edits and deletes, along with all files uploaded. User interface actions for “deleting” messages and channels remove the data only from the user interface. the data is retained within your database. If your compliance guidelines require it, you can turn off users’ ability to edit and delete their messages after they are posted. </li> <li> Use an antivirus plugin to scan for viruses before uploading a file to Mattermost. Supports ClamAV anti-virus software across browser, Desktop App, and Mobile Apps. </li> <li> Custom data retention policies on messages and file uploads is available (E20). A daily data deletion job can be scheduled that deletes messages from the database and user interface, and file uploads from local file storage or Amazon S3, which exceed the specified retention period. </li> <li> The output and archives of server logs can be saved to a directory of your choice. Mattermost server logs plus logs from your web proxy can provide an end-to-end history of system usage. </li> <li> Ad hoc compliance reports of messaging by user, date range, and keyword, including edited and deleted messages are available (E20). To protect against unauthorized use, all ad hoc report requests are logged. </li> <li> Daily compliance reports compatible with third-party compliance solutions such as Global Relay and Actiance are also available (E20). </li> </ul> </blockquote> Authentication Safeguards¶ <blockquote> <ul> <li> To protect against brute force attacks, you can set rate limiting on APIs, varied by query frequency, memory store size, remote address, and headers. </li> <li> Session length, session cache, and idle timeout can be configured according to your internal policies, automatically forcing a user to re-login after a specified period of time. </li> <li> Remotely revoke user sessions across web, mobile devices, and native desktop apps. </li> <li> Remotely reset user passwords via the System Console or via the command line. </li> <li> Mattermost supports integrated authentication with Active Directory and LDAP (E10) as well as SAML 2.0 SSO integration with providers including Active Directory Federation Services, Okta, among others (E20). </li> <li> The ability to require multi-factor authentication is also available (E10). </li> </ul> </blockquote> Access Control Policy¶ To prevent account enumeration, if a user logs in and enters incorrect login details a generic error is presented. Security is a top concern for organizations who deploy Mattermost in a private network. While running under existing policies and auth protocols of the private network, we prioritize a better user experience (telling a user what went wrong on login) ahead of preventing users on the private network from enumerating accounts. Mattermost is optimized to be deployed in a highly secure environment. However, admins are given a choice as to the deployment environment. When Mattermost is deployed outside a firewall, Admins must be aware that their system is exposed to issues inherent in public cloud deployments. In this case, we generally follow the standards of leading online services. For example, Gmail offers APIs that not only confirm whether an email account exists, but also displays the user’s profile picture by default. Mattermost undergoes extensive penetration testing, security reviews, and security updates. You can find further details and previous discussion in our GitHub thread. In addition, the following policies are provided: <blockquote> <ul> <li> Limit communications to specific users, private channels, or team-wide public channels. </li> <li> Increase system security by restricting email-based account creation to email addresses from a list of specific domains, e.g. “corp.mattermost.com”, “mattermost.org”, etc.” </li> <li> Choose whether to restrict or enable cross-origin requests. </li> <li> If sharing of public links for account creation or sharing of files and images are enabled, links can be invalidated via the System Console by regenerating salts. </li> <li> Optionally add advanced passwords requirements with minimum numbers of symbols, numbers, lower, and uppercase letters. </li> <li> Optionally restrict creation, renaming, archiving of channels, private channels and integrations to Team Admins, System Admins, or end users (E10). </li> <li> Optionally restrict sending team invites to Team Admins, System Admins, or end users (E10). </li> </ul> </blockquote> Security Updates¶ Security updates address newly discovered attacks reported to Mattermost, Inc. by the security research community. Disclosures are made confidentially, under the Mattermost responsible disclosure policy, allowing for Mattermost, Inc. to provide security updates to the community prior to public disclosure. For more information, please see: <ul> <li> <dl> <dt>Mattermost Security Updates Disclosures</dt> <dd> <ul> <li> A summary of security updates made based on past and on-going security analysis and penetration testing. </li> </ul> </dd> </dl> </li> <li> <dl> <dt>Mattermost Responsible Disclosure Policy</dt> <dd> <ul> <li> An overview of how security issues are confidentially reported to and addressed by Mattermost, Inc. </li> </ul> </dd> </dl> </li> </ul> Security Policies¶ For information on internal security policies, development guidelines, business continuity plans, and common security-related questions from enterprises, please see our Security Policies documentation. Moreover, Mattermost performs a penetration test on the software no less than once per twelve (12) month period. Customers may request a copy of any penetration test results upon five (5) days’ written notice at any time, but no more than once per twelve (12) month period. HIPAA compliance¶ Deploying Mattermost as part of a HIPAA-compliant IT infrastructure requires a deployment team trained on HIPAA-compliance requirements and standards. <ul> <li> Mattermost offers HIPAA-relevant Technical Safeguards including: <blockquote> <ul> <li> Integrity Controls </li> <li> Access Control </li> <li> Transmission Security </li> <li> Audit Controls </li> </ul> </blockquote> </li> <li> HIPAA-compliant deployments commonly consider the following: <blockquote> <ul> <li> Omitting the contents of messages from mobile push and email notifications: <blockquote> <ul> <li> If your Push Notifications Contents option is set to <code>Send full message snippet</code> there is a chance Personal Health Information (PHI) contained in messages could be displayed on a user’s locked phone as a notification. To avoid this, set the option to <code>Send generic description with user and channel names</code> or <code>Send generic description with only sender name</code>. </li> <li> Similarly, setting Email Notifications Contents to <code>Send generic description with only sender name</code> will only send the team name and name of the person who sent the message, with no information about channel name or message contents included in email notifications. </li> </ul> </blockquote> </li> </ul> </blockquote> </li> <li> Beyond Technical Safeguards, HIPAA compliance deployments also require: <blockquote> <ul> <li> Administrative Safeguards </li> <li> Physical Safeguards </li> <li> Organizational requirements and other standards. </li> </ul> </blockquote> </li> </ul> To learn more, please review HIPAA requirements from the US Department of Health and Human Services. FINRA compliance¶ Mattermost Enterprise Edition E20 is designed to meet the cybersecurity requirements of the United States Financial Industry Regulatory Authority (FINRA) as part of a customer’s existing operational systems, including technology governance, system change management, risk assessments, technical controls, incident response, vendor management, data loss prevention, and staff training. FINRA reviews a firm’s ability to protect the confidentiality, integrity, and availability of sensitive customer information. This includes reviewing each firm’s compliance with SEC regulations, including: <ul> <li> Regulation S-P (17 CFR §248.30), which requires firms to adopt written policies and procedures to protect customer information against cyber-attacks and other forms of unauthorized access. </li> <li> Regulation S-ID (17 CFR §248.201-202), which outlines a firm’s duties regarding the detection, prevention, and mitigation of identity theft. </li> <li> The Securities Exchange Act of 1934 (17 CFR §240.17a-4(f)), which requires firms to preserve electronically stored records in a non-rewriteable, non-erasable format. </li> </ul> Mattermost supports FINRA compliance as part of a customer’s integrated operations in the following ways: <ul> <li> Continuous archiving: Configuration as a non-rewriteable, non-erasable system of record for all messages and files entered into the system. Moreover, automated compliance exports and integration support for Smarsh/Actiance and Global Relay provide third-party eDiscovery options. </li> <li> Secure deployment: Deployment within private, public, and on-premesis networks with existing FINRA-compliant safeguards and infrastructure to protect customer information from cyber attack. </li> <li> Support for intrusion detection: Ability to support multi-layered intrusion detection from authentication systems to application servers to database access, including configuration of proxy, application, and database logging to deeply audit system interactions. </li> <li> Multi-layered disaster recovery: High Availability configuration, automated data back up, and enterprise information archiving integration to prevent data loss and recover from disaster. </li> </ul> Next Previous © Copyright 2015-2021 Mattermost. Built with Sphinx using a theme provided by Read the Docs.   Options&nbsp. <dl> <dt>Contribute</dt> <dd> Report a Problem </dd> <dd> Edit on GitHub </dd> </dl> <ul> <li>Developers</li> <li>Product</li> <li>Pricing</li> <li>Blog</li> <li>Download</li> <li>Trial</li> </ul> 🙂×How would you rate this page? 😀 Excellent 😐 Average 🙁 Poor

Mattermost

Security Overview

On 2021-04-06 13:48:42 UTC, Agnes_de_Lion (20760) Staff wrote:

On 2021-04-06 13:48:42 UTC, Agnes_de_Lion ^(20760) Staff wrote: