Cruip Logo

AFTA check

The full Irianalab (افتا) security-requirement list for a network/web or Windows-desktop product. Auto requirements are proven live against your target one at a time; manual requirements are the lab's source/log attestations.

Lab source documents
Deliverables the producer submits: Product guide · Product catalog / brochure · Security-requirements checklist (web + desktop) · Security-requirements checklist (CMS / portal) · Product identity sheet (one per VM) · Technical & delivery commitment checklist (25 items).
0
Passed
0
Attention
0
Inconclusive
32
Not run
29
Manual

32 automated requirements proven by 23 live checks (some checks cover several requirements) · 29 manual (lab attestation). Passed counts INFO/LOW as OK; MEDIUM+ needs attention; By policy means a tunable control you declared off/detect for this zone (intentional, not a gap); Inconclusive means the check could not be assessed (e.g. target unreachable) — it is not a pass.

Show
2.1 Security Audit (Logging)
ممیزی امنیت (لاگ)
manual
Generate audit records for the specified security events (~20 event types: auth attempts, security-attribute changes, admin actions, session events, failures…)
manual — lab source/log review or attestation
manual
Each audit record carries the required fields (date/time, subject, event, outcome…)
manual — lab source/log review or attestation
manual
Protect audit records against unauthorized access
manual — lab source/log review or attestation
manual
Select and sort audit records
manual — lab source/log review or attestation
manual
Prevent unauthorized deletion/modification of audit records
manual — lab source/log review or attestation
manual
Act when audit storage reaches the defined threshold
manual — lab source/log review or attestation
manual
Continue auditing on product/component failure
manual — lab source/log review or attestation
2.2 Cryptographic Support
رمزنگاری
manual
Provide a cryptography capability / crypto module
manual — lab source/log review or attestation
auto
Use approved algorithms and key lengths
Not run
orion: tls-audit
auto
Transport crypto hygiene: TLS versions, ciphers, cert chain
Not run
orion: tls-audit
auto
Keyless TLS signer: private key never on the edge; mTLS-required, no key-export surface, scoped cross-tenant denial
Not run
orion: keyless-sign
⚠ Two-layer verification, reported honestly. This auto-probe (orion keyless-sign) checks the signer's mTLS requirement, the absence of any key-export surface, and scoped cross-tenant denial; without an enrolled edge identity + an unassigned cert tuple it reports INCONCLUSIVE (never a pass), and the public scan target is not the internal signer, so here it will typically read 'Not run / inconclusive' — that is the truthful state, not a failure. The deeper replay / at-most-once / retention / cross-instance-rate-limit / revocation invariants are proven separately by the two-signer concurrency matrix (cert-probe/cmd/keyless-concurrency: 16/16 incl. a real crash, with reproducible JSON evidence). PRODUCTION customer-domain keyless activation is NOT yet enabled — it is gated on all 12 keyless-tls §4 acceptance gates plus operator approval — so treat production keyless as NOT-TESTED here.
2.3 Identification & Authentication
شناسایی و احراز هویت
manual
Limit the number of failed authentication attempts (lockout)
manual — lab source/log review or attestation
manual
Provide password-management capability (policy, change, complexity)
manual — lab source/log review or attestation
auto
Allow only minimal actions before a user is authenticated
Not run
orion: auth-bypass
auto
Support a real authentication mechanism (no bypass: alg:none, unverified signature, RS256→HS256, weak secret)
Not run
orion: auth-bypass
manual
Bind user security attributes at initial connection
manual — lab source/log review or attestation
manual
Act on changes to a user's security attributes
manual — lab source/log review or attestation
2.4 User Data Protection
حفاظت از داده کاربری
auto
Enforce access-control policies on objects and operations
Not run
orion: idor
auto
Enforce rules governing operations between active entities (no cross-tenant / cross-object read)
Not run
orion: idor
manual
Protect residual information in reused resources
manual — lab source/log review or attestation
manual
Apply the access-control policy when receiving user data
manual — lab source/log review or attestation
auto
Use a secure protocol to transfer data
Not run
orion: tls-audit
manual
Apply an export policy when data leaves the product
manual — lab source/log review or attestation
manual
Detect unauthorized change to stored sensitive data (integrity)
manual — lab source/log review or attestation
manual
Take action on a detected data-integrity error
manual — lab source/log review or attestation
auto
Do not trust client-set proxy/forwarding headers for access decisions
Not run
orion: header-audit
2.5 Security Management
مدیریت امنیت
auto
Only the admin / authorized users can change security attributes
Not run
orion: bfla
auto
Manage functions on product data under the access-control policy
Not run
orion: bfla
manual
Define multiple roles
manual — lab source/log review or attestation
manual
Assign users to defined roles
manual — lab source/log review or attestation
auto
No cross-origin credentialed read via reflected/weak CORS
Not run
orion: cors
2.6 Protection of Product Security Functions
حفاظت از توابع امنیتی محصول
manual
Behave safely on failure (fail-secure)
manual — lab source/log review or attestation
manual
Provide a secure platform/infrastructure
manual — lab source/log review or attestation
manual
Maintain a valid, reliable time/date source
manual — lab source/log review or attestation
manual
Support secure software/firmware update
manual — lab source/log review or attestation
auto
No known-vulnerable client-side libraries served
Not run
orion: vuln-libs
auto
No leaked manifests / source maps / .git/.env; SRI present
Not run
orion: supply-chain
auto
No unauthenticated management/debug endpoints exposed
Not run
orion: exposed-mgmt
auto
Response hardening headers present (CSP, X-Frame-Options, nosniff, HSTS…)
Not run
orion: security-headers
2.7 Resource Allocation
تخصیص منابع
manual
Enforce a maximum number of concurrent sessions
manual — lab source/log review or attestation
auto
Bounded resource use under load (no protocol-level exhaustion)
Not run
orion: h2-audit
2.8 Product Access
دسترسی به محصول
manual
Limit concurrent sessions per user
manual — lab source/log review or attestation
manual
Let the initiating user terminate their own session; idle-session lock
manual — lab source/log review or attestation
manual
Display last successful and failed access attempt
manual — lab source/log review or attestation
2.9 Trusted Channels / Paths
کانال‌ها/مسیرهای مورد اعتماد
auto
Use a trusted, encrypted channel for data transfer
Not run
orion: tls-audit
3 Transport (selection): HTTPS / TLS
پروتکل HTTPS و TLS
auto
HTTPS enforced (HTTP redirects/upgrades; no plaintext)
Not run
orion: tls-audit
auto
TLS server: strong versions & ciphers only
Not run
orion: tls-audit
manual
TLS client posture (where the product is a client)
manual — lab source/log review or attestation
manual
Mutual TLS where required
manual — lab source/log review or attestation
auto
Certificate validation (chain, expiry, hostname)
Not run
orion: tls-audit
EP Edge Protection (CDN)
حفاظت لبه (CDN)
auto
Edge actively blocks common web attacks (WAF: SQLi, XSS, path-traversal)
Not run
orion: waf-bypass
auto
Origin is not directly reachable (no CDN bypass) and the edge adds protection over it
Not run
orion: edge-diff
auto
Edge rejects HTTP request smuggling (ambiguous Content-Length / Transfer-Encoding framing)
Not run
orion: smuggle
auto
Edge shared cache cannot be poisoned (an unkeyed request header cannot alter a cached response served to others)
Not run
orion: cache-poison
auto
Edge does not serve a cache-deception entry (a personalized response dressed as a static asset is not shared-cached)
Not run
orion: cache-deception
auto
Edge normalizes obfuscated request paths (an encoded path cannot bypass the edge while the origin re-expands it)
Not run
orion: path-norm
auto
Edge/origin resist CL.0 request desync (a back-end that ignores the body, read as the next request on a pooled connection)
Not run
orion: cl0
auto
Edge enforces request-body limits and rejects a malformed structured body before the origin
Not run
orion: body-limits
⚠ Known bound: the WAF inspects a request body up to a bounded window (min of the zone's size cap and 1 MiB). A zone that self-raises its request-body cap above 1 MiB has the 1 MiB..cap region streamed to the origin UN-inspected (the size cap is still enforced). Bodies at or below 1 MiB are inspected in full.
auto
Edge WAF inspects the request body regardless of declared Content-Type (a payload blocked as JSON must not pass as text/plain)
Not run
orion: ct-confusion
auto
Edge inspects a request XML body for an XXE (external-entity DOCTYPE/ENTITY or XInclude) and blocks it before the origin
Not run
orion: xxe
auto
Edge inspects (or refuses) a compressed request body — a gzip-compressed payload cannot ride through the WAF uninspected
Not run
orion: compressed-body