We are often asked what security should be applied to the TMA web server. Infrastructure security isn’t something we usually get involved with, however our Professional Services department can help implement changes when required. That said, below are some notes which may help you.
Your TMA Web Server should be sited within a DMZ as per the EToN Technical Specification, therefore any server vulnerabilities should be outside of your main corporate firewall. The EToN Technical Specification describes what security can and can’t be implemented - See pages 116-122 of the EToN Technical Specification v5.01, or pages 137-142 of ETS v6.
In order to remain compliant with the legislation, you should thoroughly read this document before making any changes to your web server.
One particularly important section to note is below:
EToN requires basic security but not a comprehensive solution appropriate for some transactional web services. EToN is a closed system where all users are pre-determined and there are no intermediaries, and no need for partner applications to share user authentication, authorisation and access information. The aim is to provide adequate security consistent with the non-critical, non-confidential nature of EToN.
Receiving systems must therefore not block any incoming transaction that conforms to the requirements of this specification. Examples of techniques that should not be used include:
IP Address Recognition
Additional SOAP functionality (e.g. WS-Security) not defined in this specification and associated WSDL.
Firewalls and proxy servers should be configured to allow interoperable web services as specified above, i.e. allow unsolicited SOAP messages over HTTP / HTTPS. The method(s) of achieving this whilst protecting internal corporate systems and data is a matter for individual organisations.
Figure 7.2 shows an example of web service behind a demilitarized zone (DMZ). However, it is assumed that not all IT infrastructures will use a DMZ with servers outside of the firewall.
The Exor TMA web service software is integrated within Oracle and has its own secure method of contacting your database. One common change is to hide the Oracle Enterprise Manager and WebLogic console pages from the outside world. There are various ways you can do this and there are several articles on the internet which may help, however one simple solution would be to redirect all incoming web traffic from the outside world to the EToN end point using your firewall or proxy server software. As long as the EToN web service endpoint (notice URL) and associated WSDL file are still accessible to the outside world, you should be compliant. I.e. http://tma.organisation-name.gov.uk/EToN/EToNSoap12 and http://tma.organisation-name.gov.uk/EToN/EToNSoap12?WSDL
If you would like some assistance or further advice from our Professional Services department, then please contact your Bentley Account Manager.
ETS v6 - https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/181675/eton-6-technical-specification.pdf
ETS v501 - http://webarchive.nationalarchives.gov.uk/+/www.dft.gov.uk/pgr/roads/network/local/streetworks/cop/pdfelectronictransnotices.pdf