Change in ICES Web Services (API)

ices-eg / wg_WGACOUSTICGOV

Working Group on Acoustic Trawl Data Portal Governance

http://ices.dk/community/groups/Pages/WGacousticgov.aspx

5 stars 1 forks source link

Change in ICES Web Services (API) #64

Closed HjalteParner closed 2 months ago

HjalteParner commented 2 months ago

A review of our website and services following the cyber attack in June 2024 has highlighted that there are some web service calls that allow a user to upload a file (for validation or inclusion in a database) without full authentication. This is a potential vulnerability when coupled with other techniques that cyber threat actors use.

All services (API’s) that have call actions that allow upload of data/files will therefore be changed to full authentication.

HjalteParner commented 2 months ago

Done!

Authentication is now required on validation and/or upload of file through the acoustic data portal. Previous autentication was only necessary on upload.