Bayanat v5.0 Security Update and Audit by 7ASecurity
SJAC’s Technology and Human Rights Team recently released version 5.0 of Bayanat, an open-source platform created by SJAC to preserve, structure, and analyze human rights documentation. Bayanat is used by human rights organizations around the world, including the Syrian National Commission on Transitional Justice, to preserve highly sensitive documentation of violations, witness testimonies, information about perpetrators, and case files that support prosecution and advocacy efforts.
Bayanat Version 5.0 includes multiple upgrades recommended by the cybersecurity team at 7ASecurity, whose six senior auditors spent 32 days conducting an independent penetration test of Bayanat's system to search for security vulnerabilities. As part of this test, SJAC gave 7ASecurity access to Bayanat's source code and documentation, along with a test environment and test user accounts. This approach, known as a "whitebox" review, allowed the auditors to directly examine and test Bayanat’s internal systems.
The security team reviewed Bayanat’s web application and application programming interface (API) as well as the system for managing logins and user permissions. The team also reviewed the process for importing and processing evidence, how Bayanat is installed and configured, and how new releases are built and published. They also stress-tested the code that reads incoming files by seeing if it would flag malformed data. They then reviewed and updated Bayanat's threat model which assesses who might target Bayanat and what processes they would use to access the system.
7ASecurity’s audit documented 22 direct security issues and provided 21 recommendations to further harden Bayanat’s systems, all of which have been addressed in the Version 5.0 update. 7ASecurity then retested Bayanat and confirmed that all 43 items were resolved.
Version 5.0 also makes updating and running Bayanat safer and easier. New releases will now be signed so organizations can verify that updates were issued by SJAC. Updates can now be done with a single command, and a snapshot and automatic rollback feature allows users to reset back to an earlier version in the event of a failed update. Bayanat's deployment now defaults to the principle of least privilege, meaning each part of the system has only the minimum access it needs to function.
7ASecurity also noted several strengths in Bayanat. The auditors found no SQL injection or remote code execution vulnerabilities, two serious types of flaws that can let an attacker read, alter, or take control of a server. They also highlighted multiple beneficial features of Bayanat including its role and group access controls, its approval workflows, revision tracking and peer review, and its operator-friendly installer and documentation.
Links to Learn more:
SJAC’s full technical analysis of the security audit
Learn more about Bayanat and update to the latest tagged release.
___________________________
For more information or to provide feedback, please contact SJAC at [email protected] and follow us on Facebook and Twitter. Subscribe to SJAC’s newsletter for updates on our work