# Commission Implementing Regulation (EU) No 1179/2011 of 17 November 2011 laying down technical specifications for online collection systems pursuant to Regulation (EU) No 211/2011 of the European Parliament and of the Council on the citizens’ initiative, Division 2.7

Extent: E+W+S+N.I.

The system is suitably protected against known vulnerabilities and exploits. For this purpose it satisfies, inter alia, the following requirements:
2.7.1. The system guards against injection flaws such as structured query language (SQL) queries, lightweight directory access protocol (LDAP) queries, XML path language (XPath) queries, operating system (OS) commands or program arguments. For this purpose, it requires at least that:
(a) all user input is validated;
(b) validation is performed at least by the server-side logic;
(c) all use of interpreters clearly separates untrusted data from the command or query. For SQL calls, this means using bind variables in all prepared statements and stored procedures, and avoiding dynamic queries.
2.7.2. The system guards against cross-site scripting (XSS). For this purpose, it requires at least that:
(a) all user supplied input sent back to the browser is verified to be safe (via input validation);
(b) all user input is properly escaped before it is included in the output page;
(c) proper output encoding ensures that such input is always treated as text in the browser. No active content is used.
2.7.3. The system has strong authentication and session management, which requires at least that:
(a) credentials are always protected when stored using hashing or encryption. The risk that someone authenticates using ‘pass-the-hash’ is mitigated;
(b) credentials cannot be guessed or overwritten through weak account management functions (e.g. account creation, change password, recover password, weak session identifiers (IDs));
(c) session IDs and session data are not exposed in the uniform resource locator (URL);
(d) session IDs are not vulnerable to session fixation attacks;
(e) session IDs timeout, which ensures that users log out;
(f) session IDs are not rotated after successful login;
(g) passwords, session IDs, and other credentials are sent only over transport layer security (TLS);
(h) the administration part of the system is protected. If it is protected by single-factor authentication, then the password is composed of a minimum of 10 characters, including at least one letter, one number and one special character. Alternatively two-factor authentication may be used. Where only single-factor authentication is used, it includes a two-step verification mechanism for accessing the administration part of the system via the Internet, in which the single factor is augmented by another means of authentication, such as a one-time pass-phrase/code via SMS or an asymmetrically encrypted random challenge string to be decrypted using the organisers’/administrators’ private key unknown to the system.
2.7.4. The system does not have insecure direct object references. For this purpose, it requires at least that:
(a) for direct references to restricted resources, the application verifies that the user is authorised to access the exact resource requested;
(b) if the reference is an indirect reference, the mapping to the direct reference is limited to values authorised for the current user.
2.7.5. The system guards against cross-site request forgery flaw.
2.7.6. Proper security configuration is in place, which requires, at least, that:
(a) all software components are up to date, including the OS, web/application server, database management system (DBMS), applications, and all code libraries;
(b) OS and web/application server unnecessary services are disabled, removed, or not installed;
(c) default account passwords are changed or disabled;
(d) error handling is set up to prevent stack traces and other overly informative error messages from leaking;
(e) security settings in the development frameworks and libraries are configured in accordance with best practices, such as the guidelines of OWASP.
2.7.7. The system provides for encryption of data as follows:
(a) personal data in electronic format is encrypted when stored or transferred to the competent authorities of the Member States in accordance with Article 8(1) of Regulation (EU) No 211/2011, the keys being managed and backed up separately;
(b) strong standard algorithms and strong keys are used in line with international standards. Key management is in place;
(c) passwords are hashed with a strong standard algorithm and an appropriate ‘salt’ is used;
(d) all keys and passwords are protected from unauthorised access.
2.7.8. The system restricts URL access based on the user access levels and permissions. For this purpose, it requires at least that:
(a) if external security mechanisms are used to provide authentication and authorisation checks for page access, they need to be properly configured for every page;
(b) if code level protection is used, code level protection needs to be in place for every required page.
2.7.9. The system uses sufficient transport layer protection. For this purpose, all of the following measures or measures of at least equal strength are in place:
(a) the system requires the most current version of the hypertext transfer protocol secure (HTTPS) to access any sensitive resource using certificates that are valid, not expired, not revoked, and match all domains used by the site;
(b) the system sets the ‘secure’ flag on all sensitive cookies;
(c) the server configures the TLS provider to only support encryption algorithms in line with best practices. The users are informed that they must enable TLS support in their browser.
2.7.10. The system guards against invalidated redirects and forwards.

---
Source: https://www.legislation.gov.uk/eur/2011/1179/annex/division/2/division/3/division/2.7 (the official version)
Page: https://openlegislation.uk/eu-regulation-2011-1179/annex/division-2/division-3/division-2.7
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.