Weak admin passwords: the most common reason for corporate portal breaches
A weak admin password is the most common cause of corporate portal breaches on 1C-Bitrix. According to Wikipedia, 81% of breaches involve compromised credentials – confirmed by password attack data. Over a decade of work, we've handled dozens of such cases, and the root cause is always lax default settings. Our experience allows us to prevent problems during the audit stage. We configure security policies to protect your portal from real threats: brute force, phishing, session theft. One project – a large retailer with 300+ users – lost admin control due to a 6-character password. After our configuration, brute force attacks stopped, and incident recovery costs dropped threefold.
How to configure password policies for admins
Password policies are set under Settings → Password Policies. Each policy is bound to user groups. For admins and managers, create a separate policy with the strictest requirements. Recommended values:
| Parameter | Recommendation for employees | Recommendation for admins |
|---|---|---|
| Minimum length | 10 characters | 12 characters |
| Required characters | lowercase, uppercase, digits, special | lowercase, uppercase, digits, special |
| Password expiration | 180 days | 90 days |
| Password history | 5 | 10 |
| Number of attempts | 5 | 3 |
After 5 failed attempts (3 for admins), the account is blocked. Unblocking is only possible through an administrator. This reduces brute force risk by an order of magnitude – roughly 90%.
To configure, follow these steps:
- Go to
Settings → Password Policies. - Create a new policy or edit an existing one.
- Apply it to the "Administrators" and "Managers" groups.
- Set parameters from the table above.
- Save changes and test with a test user.
Why is IP session binding important?
Session and authorization settings are in Settings → Main Module → Security. Admin section session lifetime should not exceed 60 minutes. It's best to disable "Remember me" or reduce it to 7 days. Long-lived cookies are a common attack vector when a device is stolen.
Enable session IP binding via BX_SECURITY_SESSION_VIRTUAL_DIRECTORY. Note: mobile users' IP may change, so you can create a separate policy with less strict requirements for them.
What does a security audit include?
The audit covers file integrity checks, configuration analysis, and penetration testing. The "Proactive Protection" module (Security → Proactive Protection) automatically scans the system for malicious code and vulnerabilities. We also check module and core versions – outdated components often contain known CVEs. Additionally, we analyze mail and integration settings to prevent leaks. In one project, we discovered 12 outdated modules with critical vulnerabilities – after updates, risks dropped by 70%.
Protecting the admin section
Limit access to /bitrix/admin/ by IP. Example for nginx:
location /bitrix/admin/ { allow 192.168.1.0/24; allow 203.0.113.10; deny all; } Additionally, change the admin section URL via the "Proactive Protection" module (Security → Proactive Protection → Admin Section Protection). This adds a secret prefix to the path, making brute-forcing harder. Combining IP filtering and URL change reduces daily attacks from hundreds to single digits.
How does two-factor authentication improve security?
Two-factor authentication (2FA) is a mandatory security layer for admins. In Bitrix, it's configured under Settings → Security → Two-Factor Authentication. We recommend enforcing it for all users with admin section access. This neutralizes the threat of password leaks. According to our data, implementing 2FA prevents 99% of attacks using compromised credentials.
Case study
A corporate portal on Bitrix24 Box. A manager left an open session on a work computer and went on vacation. A colleague gained access to their account. Solution: configure a policy limiting idle session timeout to 2 hours and enforcing logout on browser close (session.cookie_lifetime = 0). After this, similar incidents stopped.
What's included in the work
- Audit of current security policies
- Configuration of password policies for all user groups
- Session and authorization settings
- Enabling and configuring proactive protection
- Two-factor authentication setup (optional)
- Training session for administrators
- Documentation of the current configuration
- 30 days of support after configuration
Timelines and cost
Audit and basic policy setup take 3–5 hours. Full cycle with two-factor authentication – from 8 hours. Cost is calculated individually based on complexity. Contact us to evaluate your project. We guarantee our configuration and assist with implementation. Order a security audit – it's the first step to protecting your data. Get portal protection that halves risks compared to default Bitrix settings. Over 10 years of experience and 50+ successful projects prove: security is not an option, it's a necessity. Contact us for a consultation.