Documentation

For locales using this language...	use this CountryCode	and this LanguageCode
Spanish	ES	ES
French	FR	FR
English	GB	EN

For locales using this language...	use this CountryCode	and this LanguageCode
Spanish	ES	ES
French	FR	FR
English	GB	EN

MFI	country	clients served	current accounting system
Grameen Koota	India	450,000	Tally
enda	Tunisia	130,000	Sigma
Jitegemea	Kenya	6,700	Pastel
KEEF	Kenya	13,500	Pastel
ASOMI	India	33,000	Tally
Adhikar	India	100,000	Tally
SECDEP	Philippines	8,000	Microsoft Excel
Al Majmoua	Lebanon	16,000	Dolphin
Digamber Finance	India	2,500	Tally

Property	Description
Next Start	Lists when the next start time is for the scheduled task
Previous Start	Previous Start time for the scheduled task
Most recent successful run	Last successful Start time for the scheduled task (displayed only when the previous scheduled task run failed)
Task Type	CronTrigger or SimpleTrigger
Task Priority	Order in all batch jobs of which it is run. If it is all the same, then it is just run in the order listed in the table. Lower number takes higher priority and will be run first
Previous run status	Completed or Failed (also a detailed failure reason can be displayed here, if available)
Cron expression	(only for CronTrigger) Expression which determines when batch job should be started (Please read Cron Trigger Tutorial for a more detailed documentation)
Repeat interval	(only for SimpleTrigger) Number of milliseconds between successive batch job runs

1 Introduction
2 Scope
3 Scenarios
- 3.1 Typical usage scenario
  - 3.1.1 Example deployment scenario
4 Threats
- 4.1 Attacker's Goals
- 4.2 Prioritized Threat Tables
5 Open Questions
6 Glossary
7 References and tools

1 Introduction

This document is an outline of the attacker's goals and capabilities that we need to consider for Mifos security. The threats in this document can be used to develop the Mifos security recommendations document.

2 Scope

Threats to the following components of a typical Mifos deployment are considered:

User (Loan Officer),
Network,
Web Server,
Database.

The following threats are considered out of the scope of this document:

Attacks involving physical access to a system hosting the Mifos software.
Attacks on an underlying system hosting Mifos such as attacks on a virtual machine running a Mifos instance.
Attacks on other systems using a Mifos database as a resource to build victims profiles.

Note0: A stretch goal could be to make it hard to attackers to use the data in the database.

Note1: Informative notes on the physical security of the system can be inserted.

Note2: There's not much we can do to prevent attacks on other systems by using the data on a Mifos database beyond telling people not to use the same username/password on Mifos that they have on other systems.

3 Scenarios

3.1 Typical usage scenario

The following steps outline in chronological order a new user (a Loan Officer) being added to the system and using it. These were extracted from the Mifos user manual.

A new loan officer (LO) is assigned to a particular center (sub division of a branch).
An account is created at the Head Office, and login credentials are sent to the LO via email.
(Optionally) Assigns a 'custom' role with permissions to perform certain other actions.
The new LO logs in for the first time (and is required to change the first-use password before proceeding any further)

There is no additional setup steps and the Loan Officer can proceed to immediately add clients. The Loan Officer does the following:

Create an account for a client
Create or select a group (up to 30 people) for the new client
Enters information about the new client
Issues loans, which begins to track immediately
Disburses the actual monetary loan

The typical administration setup scenario for new Loan Officer are as follows:

Admin->new system user
Assign the Loan Officer to a center

See chapter 3 of users guide for more details (comment: the user guide is outdated...)

3.1.1 Example deployment scenario

Physical outline: Two colocated machines

One Web/Application server (Linux or Windows)
One Database server (Linux or Windows)

Network access:

The web/application server allows incoming connections from the outside world on the following ports

RDP (Windows) or SSH (Linux)
HTTP
HTTPS

The database server allows incoming connections from the outside world on the following ports:

RDP (Windows) or SSH (Linux)

Additionally, the firewall allows incoming connections from the web/application server to the database server on the following ports:

MySQL (3306)

Depending on the environment and OS used, additional ports may be opened between the web/application server in the DMZ and a server in the secure subnet such as DNS, NTP, etc.

The web/application server and the database server are on different subnets, typically with the web/application server in the DMZ and the database server in a secure subnet, behind a firewall allowing the connections above.

Note3: Mifos is not connected to any financial systems, it is only used to track transactions that were made in the real world. Thus, the attacker's incentive is now based on identity theft, competitive advantage and denial of service. A successful attacker would have enough information to deplete a client's bank account.

Note4: Recommend a method to minimize the threat of initial login credential compromise. E.g., if the initial credentials have to be sent via email, make Mifos automatically create a password that is intentionally hard to remember, thus giving the user an incentive to change the password. Recommend good password policy

Note4.5: ssh must use private/public key pairs. Password authentication and root log on must be disabled.

Note5: For additional scenarios, see the Mifos user manual.

4 Threats

[TODO This section needs some clean up]?

What property do we want to ensure, against what adversary?

Transactions about loans, savings
Personal identification of clients (borrowers)
Data privacy for personal data and financial transaction trails for customers
Proprietary and competitive information
loan/savings totals
repayment rates

Attackers

Who is the adversary?

internal user (attempting fraud)
recently fired loan officer (DoS)
identity thieves (client's information)
competitor businesses (loan information)

4.1 Attacker's Goals

impersonation of clients (drain account, money laundering, payment of illegal activities)
Malicious defacement or other damage to reputation
Information leading to competitive advantages
Identity theft
Denial of Service

4.1.1 Attacks against a client

Obtain an individual's loan information
Obtain an individual's bank account information
Obtain an individual's personal identity information

4.1.2 Attacks against a loan officer

Obtain multiple clients loan information
Obtain multiple clients bank account information
Obtain multiple clients personal identity information

4.1.3 Attacks against a system

Retrieve information existing accounts (See client and loan officer attacks above) to gain competitive advantage
Deny service

4.2 Prioritized Threat Tables

4.2.1 User (Loan Officer) Based Threats

User Centric Threats
Code	Priority	Threat	Mitigation
1-1	1	Compromised Loan Officer login credentials (either by the LO or during transit from Head office)	force password change upon first login. (see Mifos user manual chapter 1.3)
1-2	3	Compromised client bank account information (depends on 1-1)
1-3	2	Compromised client identity information (SSN; gov ID; address; phone; email) (depends on 1-1)
1-4	4	Compromised client loan information (subset of 1-2?)
1-5	8	Inaccessible system due to malicious activities
1-6	5	Scavenging of old data (leads to thread 1-1; 1-2 and 1-3)	Secure deletion of old storage hardware (best practices)
1-7	7	Activity analysis
1-8	6	Loss of equipment containing private information. (e.g. laptop stolen with password saved in browser)	good password policies. (e.g. first letter in random phrase. Don't save password in browser.)
1-9	N/A	Loss of equipment containing private information. (e.g. laptop stolen with password saved in browser)	Same as 1-8

4.2.2 Database and Application Centric Threats

Database and Application Centric Threats
Code	Priority	Threat	Mitigation
2-1	1	compromise of backup user	Perform backups from a secure box using only secured communication channels.
2-2	2	Compromise of backup user's private key
2-3	3	SQL injection	Sanitize inputs
2-4	4	Access to execute arbitrary code (from limited account and root)	Ensure system is fully patched (good patching policies). Open only ports that are absolutely necessary and time limiting them as needed.
2-5	5	Access to read data. (remote) Any malicious user with access inside the firewall and credentials to the database. (local) Theft of physical hardware hosting the database.
2-6	6	Access to write (tamper) data. (Same as 2-5)
2-7	7	Access to destroy data (subset of 2-6)	regular offline backups
2-8	8	Compromise of data flowing between the web server and the database. Requires that the attacker has access to at least the DMZ network	protect data between web server and db. TLS tunnel?
2-9	9	Compromise of backup data
2-10	10	Configuration error	best practices document

4.2.3 Web Server Centric Threats

Web Server Centric Threats
Code	Priority	Threat	Mitigation
3-1	1	Access to replace valid software with malicious one
3-2		(subset of 3-1) Access to execute resident code (from limited account and root)
3-3		(repeat of 3-2) Access to execute arbitrary code (from limited account and root)
3-4	2	compromised Operating System	good patching policy.
3-5	3	Access to read data (secret configuration; e.g. SQL creds)
3-6		(same as 3-6) compromise of Mifos software	Good backup policy
3-7	4	Exploitation of side vectors to get to Mifos data. In a central hosted cloud Mifos would probably run in a virtual machine. A malicious process with access to another virtual machine on the same physical machine could do some damage depending on strong the checks on the hypervisor are. Another side vector is Tomcat. A vulnerability in that software could lead to a compromise of Mifos data to no fault of Mifos.	Secure policy on virtualized components. Strip down all unnecessary software (recommend baseline like PCS) semi-automatic software update mechanism. (Tough. Need to avoid loss of service due to patching on very heterogeneous networks.)
3-8	5	Software error (bug)
3-9	6	Configuration error. (Leaving default tomcat page...etc)
3-10	7	Unauthorized remote access to server. Typically through compromised credentials of maintenance and support staff.	web server account set to a limited one with privs only to complete tasks needed.
3-11		(repeat of 3-10) Compromise of administrative credential (e.g. administrator; software update; remote administrator)
3-12	8	Scavenging of old server (physical machine)
3-13	9	Physical theft of server or parts thereof.
3-14	10	Loss or compromise of Logs	remote storage of critical logging information. Note: sanitize log info. print user ID and not what the user typed.

4.2.4 Network Centric Threats

Network Centric Threats
Code	Priority	Threat	Mitigation
4-1	1	Eavesdropping of information	use TLS
4-2		(subset of 4-1) Modification (tampering) of information
4-3		(subset of 4-1) Replay of information
4-4	2	Man in the Middle during legitimate communication	appropriate warning messages. CAcert? and don't ignore warning. Bullet proof docs for installation and maintenance of certs to minimize (or eliminate warning messages)
4-5	4	compromise of credentials for remote maintenance
4-6	8	Corruption of time information to falsify timestamps	Authenticated NTP with NIST. http://tf.nist.gov/service/auth_ntp.htm
4-7	9	Exploitation of side vectors (other running programs) to get to Mifos data.	Firewall with only port 80 (if necessary) and 443 open. Put Web server in DMZ.
4-8	10	Denial of service
4-9		(subset of 4-8) Flooding of requests [TODO define requests]?
4-10		(subset of 3-8) Vector for remote exploitation. (Software bug)

5 Open Questions

Is there enough information in Mifos for an attacker to deplete a client's bank account?
What is a typical deployment scenario?
What is a typical use case?
Can we divide deployment into security categories (low, medium, high) to customize security requirements?
RDP ports open to the outside world? VPN then RDP? logs?
What is the motivation of an attacker

6 Glossary

Activity analysis: The fact that a pipe (even secured) was established leaks information. Moreover, the frequency and timing of packets sent over that pipe leaks information as well.
Man in the Middle (MIM, MITM): An attacker sitting between the client and the server, pretending to be the client to the server and pretending to be the server to the client while being able to see and tamper with any information between the legitimate client and server.

7 References and tools

Ross Anderson "Security Engineering" Chapter 1, 22
Nick Hopper, "CSci5271, Introduction to Computer Security" lecture 1, University of Minnesota, http://www-users.itlabs.umn.edu/classes/Fall-2008/csci5271/index.php?page=schedule
Authenticated NTP, U.S. NIST, http://tf.nist.gov/service/auth_ntp.htm
Granting privileges on MySQL, http://dev.mysql.com/doc/refman/5.1/en/grant.html)
Firewall builder firewall rule manager, www.fwbuilder.org
CAcert, Certificate Authority, www.cacert.org
TrueCrypt, Hard drive encryption, www.truecrypt.org
fwanalog, Firewall Log analyser, http://tud.at/programm/fwanalog - "a wee bit dated now"
BASE, IDS log monitor http://base.secureideas.net
SNORT, IDS log, snort, www.snort.org
awstats, web log monitor, http://awstats.sourceforge.net
Mifos user manual: http://www.mifos.org/knowledge/user-manual

Data	Description	Dependencies
Mifos Config Information	Includes database settings, properties files, localization settings, definition of office hierarchy, additional fields, look up options etc	None
Office & Related Information	Includes details of the head office and the various branches	Config Info
Personnel& Related Information	Includes details of all the users of the system	Config & Office Info
Customer & Related Information	Includes the details of the customers of the MFI	Config,Office & Personnel Info

No.	Fees Related actions from Admin Screen	Notes
1	Define a new fee	Mifos Tables Hit are : FEES, FEE_FREQUENCY

No.	Product Related actions from Admin screen	Notes
1	Define Product Categories	If necessary
2	Define new Loan/Savings Product
3	Define Product Mix

No.	Office & Personnel Related actions from Admin screen	Notes
1	Define a New office	Office Details
2	Define Office Hierarchy
3	Define new System User	Personnel Details
4	Manage Roles and Permissions

No.	Defining Additional Data from Admin screen	Notes
1	Define Additional Fields	The extra information (data fields) in the MFI Legacy system that need to be captured in Mifos are defined here
2	Define Look up Options	The drop down values for certain data fields are defined here
3	Define Labels	Any existing Labels on the UI of the application are changed here
4	Define Mandatory Fields	Fields are tagged as Mandatory or Hidden here

No.	DB Configuration	Notes
1	Localization Settings : Language	http://www.mifos.org/developers/wiki/ConfiguringMifos#application-wide-i... applicationConfiguration.custom.properties
2	Application Settings	Enable features that are required in this DB table: config_key_value_integer
3	View Organization Settings Link from the Admin Screen	applicationConfiguration.default.properties
4	Custom properties	applicationConfiguration.custom.properties
5	Office Hierarchy of the MFI	Part of the DB Settings & properties files settings. It can also be set using Admin Tab--> Define Office Hierarchy
6	Holiday Configuration	Admin Screen --> Define new holidays. Define repayment rules for each holiday. Repayment rules are not loan specific in Mifos,
7	GL Codes	GL Codes can only be added, the codes shipped with Mifos cannot be modified. For more details refer to - http://mifos.org/developers/wiki/ConfiguringMifos#using-a-custom-chart-of-accounts

No.	UI Action	Tables Affected - Inserts and Updates	Notes
1	Create a Customer	insert into CUSTOMER	Data from UI One Entry per Customer
		insert into CUSTOMER_DETAIL	Data from UI One Entry per Customer
		insert into CUSTOMER_ADDRESS_DETAIL	Address Data from UI One Entry per Customer
		insert into CUSTOMER_NAME_DETAIL	Client's & Dependant's Name Detail from UI Two Entries per Customer (for the Client and Spouse/Father)
		Insert into CUSTOMER_CUSTOM_FIELD	Additional Data from the source as defined will be stored here Entries per Customer is dependent on the number of additional fields defined
		insert into ACCOUNT	A customer account is created Can have more than one entry per Customer
		insert into CUSTOMER_ACCOUNT	Contains list of Customer accounts created
		insert into CUSTOMER_MEETING	Based on the meeting schedule of the group/center which he is a part of or for a client who is not part any group/center a separate customer meeting is created One Entry per Customer
		insert into CUSTOMER_SCHEDULE	Based on the meeting schedule of the group & the MFI Holiday schedule , a repayment schedule for 10 installments in created when a client is created
		insert into CLIENT_PERF_HISTORY or GROUP_PERF_HISTORY	Mifos inserts 2 metrics namely total active loans & last loan amt. The other Metrics are calculated on the fly in the Mifos code, there are no inserts made to the DB One Entry per Customer

2	Edit Customer Status	insert into CUSTOMER_NOTE	Note captured from UI Can have more than one entry per Customer
		insert into CUSTOMER_FLAG_DETAIL	The reason for closing a customer is captured One entry per Customer
		insert into CHANGE_LOG	An entry is made when any existing information is updated One Entry per Submit Action
		insert into CHANGE_LOG_DETAIL	Details of the actual fields updated is captured here More than one entry per Submit action.Number of entries depends on the number of fields changed
		update CUSTOMER	Update the details that were changed

3	Move a Customer from One Group/Center to another	insert into CUSTOMER_HIERARCHY	An Entry is made to track Customer movement between groups/centers within the same office or between offices. Can have more than one entry per hierarchy per customer. Only one active hierarchy exists for a customer at any point of time
		insert into CUSTOMER_MOVEMENT	An Entry is made to track Customer movement between offices Can have more than one entry per customer per movement Only one active movement exists for a customer at any point of time
		update CUSTOMER	Update the details that were changed

4	Edit MFI information	insert into CHANGE_LOG	An entry is made when any existing information is updated One Entry per Submit Action
		insert into CHANGE_LOG_DETAIL	Details of the actual fields updated is captured here More than one entry per Submit action.Number of entries depends on the number of fields changed
		Update CUSTOMER	Update the details that were changed

5	Edit personal information	insert into CHANGE_LOG	An entry is made when any existing information is updated One Entry per Submit Action
		insert into CHANGE_LOG_DETAIL	Details of the actual fields updated is captured here More than one entry per Submit action.Number of entries depends on the number of fields changed
		update CUSTOMER	Update the details that were changed
		update CUSTOMER_DETAIL	Update the details that were changed
		update CUSTOMER_NAME_DETAIL	Update the details that were changed

No.	UI Action	Tables Affected - Inserts and Updates	Notes
1	Create a Loan	insert into MEETING	inserts a new record for loan account but the details are the same as
		insert into RECURRENCE_DETAIL
		insert into RECUR_ON_DAY
		insert into ACCOUNT
		insert into LOAN_ACCOUNT	Data From UI
		insert into ACCOUNT_FEES	Fees that are applied at the time of loan creation
		insert into ACCOUNT_STATUS_CHANGE_HISTORY
		insert into LOAN_SUMMARY
		insert into LOAN_PERF_HISTORY
		insert into MAX_MIN_LOAN_AMOUNT
		insert into MAX_MIN_NO_OF_INSTALL
		insert into LOAN_SCHEDULE	One Entry per installment
		insert into LOAN_FEE_SCHEDULE	One Entry per installment

2	Edit Account status	insert into ACCOUNT_NOTES	Stores the notes entered in the UI while changing account state
		insert into ACCOUNT_STATUS_CHANGE_HISTORY
		update ACCOUNT
		insert into CHANGE_LOG
		insert into CHANGE_LOG_DETAIL	Number of entries depend on the number of fields changed

3	Edit Account Information	update ACCOUNT
		update LOAN_ACCOUNT
		update LOAN_SUMMARY

Documentation

Installation

Windows Installation Guide

Software Requirements

Set up Folder and Download Mifos

Download Mifos

Install and Configure Java and Apache Tomcat

Apache Tomcat

Install and Configure MySQL

Configure MySQL

Create Mifos Database and Mifos User

Initiate MySQL

Update local.properties file if you changed mysql password for user id mifos.

Set up Environment Variables

Install Mifos WAR

The Mifos WAR file is basically a collection of pages and files that comprise the MIfos web application (you can view Wikipedia's definition of a WAR file to learn more). The Mifos WAR is located in the download package you saved to Mifos Install.

Configure Mifos

Run Mifos

Ubuntu Installation Guide

Using War Files

Configuration

Mifos Configuration

MPESA Max Disbursal Limit

Batch Jobs

Mifos Configuration Locations

Upgrades

Upgrading Mifos

Preparation Before Upgrade

Verification and Validation in Test Environment

Deploy in Production

Document and Monitor Upgrade

Version-specific Upgrade Instructions

Accounting Integration

Community Proof of Concepts

Mifos Peachtree Accounting Integration Proof of Concept

Sample Accounting POC

Crosstalk

CrossTalk is a GUI tool that assists accounting integration with Mifos by exporting data in the format your accounting package will be happy with.

Customer Accounting Systems

Notes on Accounting/Cash Management for Current Customers

Enda - Tunisia

KMBI - Philippines

PAWDEP - Kenya

Tally in India

Grameen Koota

Cash Management Process

Most Important Cash Management Needs

Deployment Guide

Reporting

Built-in Standard Reports

Built-in Mifos Report Templates

Customizing Built-in Reports

Overview of the Standard Reports

Detailed Aging Portfolio at Risk Report

General Ledger Report

Building your own Reports

Building Reports in BIRT

Understanding Mifos Data Model

Mifos Data Schema

SQL Query Repository