How to Ensure Compliance with Data Protection Laws
How to Ensure Compliance with Data Protection Laws
This article details the server-side configuration necessary to help ensure compliance with various data protection laws, such as GDPR, CCPA, and others. It's geared towards MediaWiki administrators and server engineers. Proper server configuration is a *critical* component of any data protection strategy, complementing Special:MyPreferences user settings and Manual:Configuration settings overall wiki settings.
Understanding the Requirements
Data protection laws generally require organizations to:
- Protect personal data from unauthorized access, use, disclosure, alteration, or destruction.
- Provide individuals with the right to access, rectify, erase, and restrict the processing of their personal data.
- Obtain consent for the collection and use of personal data.
- Implement appropriate technical and organizational measures to ensure data security.
- Notify individuals and authorities of data breaches.
- **Firewall Configuration:** Implement a robust firewall.
- **Regular Security Updates:** Keep the operating system and all installed software (including PHP, MySQL/MariaDB, and Apache/Nginx) up-to-date. Automated updates are highly recommended. Refer to Help:Upgrading MediaWiki.
- **Access Control:** Restrict access to the server to only authorized personnel. Use strong passwords and multi-factor authentication. Consider Manual:Command-line access limitations.
- **Intrusion Detection/Prevention Systems:** Implement systems to detect and prevent unauthorized access attempts.
- **Data Encryption:** Encrypt data at rest (on disk) and in transit (over the network). See section below on encryption.
- **Database Encryption:** Enable database encryption at rest. Most modern database systems (MySQL/MariaDB, PostgreSQL) support this.
- **Access Control:** Restrict database access to only the MediaWiki application and authorized administrators.
- **Regular Backups:** Implement regular database backups, stored securely and separately from the production server. Test restoration procedures regularly. See Manual:Backups
- **Data Masking/Pseudonymization:** Consider masking or pseudonymizing sensitive data fields where possible.
- **TLS/SSL:** Always enforce HTTPS (TLS/SSL) for all MediaWiki traffic. This encrypts data in transit between the user's browser and the server. Configure your web server (Apache or Nginx) to redirect all HTTP traffic to HTTPS. See Manual:HTTPS.
- **Certificate Management:** Use a valid TLS/SSL certificate from a trusted Certificate Authority (CA). Automate certificate renewal.
- **Cipher Suite Configuration:** Configure your web server to use strong cipher suites. Avoid weak or outdated ciphers.
- **Data at Rest Encryption:** Consider encrypting sensitive data stored on the server's file system. This adds an extra layer of protection in case of a physical security breach.
- **Web Server Logs:** Configure your web server to log all requests, including the user's IP address, requested URL, and HTTP status code.
- **Application Logs:** Enable detailed logging within MediaWiki itself. This can help track user activity and identify potential security breaches. Configure in Manual:Configuration settings under `$wgDebugLogFile`.
- **Database Audit Logs:** Enable database audit logging to track changes to the database.
- **Log Monitoring and Analysis:** Regularly monitor and analyze logs for suspicious activity. Consider using a Security Information and Event Management (SIEM) system.
- **Data Export:** Ensure you can export all data associated with a user account. This may require custom scripts or extensions.
- **Data Deletion:** Implement a process for securely deleting user data when requested. This includes removing data from the database, logs, and backups.
- **Data Rectification:** Allow users to correct inaccurate information in their accounts.
- Manual:Configuration settings
- Manual:HTTPS
- Manual:Backups
- Help:Data privacy
- Special:MyPreferences
- Manual:Command-line access
- Help:Upgrading MediaWiki
- [GDPR Official Website](https://gdpr-info.eu/)
- [CCPA Official Website](https://oag.ca.gov/privacy/ccpa)
- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [OWASP Top Ten](https://owasp.org/www-project-top-ten/)
- [SANS Institute](https://www.sans.org/)
- [Database Encryption Documentation (MySQL)](https://dev.mysql.com/doc/refman/8.0/en/encryption-overview.html)
- [Apache Security Tips](https://httpd.apache.org/docs/2.4/security/)
- Telegram: @powervps Servers at a discounted price
These requirements translate into specific server-side configuration considerations. A core principle is *data minimization* – only collect and store data that is absolutely necessary. Review Help:Data privacy for general guidance.
Server Security Hardening
A secure server is the first line of defense. These steps help minimize risk:
| Security Measure | Description | Priority |
|---|---|---|
| Firewall | Restricts network access based on defined rules. | High |
| OS Updates | Patches security vulnerabilities. | High |
| Strong Passwords | Protects against brute-force attacks. | High |
| Intrusion Detection | Alerts administrators to suspicious activity. | Medium |
| Encryption | Protects data confidentiality. | High |
Database Security
The MediaWiki database contains potentially sensitive user information.
| Database Security Measure | Description | Implementation |
|---|---|---|
| Encryption at Rest | Encrypts database files on disk. | Database-specific configuration (e.g., InnoDB encryption in MySQL). |
| Access Control | Limits database user privileges. | Database user management. |
| Regular Backups | Creates copies of the database for recovery. | `mysqldump` or similar tools. |
| Audit Logging | Records database activity. | Database audit logging features. |
Encryption and Transport Layer Security (TLS)
| Encryption Aspect | Details | Configuration |
|---|---|---|
| TLS Version | Use TLS 1.3 or 1.2. | Web server configuration (Apache/Nginx). |
| Cipher Suites | Prioritize strong cipher suites (e.g., ECDHE-RSA-AES256-GCM-SHA384). | Web server configuration (Apache/Nginx). |
| Certificate Authority | Use a trusted CA (e.g., Let's Encrypt). | Certificate installation on web server. |
| Data Encryption | Encrypt sensitive files on disk. | Operating system-level encryption (e.g., LUKS). |
Logging and Auditing
Data Subject Rights
MediaWiki provides some features to support data subject rights, but server-side configuration can enhance these:
Important Links
Intel-Based Server Configurations
| Configuration | Specifications | Benchmark |
|---|---|---|
| Core i7-6700K/7700 Server | 64 GB DDR4, NVMe SSD 2 x 512 GB | CPU Benchmark: 8046 |
| Core i7-8700 Server | 64 GB DDR4, NVMe SSD 2x1 TB | CPU Benchmark: 13124 |
| Core i9-9900K Server | 128 GB DDR4, NVMe SSD 2 x 1 TB | CPU Benchmark: 49969 |
| Core i9-13900 Server (64GB) | 64 GB RAM, 2x2 TB NVMe SSD | |
| Core i9-13900 Server (128GB) | 128 GB RAM, 2x2 TB NVMe SSD | |
| Core i5-13500 Server (64GB) | 64 GB RAM, 2x500 GB NVMe SSD | |
| Core i5-13500 Server (128GB) | 128 GB RAM, 2x500 GB NVMe SSD | |
| Core i5-13500 Workstation | 64 GB DDR5 RAM, 2 NVMe SSD, NVIDIA RTX 4000 |
AMD-Based Server Configurations
| Configuration | Specifications | Benchmark |
|---|---|---|
| Ryzen 5 3600 Server | 64 GB RAM, 2x480 GB NVMe | CPU Benchmark: 17849 |
| Ryzen 7 7700 Server | 64 GB DDR5 RAM, 2x1 TB NVMe | CPU Benchmark: 35224 |
| Ryzen 9 5950X Server | 128 GB RAM, 2x4 TB NVMe | CPU Benchmark: 46045 |
| Ryzen 9 7950X Server | 128 GB DDR5 ECC, 2x2 TB NVMe | CPU Benchmark: 63561 |
| EPYC 7502P Server (128GB/1TB) | 128 GB RAM, 1 TB NVMe | CPU Benchmark: 48021 |
| EPYC 7502P Server (128GB/2TB) | 128 GB RAM, 2 TB NVMe | CPU Benchmark: 48021 |
| EPYC 7502P Server (128GB/4TB) | 128 GB RAM, 2x2 TB NVMe | CPU Benchmark: 48021 |
| EPYC 7502P Server (256GB/1TB) | 256 GB RAM, 1 TB NVMe | CPU Benchmark: 48021 |
| EPYC 7502P Server (256GB/4TB) | 256 GB RAM, 2x2 TB NVMe | CPU Benchmark: 48021 |
| EPYC 9454P Server | 256 GB RAM, 2x2 TB NVMe |
Order Your Dedicated Server
Configure and order your ideal server configurationNeed Assistance?
⚠️ *Note: All benchmark scores are approximate and may vary based on configuration. Server availability subject to stock.* ⚠️