Security¶
Protect your data with advanced firewalls, encryption, and continuous monitoring for total peace of mind.
We always use security best practices, tailored in part to the individual needs of each client. Below is a description of the standard measures we provide and manage to provide a by-default secure setup.
Our default setup is based on the principle of defense-in-depth, and ensures that there are multiple layers of defense in case one of them would be compromised. These measures are also actively monitored, and are improved and adjusted as needed.
Infrastructure level¶
- A GCP TCP load balancer that only allows HTTP / HTTPS traffic on ports 80 and 443, blocking highly disruptive Layer 3 and Layer 4 attacks by default.
- GCP Network-based firewall with fine grained control over which ports are allowed to be open, and which traffic is allowed to the server. This is for fallback from possible OS software errors and for risk mitigation, and is also used in (D)DOS attacks as a possibility to block traffic
- Proxy servers for SSL offloading and to block deep malicious traffic before it reaches the provided protected infrastructure.
- Separate shielded virtual network for the provided dedicated components.
Isolation between clients¶
VM (VPS) based hosting. Our production hosting runs on virtual machines on Google Cloud. Each production environment runs on its own dedicated virtual machine, provisioned for a single client. A client's application, files, and database are not co-located with those of other clients, and each dedicated environment sits within its own shielded virtual network. Development and staging environments provided through the shared development hosting are logically separated per client and project; a dedicated development server is available as an option.
Containerized based hosting (in development). Our containerized hosting runs on Kubernetes. Each client's workloads run in their own isolated, access-controlled namespace, with network policies enforcing separation between clients.
Host level¶
At the host level, all servers are equipped by default with the following active components:
- a host-based firewall (iptables) with only the necessary ports open, and the necessary logging (e.g. flood traffic) active.
- An IPS (intrusion prevention system, fail2ban) installed and configured, which actively scans all logs (e.g. auth.log, web server logs, ...), and takes actions (e.g. block IP address) based on the configured rules.
- An antivirus engine (ClamAV) to detect and mitigate trojans, viruses, malware and other malicious threats.
- In addition, best practices around hardening (SSH configuration, disk and partition management, disk consistency checks, user authentication policies, ...) are also followed.
OS & software updates / patching¶
For both the OS and the software, we possibly use Long Term Support versions, so that we have the necessary guarantees in terms of security patches within the term of the contractual obligations.
- Patch Frequency: each patch is evaluated for urgency and impact, e.g. on the CVE score for security issues. Patches considered highly critical are deployed within one day
- Active log monitoring of various security lists and proactive action on suspected security threats.
- Active monitoring and deployment of security updates for all services within the stack.