Web Platform Security -- Best Practices

Information security is an extremely important topic for technology companies, which handle large volumes of sensitive data from their clients and users. It is essential to ensure the privacy, integrity, and availability of this information, protecting it against unauthorized access, theft, damage, and other types of threats. Furthermore, information security is vital for business continuity and the preservation of an organization's reputation. Given the growing sophistication of cyber attacks, adopting effective security measures to protect confidential information is imperative. In this article, we discuss some of the key security measures we employ to ensure data security and maintain our clients' trust.

Encryption

Encryption is one of the most important information security measures on our platforms, as it protects information in transit between the platform and the client, as well as data stored "at rest." In general terms, encryption is the process of encoding data so that it can only be read by someone who holds the correct key to decode it.

There are different encryption algorithms, one of the most popular being SSL/TLS (Secure Socket Layer/Transport Layer Security). SSL/TLS is a technology that encrypts information traveling between the application and the client, ensuring that it cannot be intercepted by third parties.

SSL/TLS works using digital certificates issued by a trusted certificate authority. When a user accesses a web platform that uses SSL/TLS, the server sends the client a digital certificate containing a public key. This key is used to encrypt the information sent by the client. The client, in turn, generates a session key to encrypt the information before sending it to the application.

At Mupi Systems, we take special care in configuring our encryption methods to ensure adherence to the strictest security standards. For example, we avoid using weak encryption algorithms and outdated SSL versions, keep software versions up to date, monitor compliance with regulations, and conduct regular security tests. You can check the rating of our security configurations by visiting an independent SSL validation site, such as SSL Labs by Qualys.

Authentication

Authentication is also one of the most important information security measures on our platforms, as it helps ensure that only authorized users have access to protected data and resources. Authentication is the process of verifying a user's identity to confirm that they are who they claim to be.

There are different authentication methods available in the market. The most common on our platforms is password-based authentication. In this method, the user provides a username and password to access the platform. The password is verified against a database of encrypted passwords, and access is granted only if the password is correct.

However, password-based authentication can be vulnerable to brute-force attacks and other hacking techniques. This is especially true if passwords are not strong enough or if they are reused across different services. For this reason, we employ protective measures such as locking user accounts after a series of invalid login attempts.

Password Management

Password management is a crucial part of information security, as weak or poorly managed passwords can expose confidential information and user data to attackers. Password management involves various practices and policies to ensure secure storage and that users create strong, unique passwords.

One of the key practices is secure password storage. Rather than storing user passwords in plain text, they are stored in an encrypted form using a "salt." Encryption protects the password from being seen by unauthorized individuals, while the "salt" adds a random string of characters to the password before it is encrypted, making it even more difficult to crack.

Additionally, passwords should be strong and unique. This means passwords should be at least 8 characters long, including uppercase and lowercase letters, numbers, and special characters. It is also important that users do not reuse passwords across different services, as this increases the risk that a security breach in one service could lead to the exposure of other user accounts.

We also implement password policies that encourage users to create strong and unique passwords. This can include requiring strong passwords when creating an account or changing a password, as well as notifying users about weak or reused passwords.

Finally, user education is important to ensure they understand the importance of secure passwords and how to create strong, unique ones. At Mupi Systems, we work to provide educational resources to our clients, such as password best practices guides, as well as password notifications and reminders to users.

Backup

Data backup is crucial for the security and availability of our platforms. It ensures that in the event of hardware or software failures, human errors, or cyber attacks, data can be restored quickly and without data loss.

There are several practices we adopt and recommend for data backup, including:

1. Back up regularly: We perform backups on a regular and consistent basis, depending on the volume of data being generated. For our databases, we run incremental backups every 5 minutes and a full backup daily.
2. Store backups in a secure location: We store backups in a location separate from the platform and also outside the company's physical premises. This ensures that in the event of a failure affecting the servers or the workplace, the backups are not compromised.
3. Test backups: We test backups regularly to ensure that data can be restored correctly. This way, in the event of a failure, we can use the backups to restore data efficiently and without data loss.
4. Automate the backup process: The backup process is fully autonomous to ensure regular and consistent execution. This reduces the risk of failures caused by human error or oversight.
5. Encrypt backups: We encrypt backups to ensure that the data stored in them is protected against unauthorized access.

Monitoring

Monitoring is an essential practice for ensuring the performance, information security, and availability of our platforms. It allows Development, Operations, and Security teams to detect problems quickly -- before they affect users -- and take measures to correct them.

Here are some types of monitoring we perform on our platforms:

1. Performance monitoring: We continuously monitor our platforms to ensure they are functioning correctly and providing a good user experience. Performance monitoring can detect issues such as slowness, high response times, or connection errors. This allows the team to take corrective action and ensure the platform continues to operate without interruptions.
2. Security monitoring: Platforms are constantly exposed to security threats, such as cyber attacks, malware, and phishing. Security monitoring enables the Security team to detect these threats as quickly as possible and take measures to mitigate risks, protecting user data and platform integrity.
3. Availability monitoring: Platform availability is fundamental to ensuring user satisfaction. Availability monitoring can detect issues such as application outages, network failures, or configuration errors. This allows the IT team to take action to ensure the platform is always available to users. You can access our public availability monitoring page for our platforms at https://status.blog.mupisystems.com.br;
4. Log monitoring: Logs are records that track web platform activities, including errors, security events, and user actions. Log monitoring helps the Development team identify security issues, debug performance problems, and provide valuable information for future platform planning.

Security Testing

Security testing is a critical part of the platform development lifecycle and is essential for identifying and fixing vulnerabilities before malicious actors can exploit them. These tests include identifying and remediating vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), Command Injection, and other threats.

There are several types of security tests we perform internally. These tests aim to identify vulnerabilities and security threats that may exist on the platform and to evaluate the effectiveness of the security measures in place. Below, we list some types of security tests we conduct at Mupi Systems:

Penetration Testing

This is a security test that simulates a real attack on the platform in order to identify vulnerabilities and weak points. This type of test can include network intrusion testing, application penetration testing, phishing tests, and others.

Vulnerability Testing

This is a test designed to identify known vulnerabilities on the platform. Examples of vulnerabilities include software flaws, inadequate configurations, and other issues that could leave the platform vulnerable to attacks. We employ two types of tests: DAST (Dynamic Application Security Testing) and SAST (Static Application Security Testing). DAST is a testing approach where we simulate external attacks on a platform, identifying vulnerabilities and weak points. SAST, on the other hand, is a testing approach that evaluates an application's source code to identify potential vulnerabilities.

Compliance Testing

This is a test that evaluates whether the platform complies with security and privacy regulations, such as the LGPD (Brazil's General Data Protection Law) and the GDPR (General Data Protection Regulation) in the European Union.

Stress Testing

This is a test that evaluates the platform's capacity to handle a large volume of traffic, users, and other simultaneous requests. This type of test can help identify potential bottlenecks on the platform and determine whether it can withstand a heavy load.

Conclusion

Information security is a crucial topic for technology companies. When handling large volumes of sensitive data from clients and users, protecting the privacy, integrity, and availability of this information is fundamental. Furthermore, information security is vital for business continuity and preserving an organization's reputation.

Implementing adequate security measures is one of the primary ways to ensure information security. For example, an effective approach includes adopting robust encryption practices, proper password management, performing regular backups, and conducting security tests.

As a company committed to information security, it is essential that we invest in advanced technologies and a highly qualified team to protect our clients' data and maintain their trust in our services. We will continue to enhance our security measures to ensure that our clients can use our services with peace of mind and confidence. We appreciate the trust placed in our company and reiterate our commitment to information security. New publications on this topic will be available on our blog at this link.