Difference between revisions of "Security setup"
| Line 47: | Line 47: | ||
=== Denial of service hardening (optional) === | === Denial of service hardening (optional) === | ||
=== Storage encryption ( | === Storage encryption (optional) === | ||
Storage encryption is normally supported by the underlying technologies. | Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). | ||
MySQL supports multiple encryptions | MySQL supports multiple encryptions | ||
Revision as of 14:09, 2 September 2021
Security features
Password policies (recommended)
Password should have rules in order to prevent guessing
- Requirements to length and complexity
- Maximum number of tries
How to: The polices can be changed in server configurations in the group Password policies
Note: The password polices will have no impact on SSO authentication
Multifactor authentication (recommended)
Two different options exist (choose one)
- MFA using codes sent to the users mobile via SMS
- You will need to create an account for sending SMS
- Cost is approx. 0,30 DKK per message)
- MFA using af dedicated app from
- Apple
- Microsoft
SMS requires very little of the users, while App based MFA is considered (slightly) more secure.
Note: If using singleignon the MFA will not be used
Geolocation blocking (optional)
Geoblocking will allow the servers to deny requests from certain countries.
The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.
How to: Change the system configurations starting with ipBlocker
- Activate setting ipBlockerActive
- Set allowed countries in ipBlockerAllowedCountries
Request throttling (optional)
As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.
Limitations can be set on
- Pages hit
- WebDAV requests
- Upload (size/count)
- REST operations
How to: Edit server configurations starting with limit
Denial of service hardening (optional)
Storage encryption (optional)
Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt).
MySQL supports multiple encryptions
- The whole database
- Single schema (each TS installation)
Read more about encryption for [[1]] and [[2]]
O/S level encryption technology includes
- Windows: BitLocker
- Linux: LUKS
Additional configurations
- File whitelisting (uploadWhitelist)
- OWASP compliance (owaspCompliance)
Compliance features
Logging
Each entity can support the following
- Access log: User that has edited or viewed an item
- Status log: History of items time spent in each step
- Change log: Copy of old data along with timestamp and user that has changed the item (see below)
How to: Each option is activated on the entity Advanced page.
Pro tip: Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.
Versioning
By default file versioning is supported on document fields.
In addition data revisions can be supported on each individual entity.
How to: Data revisions is activated on the entity Advanced page.
GDPR deletion policies
GDPR policies will enable automatic handling of stated deletion policies. The system will automatically remove or anonoumize data and files in the system.
How to:
- Set up an action on a entity status
- Check of deletion policy
- Choose between anonoumization or deletion
- Optionally select log data to also be deleted
In case you choose "anonoumization" you should define how each field should be handled
- Click on a field
- Click on Assignment
- Check of anoumization
- Optionally set value after change