Safe Secure and Private

There is no compromise when it comes to web site security

“Some of the greatest fears of having a website include; unauthorized access, the possibility of being hacked, users being prevented access by a DDOS denial of service attack, virus infections, amongst many other possible abuses and malpractices. Not only could any of these activities result in a huge amount of wasted time and monetary loss, but they could seriously affect the company reputation, and also have many other knock-on negative effects. This is why we invest a significant amount of time, energy and technology in surrounding your Mondrian Hosted site with the best in website security.”

What we do not provide is a single “magic bullet” solution (because there isn’t one!); but continuously apply a whole range of the latest techniques, security processes and services to prevent malicious attacks and infections to ensure the privacy, integrity, and availability of the site’s data and resources.

System Security Best Practices

The following describes the system security processes and activities adopted and delivered in conjunction with our partners:

1. We use four different data center locations (London UK, Newark NJ, Tokyo and Hong Kong) to host our services for our enterprise customers and provide a high-availability service.
2. The data center environments undergo a SAS 70 Type II examination annually. For security reasons we don’t publish any details.
3. Industry best practices are adopted to maintain reasonable security precautions consistent as documented in ISO/IEC 27002 standards.
4. Documented security baselines are used to harden and secure IT systems and checked to ensure they are implemented and working effectively.
5. The external Security consultant (Sucuri) establish baselines and ensure they’re being adhered to and change over time as new information and processes are put into place.
6. All computing equipment is located in a physically secure facility, where electronic access controls are used to prevent unauthorized access to computing facilities. We nor our customers have physical access. This is controlled completely by our hosting providers.
7. All personnel (employees and contractors) that have access to critical infrastructure, servers, applications, or data undergo background screenings.
8. Firewalls are configured based on the principle of least privilege, where firewalls only allow approved applications, protocols, and services required to meet business needs.
9. Intrusion detection and intrusion prevention systems are used to monitor and protect our networks and are updated monthly, or as-needed.
10. Vulnerability scanning for all infrastructure, servers, databases and applications, happens at least once a quarter.
11. The well-regarded security firm (Sucuri) is used for auditing and remediation. Reports are processed internally and remedied as fast as possible with the assistance of this firm.
12. Specialist tools and custom scripts in-house are continually used for vulnerability scanning, both externally (i.e. through network connections) and internally (i.e. scanning disk and database for known vectors and exploits).
13. External penetration testing is done by an independent, qualified vendor at least once per year. Sucuri performs such external penetration testing.
14. We provide a segregated environment (physically and logically) so that your data is isolated and protected against any unauthorized access.
15. Logical separation is achieved through completely separated file system roots. Both “chroot” and “apparmor” are used to prevent executable code from one system to access files of another system. Each system has a separate database username/password to isolate database access. Attempts to access data outside the tree are prevented and logged.
16. We also offer complete physical separation if desired. This is of course much more expensive because we need to provision an entire hardware cluster just for you. This can be done as long as you have the budget.
17. We utilize multi-server clusters. A cluster is a set of machines, each of which deals with your traffic among others, so if one goes down your site keeps running. Multi-server clusters also continually assess traffic, and automatically assign the right number of clusters based on expected demand. This means rapid operation and ensures a good degree of fault tolerance if there’s a failure.
18. Backups are maintained of the application and every customer’s data is kept logically separate from other customer’s data when it is backed up.
19. We encrypt backup media. Backups are all separate and available to be restored by a single click. Full encrypted backups are also stored as tarballs on Amazon S3. Customers do not have direct access. As Amazon S3 is used for backups, please consult their information about encryption if you need more details.

Application and Database Security Best Practices

Besides applying a comprehensive range of security measures to the hardware, networking and operating system elements, there are many things we do within the application to ensure your Mondrian site is safe and secure. This includes simple things like; always keeping up to date with the latest versions of software; using SSL; hiding; locking and limiting access to critical files and directories; encrypting passwords and URLs; scanning for malware; and blocking access to search engines, crawlers and other intrusive software.

Passwords

Each year thousands of websites are hacked. Sometimes it’s by way of a crafty “social engineer” (someone who tricks someone into giving up information without realizing it) by conning some unsuspecting user out of his/her login and then there is no way that you can stop the hacker from accessing the system and changing or deleting data the user had access rights to. We do have measures to protect the data as we maintain daily backups and also do not allow any users to permanently delete data. We do not allow logged in users access to any files, software code, programs and routines that could be modified or used to damage or disable the site.

If you are an Enterprise organization, you probably already have a password security policy which we can adhere to if you wish (and/or apply other proprietary security requirements, and/or augment the features we supply as standard).

The first step all your users should take is using strong, unique passwords for user login credentials. Our standard system checks for password length and we use algorithms to monitor password strength prior to entry. All new users also need a unique license key to be able to sign up, and to use a registered domain address. All passwords are stored in the database in encrypted format.

All access to sensitive information is regulated by a secondary project access control system controlled by the project originator(s). Project originators have complete control to only allow access to people who they want to provide access to. Access rights can be restricted to read, write, or no access.

Brute force login attempts

There are many attacks on websites and Brute force login attempts are one of the more common, rather annoying and potentially dangerous types of attacks that can occur.

Brute force happens when an attacker targets the login screen and repeatedly attempts to guess the username and password to gain access. An attacker (person or bot) will try to attack for minutes or hours by entering a dictionary list of names and passwords in the hope of stumbling upon the correct one. We use sophisticated external and internal “limit login” algorithms to combat this.

By default, we limit the number of attempts made using incorrect usernames and passwords. We limit the number of attempts a user can make to enter your username and password in a given timeframe (typically 3 to 5 tries in a 5 minute period). Once that limit is reached, the potential attacker can be blocked for up to an hour or more. This is usually enough to discourage the would be hacker and make them move on to a different target.