Groupe.io adheres to the highest levels of industry standard for security to ensure all organizational information shared via Groupe.io remain private and safe. The platform comes with several layers of protection and compliance to ensure security and integrity of enterprise data stay strong.
- All database servers are physically and logically separated from application servers to keep them accessible only from application servers, to eliminate resource contention between application and database servers, and to increase security by removing the database servers from DMZ (demilitarized zone) or public network.
- Our database servers are certified by PCI, HIPAA, and SOC, with security programs for finance, healthcare, government, and more.
- All communication between servers are secured with security groups. These are analogous to an inbound network firewall. Security groups help in enabling the specific protocols, ports, and source IP ranges that are allowed to reach servers. These security groups determine which traffic is allowed to reach the servers.
- All of the server’s access is controlled by a PCI DSS Compliance Identity & Access Management policy, which restricts users to manage security groups and network policies without permission.
- All data on network during transit is encrypted with TLS 2048-bit SSL certificate.
- Passwords are hashed before storing them in database with bcrypt hashing algorithms based on the Blowfish cipher. The hashes remain resistant to dictionary attack or even brute-force attack.
- An industry standard RFC 7519, HMAC-SHA-256 algorithm is used to generate a digitally signed token for URL-safe means of communication between two parties.
- Organization data is segmented at a spot level within Groupe.io, and is only available to employees of the organization who have been explicitly authorized as admins of that spot.
- Admins can grant access to user with secure passcode & and multi-step verifications and set password expiration schedules.
- Each user is identified by a combination of user account and device id and and accessibility can be restricted with specific to device, geolocation, wifi, email.
- Administrators can revoke access to individual users and remotely wipe data from user’s device
- SAML 2.0 interface to enable single sign-on & active directory
- Groupe.io operates state-of-the-art; is highly-available; and is resilient to disasters, thanks to geographically distributed data centers. Although rare failures can occur that affect the availability of instances in the same geolocation, other data centers from a different region always ensure availability.
- Images are stored on the CDN and are replicated on multiple servers around the world to serve them to end-users with high availability and high performance.
- Only those within the company having a genuine business, need to know the actual location of data centers.
- To prevent unauthorized access, data centers are secured with a variety of physical controls like full-time on-site security personnel, 24/7/365 video surveillance, strict physical access controls.
- Admins can grant access to users with secure passcode and multi-step verifications.
- Security and accessibility preferences allow admins to restrict how and where users can access data. User accessibility can be restricted specific to device, geolocation, wifi, and email.
- Users using defamatory, offensive, mean-spirited content can be banned using the Admin Console.
- Automated test suites are executed every eight hours. Reporting and comparing results with earlier test runs are notified to tech teams.
- Mocha is used for test coverage reporting and for checking memory leak detection. This also ensures accurate reporting, while mapping uncaught exceptions to the correct test cases.
- Scans for internal and external vulnerability assessments and penetration tests are done based on the OWASP (Open Web Application Security Project).
- Monitoring and reporting with Nagios, which extensively monitors activities on servers, generates priority based notifications, captures activity logs, and remains available for querying logs for audit.
- Event loggers and hooks ensure all activities are recorded, monitored, and any event which is determined as critical, e.g. uncaught exceptions, fires a detailed mail to tech Teams.
- Server security policy changes are captured and logged, and email alerts are sent within few minutes of any changes on existing policies.
- Groupe.io follows six months clear log comprehensive retention policy.
Top Vulnerabilities and Controls
For defence against query injections, all inputs have to pass through a sanity check engine, which will filter out any suspicious and malicious ones. Strict standard followed to avoid EVAL-like expressions.
HTTP Strict Transport Security (HSTS) is IETF standards and is specified in RFC 6797. This security policy mechanism is enforced to ensure protection against protocol downgrade attacks and cookie hijacking.
X-Frame-Options HTTP Headers are always set from all the server side responses. This is done to declare a policy between our servers and the client browsers on whether the latter must display the transmitted content in frames from other domains or not. This protects against Clickjacking.
Cross-Site Scripting (XSS):
X-XSS-Protection HTTP Headers are used to detect and filter out all XSS attacks. In order to stop the attack, the browser will sanitize the page and report the violation.
Cross-Site Request Forgery (CSRF):
Standard origin and referer header checks are done to verify the request matches of our origin and also to verify CSRF Synchronizer token. This is generated by a pattern where a token, with a secret and unique value for every request, is embedded by the server that ensures unpredictability and uniqueness. The attackers are thus unable to place a correct token in their requests to authenticate. The server denies to perform the requested action if the verification of header or CSRF token fails.
Components with Known Vulnerabilities:
All the components such as libraries, frameworks, and other software modules are tested for design flaws with full attention before incorporating with the software architecture.
X-Powered-By information can be hidden from attackers using version numbers to find exploitable software. This reduces inspectability and auditability of our system on public Networks.
X-Content-Type-Options is set to “nosniff”, which instructs browsers to stop executions of the script if MIME-type mismatches. This is set to ensure defence against attacks based on MIME-type confusions.
Content Security Policies
Content security policies are well defined, which help to prevent unwanted content being injected into the web pages. This can mitigate XSS vulnerabilities, unintended frames, and malicious frames.
Broken Authentication, Session Management, and Sensitive Data Exposure An industry standard RFC 7519, HMAC-SHA-256 algorithm is used to generate a digitally signed token, which is used as a session key and which ensures communication between the client and server.
User passwords are encrypted with TLS 2048-bit certificate during transmission, and authentication is done by bcrypt one-way hashing algorithms.
Database servers use encryption storage engine, which provides AES-256-bit-CBC encryption of data stored at rest across servers.
Insecure Direct Object References:
Role-Based Access Control (RBAC) restricts what and who can access data or services. This involves users to be authenticated and authorized to access protected data and tokens for other applications and to access protected services.
RBAC mechanism is built around Roles, Role Mapping, and Access Control List. Role Maps are created with well-defined Roles and Users. Access Control List is defined to controls if a user can perform a certain action.
If you have any questions, get in touch with us at firstname.lastname@example.org, and we’ll get back to you right away.