Security

We always use security best practices, tailored in part to the individual needs of each client. Below is a description of the standard measures we provide and manage to provide a by-default secure setup.
Our default setup is based on the principle of defense-in-depth, and ensures that there are multiple layers of defense in case one of them would be compromised. These measures are also actively monitored, and are improved and adjusted as needed.

Infrastructure level

  • A GCP TCP load balancer that only allows HTTP / HTTPS traffic on ports 80 and 443, blocking highly disruptive Layer 3 and Layer 4 attacks by default.

  • GCP Network-based firewall with fine grained control over which ports are allowed to be open, and which traffic is allowed to the server. This is for fallback from possible OS software errors and for risk mitigation, and is also used in (D)DOS attacks as a possibility to block traffic

  • Proxy servers for SSL offloading and to block deep malicious traffic before it reaches the provided protected infrastructure.

  • Separate shielded virtual network for the provided dedicated components.

Host level

At the host level, all servers are equipped by default with the following active components:

  • a host-based firewall (iptables) with only the necessary ports open, and the necessary logging (e.g. flood traffic) active.

  • An IPS (intrusion prevention system, fail2ban) installed and configured, which actively scans all logs (e.g. auth.log, web server logs, ...), and takes actions (e.g. block IP address) based on the configured rules.

  • An antivirus engine (ClamAV) to detect and mitigate trojans, viruses, malware and other malicious threats.

  • In addition, best practices around hardening (SSH configuration, disk and partition management, disk consistency checks, user authentication policies, ...) are also followed.

OS & software updates / patching

For both the OS and the software, we possibly use Long Term Support versions, so that we have the necessary guarantees in terms of security patches within the term of the contractual obligations.

  • Patch Frequency: each patch is evaluated for urgency and impact, e.g. on the CVE score for security issues. Patches considered highly critical are deployed within one day

  • Active log monitoring of various security lists and proactive action on suspected security threats.

  • Active monitoring and deployment of security updates for all services within the stack.