https://wiki.tsnocode.dev/api.php?action=feedcontributions&feedformat=atom&user=80.161.14.74 2026-04-11T14:22:30Z User contributions MediaWiki 1.37.0 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5144 2021-11-16T15:49:42Z

<p>80.161.14.74: /* Hosting Setup */</p> <hr /> <div>== Application ==<br /> The LES Whistleblower Platform is fully managed by Tempus Serva ApS.<br /> <br /> The system supports the following roles and usecases<br /> * Case Triager: Assignes cases to applicable lawyer <br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower has the option to return to his/her case, using a randomized code generated during the report process.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetsEncrypt<br /> * UptimeRobot polls the server each minute checking: Access to database, Storate- and RAM-sufficiency<br /> * Database is dumped nightly, replicated to encrypted storage in EU<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Backup ==<br /> Backups are securely stored in a redundant environment. Data is stored in encrypted form and adequate measures enable recovery in case of system failure or interruption. The environment is backed up as follows:<br /> *'''A) Daily''' full server backups, stored for 30 days, after which they are overwritten.<br /> *'''B) Monthly''' full server backups, stored for 3 months, after which they are overwritten.<br /> <br /> The purpose is to ensure that Recovery Point Objective and Recovery Time Objective for environments are 24 hours where possible. For data recovery older than 60 days, a time frame of at least 72 hours is required.<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * '''Activity and data logging''' Activity and Data Logging is enabled. However, IP logging on server requests is deliberately disabled to ensure the anonymity of external users.<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> <br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5143 2021-11-16T15:46:11Z

<p>80.161.14.74: /* Hosting Setup */</p> <hr /> <div>== Application ==<br /> The LES Whistleblower Platform is fully managed by Tempus Serva ApS.<br /> <br /> The system supports the following roles and usecases<br /> * Case Triager: Assignes cases to applicable lawyer <br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower has the option to return to his/her case, using a randomized code generated during the report process.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetsEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Backup ==<br /> Backups are securely stored in a redundant environment. Data is stored in encrypted form and adequate measures enable recovery in case of system failure or interruption. The environment is backed up as follows:<br /> *'''A) Daily''' full server backups, stored for 30 days, after which they are overwritten.<br /> *'''B) Monthly''' full server backups, stored for 3 months, after which they are overwritten.<br /> <br /> The purpose is to ensure that Recovery Point Objective and Recovery Time Objective for environments are 24 hours where possible. For data recovery older than 60 days, a time frame of at least 72 hours is required.<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * '''Activity and data logging''' Activity and Data Logging is enabled. However, IP logging on server requests is deliberately disabled to ensure the anonymity of external users.<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> <br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5142 2021-11-16T15:44:21Z

<p>80.161.14.74: /* Technology Stack */</p> <hr /> <div>== Application ==<br /> The LES Whistleblower Platform is fully managed by Tempus Serva ApS.<br /> <br /> The system supports the following roles and usecases<br /> * Case Triager: Assignes cases to applicable lawyer <br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower has the option to return to his/her case, using a randomized code generated during the report process.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetsEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Backup ==<br /> Backups are securely stored in a redundant environment. Data is stored in encrypted form and adequate measures enable recovery in case of system failure or interruption. The environment is backed up as follows:<br /> *'''A) Daily''' full server backups, stored for 30 days, after which they are overwritten.<br /> *'''B) Monthly''' full server backups, stored for 3 months, after which they are overwritten.<br /> <br /> The purpose is to ensure that Recovery Point Objective and Recovery Time Objective for environments are 24 hours where possible. For data recovery older than 60 days, a time frame of at least 72 hours is required.<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * '''Activity and data logging''' Activity and Data Logging is enabled. However, IP logging on server requests is deliberately disabled to ensure the anonymity of external users.<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> <br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5141 2021-11-16T15:44:15Z

<p>80.161.14.74: /* Backup */</p> <hr /> <div>== Application ==<br /> The LES Whistleblower Platform is fully managed by Tempus Serva ApS.<br /> <br /> The system supports the following roles and usecases<br /> * Case Triager: Assignes cases to applicable lawyer <br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower has the option to return to his/her case, using a randomized code generated during the report process.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetsEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * '''Activity and data logging''' Activity and Data Logging is enabled. However, IP logging on server requests is deliberately disabled to ensure the anonymity of external users.<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> <br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5140 2021-11-16T15:42:36Z

<p>80.161.14.74: /* Backup */</p> <hr /> <div>== Application ==<br /> The LES Whistleblower Platform is fully managed by Tempus Serva ApS.<br /> <br /> The system supports the following roles and usecases<br /> * Case Triager: Assignes cases to applicable lawyer <br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower has the option to return to his/her case, using a randomized code generated during the report process.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetsEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Backup ==<br /> Backups are securely stored in a redundant environment. Data is stored in encrypted form and adequate measures enable recovery in case of system failure or interruption. The environment is backed up as follows:<br /> *'''A) Daily''' full server backups, stored for 30 days, after which they are overwritten.<br /> *'''B) Monthly''' full server backups, stored for 3 months, after which they are overwritten.<br /> <br /> The purpose is to ensure that Recovery Point Objective and Recovery Time Objective for environments are 24 hours where possible. For data recovery older than 60 days, a time frame of at least 72 hours is required.<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * '''Activity and data logging''' Activity and Data Logging is enabled. However, IP logging on server requests is deliberately disabled to ensure the anonymity of external users.<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> <br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5139 2021-11-16T15:42:01Z

<p>80.161.14.74: /* Backup */</p> <hr /> <div>== Application ==<br /> The LES Whistleblower Platform is fully managed by Tempus Serva ApS.<br /> <br /> The system supports the following roles and usecases<br /> * Case Triager: Assignes cases to applicable lawyer <br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower has the option to return to his/her case, using a randomized code generated during the report process.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetsEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Backup ==<br /> Backups are securely stored in a redundant environment. Data is stored in encrypted form and adequate measures enable recovery in case of system failure or interruption. The environment is backed up as follows:<br /> *'''A) Daily''' full server backups, stored for 30 days, after which they are overwritten.<br /> *'''B) Monthly''' full server backups, stored for 3 months, after which they are overwritten.<br /> <br /> LES will ensure that Recovery Point Objective and Recovery Time Objective for environments are 24 hours where possible. For data recovery older than 60 days, a time frame of at least 72 hours is required.<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * '''Activity and data logging''' Activity and Data Logging is enabled. However, IP logging on server requests is deliberately disabled to ensure the anonymity of external users.<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> <br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5138 2021-11-16T15:41:24Z

<p>80.161.14.74: /* Hosting Setup */</p> <hr /> <div>== Application ==<br /> The LES Whistleblower Platform is fully managed by Tempus Serva ApS.<br /> <br /> The system supports the following roles and usecases<br /> * Case Triager: Assignes cases to applicable lawyer <br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower has the option to return to his/her case, using a randomized code generated during the report process.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetsEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Backup ==<br /> Backups are securely stored in a redundant environment. Data is stored in encrypted form and adequate measures enable recovery in case of system failure or interruption. The environment is backed up as follows:<br /> A) Daily full server backups, stored for 30 days, after which they are overwritten.<br /> B) Monthly full server backups, stored for 3 months, after which they are overwritten.<br /> LES will ensure that Recovery Point Objective and Recovery Time Objective for environments are 24 hours where possible. For data recovery older than 60 days, a time frame of at least 72 hours is required.<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * '''Activity and data logging''' Activity and Data Logging is enabled. However, IP logging on server requests is deliberately disabled to ensure the anonymity of external users.<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> <br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5137 2021-11-16T15:35:06Z

<p>80.161.14.74: /* Hosting Setup */</p> <hr /> <div>== Application ==<br /> The LES Whistleblower Platform is fully managed by Tempus Serva ApS.<br /> <br /> The system supports the following roles and usecases<br /> * Case Triager: Assignes cases to applicable lawyer <br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower has the option to return to his/her case, using a randomized code generated during the report process.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetsEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * '''Activity and data logging''' Activity and Data Logging is enabled. However, IP logging on server requests is deliberately disabled to ensure the anonymity of external users.<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> <br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5136 2021-11-16T15:34:35Z

<p>80.161.14.74: /* Application */</p> <hr /> <div>== Application ==<br /> The LES Whistleblower Platform is fully managed by Tempus Serva ApS.<br /> <br /> The system supports the following roles and usecases<br /> * Case Triager: Assignes cases to applicable lawyer <br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower has the option to return to his/her case, using a randomized code generated during the report process.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * '''Activity and data logging''' Activity and Data Logging is enabled. However, IP logging on server requests is deliberately disabled to ensure the anonymity of external users.<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> <br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4016 2021-11-16T15:27:23Z

<p>80.161.14.74: /* Activity and data logging (optional) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> TS No-code Platform offers native Multi-factor Authentication to protect against unauthrised access by requiring a user to provide multiple authentication factors to prove their identity. At present two different options are available:<br /> * MFA using session-specific, one-time-passcodes sent to the users mobile phone via regular or Flash SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Activity and Data Logging includes the automatic creation of a series of log files. Logging can be set up for each entity in an application providing insight and transparency in relation to: user activity, creation, changes and status of different records in an application. <br /> * '''Access Log''': Can be activated on an entity in an application. This automatically generates a log of which users have accessed and/or edited a given record. <br /> * '''Status Log''': Can be activated for an entity in an application. This automatically generates a log of the history of the created records, which shows how long a record has been in each status<br /> * '''Change Log''': Can be activated for an entity in an application. This automatically generates a log of what changes have been made to the individual records. Including who has changed what and when (timestamp).<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on the &quot;Documents&quot; and &quot;Files&quot; field types. In addition, data revisions can be supported on each entity. This automatically builds an audit log for each record.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR Deletion Policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and System Logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4015 2021-11-16T15:22:17Z

<p>80.161.14.74: /* Versioning (optional) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> TS No-code Platform offers native Multi-factor Authentication to protect against unauthrised access by requiring a user to provide multiple authentication factors to prove their identity. At present two different options are available:<br /> * MFA using session-specific, one-time-passcodes sent to the users mobile phone via regular or Flash SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Activity and Data Logging includes the automatic creation of a series of log files. Logging can be set up for each entity in an application providing insight and transparency in relation to: user activity, creation, changes and status of different records in an application. <br /> * '''Access Log''': Can be activated on an entity in an application. This automatically generates a log of which users have accessed and/or edited a given record. <br /> * '''Status log''': Can be activated for an entity in an application. This automatically generates a log of the history of the created records, which shows how long a record has been in each status<br /> * '''Change log''': Can be activated for an entity in an application. This automatically generates a log of what changes have been made to the individual records. Including who has changed what and when (timestamp).<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on the &quot;Documents&quot; and &quot;Files&quot; field types. In addition, data revisions can be supported on each entity. This automatically builds an audit log for each record.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR Deletion Policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and System Logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4014 2021-11-16T15:18:30Z

<p>80.161.14.74: /* Activity and data logging (optional) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> TS No-code Platform offers native Multi-factor Authentication to protect against unauthrised access by requiring a user to provide multiple authentication factors to prove their identity. At present two different options are available:<br /> * MFA using session-specific, one-time-passcodes sent to the users mobile phone via regular or Flash SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Activity and Data Logging includes the automatic creation of a series of log files. Logging can be set up for each entity in an application providing insight and transparency in relation to: user activity, creation, changes and status of different records in an application. <br /> * '''Access Log''': Can be activated on an entity in an application. This automatically generates a log of which users have accessed and/or edited a given record. <br /> * '''Status log''': Can be activated for an entity in an application. This automatically generates a log of the history of the created records, which shows how long a record has been in each status<br /> * '''Change log''': Can be activated for an entity in an application. This automatically generates a log of what changes have been made to the individual records. Including who has changed what and when (timestamp).<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR Deletion Policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and System Logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4013 2021-11-16T15:14:48Z

<p>80.161.14.74: /* Activity and data logging (optional) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> TS No-code Platform offers native Multi-factor Authentication to protect against unauthrised access by requiring a user to provide multiple authentication factors to prove their identity. At present two different options are available:<br /> * MFA using session-specific, one-time-passcodes sent to the users mobile phone via regular or Flash SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Activity and Data Logging includes the automatic creation of a series of log files. Logging can be set up for each entity in an application providing insight and transparency in relation to: user activity, creation, changes and status of different records in an application. <br /> * '''Access Log''': can be activated on an entity in an application. This automatically generates a log of which users have accessed and / or edited a given record. <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR Deletion Policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and System Logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4012 2021-11-16T15:14:33Z

<p>80.161.14.74: /* Activity and data logging (optional) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> TS No-code Platform offers native Multi-factor Authentication to protect against unauthrised access by requiring a user to provide multiple authentication factors to prove their identity. At present two different options are available:<br /> * MFA using session-specific, one-time-passcodes sent to the users mobile phone via regular or Flash SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Activity and Data Logging includes the automatic creation of a series of log files. Logging can be set up for each entity in an application providing insight and transparency in relation to: user activity, creation, changes and status of different records in an application. <br /> * '''Access :og''': can be activated on an entity in an application. This automatically generates a log of which users have accessed and / or edited a given record. <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR Deletion Policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and System Logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4011 2021-11-16T15:02:38Z

<p>80.161.14.74: /* Event and system logging (recommended) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> TS No-code Platform offers native Multi-factor Authentication to protect against unauthrised access by requiring a user to provide multiple authentication factors to prove their identity. At present two different options are available:<br /> * MFA using session-specific, one-time-passcodes sent to the users mobile phone via regular or Flash SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Activity and Data Logging includes the automatic creation of a series of log files. Logging can be set up for each entity in an application providing insight and transparency in relation to: user activity, creation, changes and status of different records in an application. <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR Deletion Policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and System Logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4010 2021-11-16T15:02:17Z

<p>80.161.14.74: /* GDPR deletion policies (optional) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> TS No-code Platform offers native Multi-factor Authentication to protect against unauthrised access by requiring a user to provide multiple authentication factors to prove their identity. At present two different options are available:<br /> * MFA using session-specific, one-time-passcodes sent to the users mobile phone via regular or Flash SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Activity and Data Logging includes the automatic creation of a series of log files. Logging can be set up for each entity in an application providing insight and transparency in relation to: user activity, creation, changes and status of different records in an application. <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR Deletion Policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and system logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4009 2021-11-16T14:58:53Z

<p>80.161.14.74: /* Activity and data logging (optional) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> TS No-code Platform offers native Multi-factor Authentication to protect against unauthrised access by requiring a user to provide multiple authentication factors to prove their identity. At present two different options are available:<br /> * MFA using session-specific, one-time-passcodes sent to the users mobile phone via regular or Flash SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Activity and Data Logging includes the automatic creation of a series of log files. Logging can be set up for each entity in an application providing insight and transparency in relation to: user activity, creation, changes and status of different records in an application. <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR deletion policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and system logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5135 2021-11-16T14:54:40Z

<p>80.161.14.74: /* Security Setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * '''Activity and data logging''' Activity and Data Logging is enabled. However, IP logging on server requests is deliberately disabled to ensure the anonymity of external users.<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> <br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5134 2021-11-16T14:52:25Z

<p>80.161.14.74: /* Security Setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * '''Activity and data logging''' Activity and Data Logging is enabled. IP logging on server requests is disabled in order to ensure anonymity of the user.<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> <br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5133 2021-11-16T14:46:24Z

<p>80.161.14.74: /* Security Setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain special character(s).<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5132 2021-11-16T14:45:53Z

<p>80.161.14.74: /* Security Setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must contain one or more special characters.<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4008 2021-11-16T14:39:50Z

<p>80.161.14.74: /* Multi-factor Authentication (recommended) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> TS No-code Platform offers native Multi-factor Authentication to protect against unauthrised access by requiring a user to provide multiple authentication factors to prove their identity. At present two different options are available:<br /> * MFA using session-specific, one-time-passcodes sent to the users mobile phone via regular or Flash SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Each entity can support the following <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR deletion policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and system logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4007 2021-11-16T14:32:09Z

<p>80.161.14.74: /* Multi-factor Authentication (recommended) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> TS No-code Platform offers native Multi-factor Authentication to protect against unauthrised access by requiring a user to provide multiple authentication factors to prove their identity. At present two different options are available:<br /> * MFA using one-time-passcodes sent to the users mobile phone via SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Each entity can support the following <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR deletion policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and system logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4006 2021-11-16T14:22:22Z

<p>80.161.14.74: /* Password Policies (recommended) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce the use of strong passwords through an appropriate password policy. Specify attribute requirements that control complexity and lifetime of passwords such as:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> Two different options exist (choose one)<br /> * MFA using codes sent to the users mobile via SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Each entity can support the following <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR deletion policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and system logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4005 2021-11-16T14:18:55Z

<p>80.161.14.74: /* Password Policies (recommended) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce fine-grained password policies. Specify attribute requirements like:<br /> * Mimimum password length<br /> * Special characters<br /> * Maximum password age<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> Two different options exist (choose one)<br /> * MFA using codes sent to the users mobile via SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Each entity can support the following <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR deletion policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and system logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4004 2021-11-16T14:09:37Z

<p>80.161.14.74: /* Password policies (recommended) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password Policies (recommended) ===<br /> TS No-code Platform allows you to setup and enfoce Password Policies. Specify requirements like:<br /> * Mimimum character length<br /> * Complexity<br /> * Special characters<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> Two different options exist (choose one)<br /> * MFA using codes sent to the users mobile via SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Each entity can support the following <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR deletion policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and system logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4003 2021-11-16T14:03:56Z

<p>80.161.14.74: /* Multifactor authentication (recommended) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password policies (recommended) ===<br /> Password should have rules in order to prevent guessing<br /> * Requirements to length and complexity<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multi-factor Authentication (recommended) ===<br /> Two different options exist (choose one)<br /> * MFA using codes sent to the users mobile via SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Each entity can support the following <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR deletion policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and system logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5131 2021-11-16T14:02:27Z

<p>80.161.14.74: /* Hosting setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting Setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must special characters.<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5130 2021-11-16T14:02:17Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security Setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must special characters.<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5129 2021-11-16T14:02:07Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must special characters.<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) sent to the users mobile phone as either a regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5128 2021-11-16T13:58:09Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must special characters.<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) delivered as regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccessful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5127 2021-11-16T13:56:39Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must special characters.<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) delivered as regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * '''Event and system logging''' Is enabled to automatically log unsuccesful login attempts, system events, user errors, etc. <br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4002 2021-11-16T13:52:37Z

<p>80.161.14.74: /* Event and system logging (recommended) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password policies (recommended) ===<br /> Password should have rules in order to prevent guessing<br /> * Requirements to length and complexity<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multifactor authentication (recommended) ===<br /> Two different options exist (choose one)<br /> * MFA using codes sent to the users mobile via SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Each entity can support the following <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR deletion policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and system logging (recommended) ===<br /> When Event and System Logging are turned on for an application, the following events are logged automatically: <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4001 2021-11-16T13:49:44Z

<p>80.161.14.74: /* GDPR deletion policies (optional) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password policies (recommended) ===<br /> Password should have rules in order to prevent guessing<br /> * Requirements to length and complexity<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multifactor authentication (recommended) ===<br /> Two different options exist (choose one)<br /> * MFA using codes sent to the users mobile via SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Each entity can support the following <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR deletion policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, enabling automatic deletion or anonymization in accordance with the specified rules. The application will thus automatically delete or anonymize data and files in the application, cf. specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and system logging (recommended) ===<br /> The following events will be logged automatically <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5126 2021-11-16T13:33:04Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must special characters.<br /> * '''Multi-factor authentication''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) delivered as regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * Event and system logging<br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5125 2021-11-16T13:32:46Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria: Minimum 8 characters, Must contain uppercase and lowercase letters, Must contain numbers, Must special characters.<br /> * '''Multi-factor authentication (SMS)''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) delivered as regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * Event and system logging<br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5124 2021-11-16T13:31:30Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * '''Multi-factor authentication (SMS)''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) delivered as regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * '''GDPR Deletion Policies''' In accordance with applicable data protection rules, archived data is automatically anonymized after 60 days. In order to ensure an independent fourth party, a written agreement has been entered into that the sub-data processor may not give LES users access to the server and backend.<br /> * Event and system logging<br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Security_setup&diff=4000 2021-11-16T13:28:39Z

<p>80.161.14.74: /* GDPR deletion policies (optional) */</p> <hr /> <div><br /> == Security baseline ==<br /> <br /> === Security by design ===<br /> The platform is security designed in accordance with [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf OWASP version 4]:<br /> * Level 2: Compliant<br /> * Level 3: +90% supported<br /> <br /> In addition the platform supports a wide range of security schemes and logging features, needed for support of ISO27001, ISAE3000 etc.<br /> <br /> The platform is subject to periodic penetration testing. Last customer testing was july 2021.<br /> <br /> ===Default security ===<br /> By default the Tempus Serva is verifiably secure to all common threat vectors, such as <br /> * SQL injection<br /> * Cross-Site Scripting<br /> * Session highjacking<br /> * Login replays<br /> * [https://owasp.org/www-project-top-ten/ etc]<br /> <br /> Protective measure includes common hardening efforts, such as<br /> * Data sanitization<br /> * Request throtling<br /> * CSRF tokens<br /> * [https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf etc]<br /> <br /> In addition to this baseline additional features can be activated per installation.<br /> * Built-in: Features in the product itself<br /> * External: Measures controlled in application server or operating system<br /> <br /> == Security built-in ==<br /> <br /> === Password policies (recommended) ===<br /> Password should have rules in order to prevent guessing<br /> * Requirements to length and complexity<br /> * Maximum number of tries<br /> <br /> '''How to:''' The polices can be changed in server configurations in the group ''Password policies''<br /> <br /> '''Note:''' The password polices will have no impact on SSO authentication<br /> <br /> === Multifactor authentication (recommended) ===<br /> Two different options exist (choose one)<br /> * MFA using codes sent to the users mobile via SMS<br /> ** You will need to create an account for sending SMS <br /> ** Cost is approx. 0,30 DKK per message)<br /> * MFA using af dedicated app from<br /> ** Apple<br /> ** Google<br /> ** Microsoft<br /> <br /> SMS requires very little of the users, while App based MFA is considered (slightly) more secure.<br /> <br /> '''Note:''' If using singlesignon (SSO) the MFA will not be used<br /> <br /> === Geolocation blocking (optional) ===<br /> Geoblocking will allow the servers to deny requests from certain countries.<br /> <br /> The geoblocking will match the clients IP against af Geo service. The county will be matched to the servers whitelist of country names.<br /> <br /> '''How to:''' Change the system configurations starting with ''ipBlocker''<br /> * Activate setting '''ipBlockerActive'''<br /> * Set allowed countries in ''' ipBlockerAllowedCountries'''<br /> <br /> === Request throttling (optional) ===<br /> As specified in OWASP v4 system should be able to limit the mount of request a user can carry out in a system.<br /> <br /> Limitations can be set on<br /> * Pages hit<br /> * WebDAV requests<br /> * Upload (size/count)<br /> * REST operations<br /> <br /> '''How to:''' Edit server configurations starting with ''limit''<br /> <br /> === Brute force prevention (optional) ===<br /> This protection is handled by not serving too many requests to the login page, regardless of the source in question.<br /> This will prevent brute force attacks on distributed accounts using multiple machines. In case the detection triggers, login requests will be ignored for at set amount of time, while allready logged in users can continue their work.<br /> <br /> '''How to:''' Define systems configurations starting with ''bruteforce''<br /> <br /> === Additional configurations ===<br /> * File whitelisting (uploadWhitelist)<br /> * OWASP compliance (owaspCompliance)<br /> <br /> == Security external ==<br /> <br /> === Virus scanning ===<br /> Scanning of uploaded fiels are left to software installed on the system.<br /> <br /> The upload feature will temporarily store the files on the file system, so that detection mechanisms can quarantine the files in case they are infected.<br /> <br /> === Storage encryption ===<br /> Storage encryption is normally supported by the underlying technologies, with the possible exception of password hashes (handled with BCrypt). <br /> <br /> MySQL (+8) supports multiple encryption schemes<br /> * The whole database<br /> * Single schema (each TS installation)<br /> <br /> Read more about encryption for [https://mysqlserverteam.com/controlling-table-encryption-in-mysql-8-0/ MySQL] and [https://mariadb.com/kb/en/data-at-rest-encryption-overview/ MariaDB]<br /> <br /> O/S level encryption technology includes<br /> * Windows: BitLocker<br /> * Linux: LUKS<br /> <br /> === Transport encryption (https) ===<br /> Minimum requirements are SSL certificates. On Linux these can easily be obtained for free via LetsEncrypt.<br /> <br /> Optionally the server can also apply to HSTS, using the following [https://www.javaprogramto.com/2018/09/adding-http-strict-transport.html guideline for Tomcat].<br /> <br /> === Denial of service attacks ===<br /> Protection against DOS attacks are best handled using dedicated services such as Cloudflare.<br /> <br /> == Compliance built-in ==<br /> <br /> === Activity and data logging (optional) ===<br /> Each entity can support the following <br /> * Access log: User that has edited or viewed an item <br /> * Status log: History of items time spent in each step<br /> * Change log: Copy of old data along with timestamp and user that has changed the item (see below)<br /> <br /> '''How to:''' Each option is activated on the entity Advanced page.<br /> <br /> '''Pro tip:''' Especially the status log can be used for setting up performance charts on dashboards, as it can give detailed information of how much time was spent in each step.<br /> <br /> === Versioning (optional) ===<br /> By default file versioning is supported on document fields.<br /> <br /> In addition data revisions can be supported on each individual entity.<br /> <br /> '''How to:''' Data revisions is activated on the entity Advanced page.<br /> <br /> === GDPR deletion policies (optional) ===<br /> For each entity in a TS Application, a GDPR Deletion Policy can be set up, which enables automatic deletion in accordance with the specified deletion policy. The application will automatically delete or anonymize data and files in the application based on the specified criteria.<br /> <br /> '''How to:''' <br /> # Set up an action on a entity status<br /> # Check of deletion policy<br /> # Choose between anonoumization or deletion<br /> # Optionally select log data to also be deleted<br /> <br /> In case you choose &quot;anonoumization&quot; you should define how each field should be handled<br /> # Click on a field<br /> # Click on Assignment<br /> # Check of anoumization<br /> # Optionally set value after change<br /> <br /> === Event and system logging (recommended) ===<br /> The following events will be logged automatically <br /> * User logins<br /> ** Succesfull normal user logins are hidden<br /> ** Also contains client IP (used for MFA)<br /> * System events<br /> ** User errors<br /> ** Scheduled services<br /> ** Administrator logins<br /> <br /> Error events will include stacktraces if available.<br /> <br /> The eventlog can be cleaned automatically on a regular schedule.<br /> <br /> == Compliance external ==<br /> <br /> === Request logging ===<br /> The webserver itself can be set up to do make detailed logs in file , containing for example<br /> * Request timestamp, IP and session ID<br /> * Stacktraces on errors<br /> <br /> Depending on your security setup you might want to log these to a central repository</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5123 2021-11-16T13:24:46Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * '''Multi-factor authentication (SMS)''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a randomized, session-specific OTP (One-Time-Password) delivered as regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5122 2021-11-16T13:22:18Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * '''Password policy''' The enabled policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * '''Multi-factor authentication (SMS)''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a session-specific One-Time-Password delivered as regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5121 2021-11-16T13:21:50Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * Password policy - The enabled policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * '''Multi-factor authentication (SMS)''' Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a session-specific One-Time-Password delivered as regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * '''Scrubbing of files''' All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5120 2021-11-16T13:21:05Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * Password policy - The enabled policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * '''Multi-factor authentication (SMS)''' - Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a session-specific One-Time-Password delivered as regular or Flash SMS, to verify the user’s identity.<br /> * '''Storage encryption (AWS + LUKS)''' - Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * '''Encryption During Transmission''' - Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * '''Scrubbing of files''' (personally identifiable meta-data) -<br /> All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5119 2021-11-16T13:20:07Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * Password policy - The enabled policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * Multi-factor authentication (SMS) - Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a session-specific One-Time-Password delivered as regular or Flash SMS, to verify the user’s identity.<br /> * Storage encryption (AWS + LUKS) - Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * Encryption During Transmission - Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * Scrubbing of files (personally identifiable meta-data)<br /> All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5118 2021-11-16T13:19:03Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * Password policy: The enabled policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * Multi-factor authentication (SMS)<br /> Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a session-specific One-Time-Password delivered as regular or Flash SMS, to verify the user’s identity.<br /> * Storage encryption (AWS + LUKS)<br /> Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * Encryption During Transmission<br /> Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * Scrubbing of files (personally identifiable meta-data)<br /> All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5117 2021-11-16T13:18:30Z

<p>80.161.14.74: /* Password policy */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * Password policy <br /> The enabled policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * Multi-factor authentication (SMS)<br /> Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a session-specific One-Time-Password delivered as regular or Flash SMS, to verify the user’s identity.<br /> * Storage encryption (AWS + LUKS)<br /> Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * Encryption During Transmission<br /> Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * Scrubbing of files (personally identifiable meta-data)<br /> All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5116 2021-11-16T13:18:03Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> = Password policy =<br /> The enabled policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * Multi-factor authentication (SMS)<br /> Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a session-specific One-Time-Password delivered as regular or Flash SMS, to verify the user’s identity.<br /> * Storage encryption (AWS + LUKS)<br /> Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * Encryption During Transmission<br /> Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * Scrubbing of files (personally identifiable meta-data)<br /> All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5115 2021-11-16T13:17:37Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * Password policy<br /> The enabled policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * Multi-factor authentication (SMS)<br /> Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a session-specific One-Time-Password delivered as regular or Flash SMS, to verify the user’s identity.<br /> * Storage encryption (AWS + LUKS)<br /> Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * Encryption During Transmission<br /> Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * Scrubbing of files (personally identifiable meta-data)<br /> All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5114 2021-11-16T13:17:18Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * Password policy<br /> The enabled policy forces users to create passwords based on the following minimum criteria:<br /> * Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * Multi-factor authentication (SMS)<br /> Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a session-specific One-Time-Password delivered as regular or Flash SMS, to verify the user’s identity.<br /> * Storage encryption (AWS + LUKS)<br /> Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * Encryption During Transmission<br /> Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * Scrubbing of files (personally identifiable meta-data)<br /> All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5113 2021-11-16T13:17:04Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * Password policy<br /> The enabled policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * Multi-factor authentication (SMS)<br /> Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a session-specific One-Time-Password delivered as regular or Flash SMS, to verify the user’s identity.<br /> * Storage encryption (AWS + LUKS)<br /> Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * Encryption During Transmission<br /> Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * Scrubbing of files (personally identifiable meta-data)<br /> All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74 https://wiki.tsnocode.dev/index.php?title=Whistleblower&diff=5112 2021-11-16T13:16:04Z

<p>80.161.14.74: /* Security setup */</p> <hr /> <div>== Application ==<br /> The LES Whistlebloaer Portal is fully managed by Tempus Serva Aps.<br /> <br /> The system supports the following roles and usecases<br /> * Lawyer: Handles whistleblower cases<br /> * Tenant user: Handles whistleblower cases <br /> * Whistleblower: Anonoumous users that creates new cases<br /> <br /> Whistleblower have the option to return to their case using a randomized code.<br /> <br /> == Hosting setup ==<br /> The LES Whistleblower Portal is hosted by Amazon Webservices EC2 in the data center in Stockholm, which complies with the following standards PCI DSS 3.2 Level 1 Service Provider, FIPS 140-2, ISO 27001. The server is protected by 2 layers of firewalls and utilizes the following supported services:<br /> <br /> * SSL certificates are automatically updated monthly from LetEncrypt<br /> * UptimeRobot polls the server each minute checking <br /> ** Access to database<br /> ** Sufficient storage and RAM<br /> * Database is dumped nightly <br /> ** Replicated to encrypted storage in EU<br /> ** Rentention daily 60 days, monthly 2 years<br /> * Office365 SMTP service for sending emails<br /> <br /> == Technology Stack ==<br /> The technological stack consists of:<br /> <br /> * LES Whistleblower Portal<br /> * TS No-code Platform <br /> * Apache Tomcat<br /> * MySQL<br /> * Amazon Linux 2<br /> <br /> == Security setup ==<br /> The following security and compliance features are enabled and active:<br /> * Password policies<br /> The enabled password policy forces users to create passwords based on the following minimum criteria:<br /> ** Minimum 8 characters<br /> ** Must contain uppercase and lowercase letters<br /> ** Must contain numbers<br /> ** Must contain special characters<br /> * Multi-factor authentication (SMS)<br /> Access to case management for attorney/lawyer at LES (ombudsman) and contact persons in the company, respectively, is protected with a username and password, followed by a session-specific One-Time-Password delivered as regular or Flash SMS, to verify the user’s identity.<br /> * Storage encryption (AWS + LUKS)<br /> Storage is encrypted with LUKS (Linux Unified Key Setup – 256-bit AES disk encryption). Thus, persons with physical access to hardware cannot access stored data.<br /> * Encryption During Transmission<br /> Communication is protected with SSL certificates and HTTPS (TLS). Numeric suites for HTTPS are continuously updated.<br /> * Activity and data logging<br /> * Versioning<br /> * GDPR deletion policies (anonymize after 60 days)<br /> * Event and system logging<br /> * Scrubbing of files (personally identifiable meta-data)<br /> All files uploaded via the portal are cleaned of personally identifiable meta-data such as name, initials, geotags, etc. LES Whistleblower Portal supports all common file formats, including: MS O ce files, PDF, image formats like PNG, JPG, BMP etc., as well as media files MP3 and MP4.<br /> <br /> <br /> Note that IP logging on server requests is disabled, in order to secure anonomity of the users.<br /> <br /> See [[Security_setup|Security setup]] for additional information on security and compliance features available on TS No-code Platform.</div>

80.161.14.74