Application & System Security
Application Access Control
Access to the application is controlled using various security settings based on users, roles and groups. To find out more about application-level security, please refer to users manual: Security
The application server is capable of handling user authentication internally, but can also use federated authentication services based on SAML, for example, corporate ADFS or Azure based SSO.
For more information on SSO, please refer to ADFS / AZURE / SAML Single Sign On
Internal User Management
Information for customers willing to use internal user database:
User password is stored in hashed "salted" form
The password is required to be passed over a secured connection
System provides brute force password crack prevention (the account is locked for 60 seconds after three failed attempts)
External user management
When external (federated) user management is used, the password is never passed to application server.
Full authentication process takes place within the external provider and only final result of the authentication is passed on to our system.
System Monitoring
All vital elements of the infrastructure are monitored. In case an abnormal situation is detected, a system support engineer is alerted and can take actions as quickly as possible.
Metrics being monitored include:
application availability in general
application server load (CPU load, number of processes, response time)
storage system (free space, load, availability)
database servers
network status
all other services used by the application server
System Log Management
Application server environment is using a log management system that gathers, filters and manages logs from application servers and other components of the system.
This allows us to identify any problems or abnormal operation quickly.
Antivirus protection
User files uploaded and stored in a file repository are scanned using a server installed anti-virus software.
E-mail server used for sending out notifications is using an email scanner anti virus software to eliminate the risk for spreading infected files through e-mails.
Application Server Security Patching
Security updates installed once a week, if a critical security update is released it is installed as soon as possible
Updates are installed and tested in a staging environment before installing to production servers