Data Security
For the network security of the application, we enforce the following standards.
Virtual Private Network(VPN) + Jump Host( Bastion Host) Based Server Maintenance (Cluster Management Shell ) to enhance security. Reverse Proxying all network traffic to mask origin IP to enhance security. Apart from the above rules, additional measures could be added to enforce maximum security of data
Web Application Firewall (WAF) Configured at Domain level to prevent access to coronasafe.network from countries like US, China, Hongkong, Pakistan, Russian Federation Etc
Open Web Application Security Project (OWASP) core rule set based WAF rules implemented to protect common attack categories, including Structured Query Language (SQL) Injection and Cross-Site Scripting.
Customized WAF rules created to prevent common attacks and Bot Access
Autonomous system number (ASN) based lockdown in WAF against common threat matrix.
Sanity Check Based Block and Rate Limiting Enabled
Network-level Port Blocking allowing only ports 80 and 443 from the internet in the entire network
IP blacklist and lockdown based on Threat Score ( Score Greater than 8 is blocked) based on IP reputation.
Customized Content Security Policy (CSP) Header implemented to prevent common Clickjacking and other attacks.
HTTP Strict Transport Security (HSTS) preloaded domain-wide to enforce Hypertext Transfer Protocol Secure (HTTPS) only traffic with a Max-Age of 1 year
Origin to a domain, domain to domain, and domain to User traffic encrypted via Transport Layer Security 1.2 (TLS1.2) and above
Content Security Policy (CSP) and Certificate Transparency CT violations monitoring done to update threat matrix
The Domain Name System Security Extensions (DNSSEC) enabled to prevent domain takeovers. (DNSSEC protects against forged domain name system (DNS) answers. DNSSEC protected zones are cryptographically signed to ensure the DNS records received are identical to the DNS records published by the domain owner.)
Speed up of page load speed by the Implementation of Brotli Compression
HTTP/2 and HTTP/3(Quick User Datagram Protocol Internet Connections) enabled for faster network speeds
Automatic Branch-based Continuous integration (CI) and continuous delivery (CD) to prevent unauthorized access.
New pods are created before old pods with old code are terminated.
Database backups (Snapshots) are created daily at scheduled intervals and stored with Key Management Service (KMS) keys securely inside Cloud Infrastructure without external Access.
All Server Nodes, Volumes, and Database Instances are Encrypted with KMS-based Cryptographic Keys.
Database Connectivity allowed only using internal Private Network and allowed for the backend host only.
Last updated