Skip to main content

Our Security Cheatsheet

Introduction​

This document provides you with a comprehensive security recommendations checklist. We follow these guidelines and expect our 3rd party integrators to do the same. These guidelines cover various aspects of security including network, endpoint, data, identity and access management, application, and incident response. Adherence to these recommendations will help mitigate security risks and ensure compliance.

General Best Practices​

  • Regular Updates: Ensure all systems, applications, and devices are regularly updated with the latest security patches.
  • Backups: Implement regular data backup procedures and store backups in secure, off-site locations.
  • User Training: Conduct regular security awareness training for all employees to recognize phishing, social engineering attacks, and other common threats.
  • Security Policies: Establish and enforce comprehensive security policies and procedures.

Network Security​

  • Firewalls: Deploy firewalls to monitor and control incoming and outgoing network traffic.
  • Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS): Use IDS/IPS to detect and prevent unauthorized access to the network.
  • Virtual Private Networks (VPNs): Use VPNs to secure remote access to the network. Segmentation: Segment the network to limit access to sensitive data and systems to only those who need it.

Endpoint Security​

  • Antivirus and Anti-malware: Install and maintain up-to-date antivirus and anti-malware software on all endpoints.
  • Encryption: Encrypt sensitive data on endpoints, especially mobile devices and laptops.
  • Device Management: Implement mobile device management (MDM) solutions to control and secure mobile devices.
  • Patch Management: Regularly update endpoint operating systems and applications to protect against vulnerabilities.

Data Security​

  • Data Encryption: Encrypt data at rest and in transit using strong encryption protocols.
  • Access Controls: Implement strict access controls to ensure only authorized personnel can access sensitive data.
  • Data Loss Prevention (DLP): Use DLP solutions to monitor and protect data from unauthorized access and exfiltration.
  • Data Classification: Classify data based on its sensitivity and apply appropriate security measures to each classification level.

Identity and Access Management​

  • Multi-Factor Authentication (MFA): Implement MFA for all user accounts to add an additional layer of security.
  • Password Policies: Enforce strong password policies, including complexity requirements and regular password changes.
  • Least Privilege: Apply the principle of least privilege, ensuring users have the minimum level of access necessary for their roles.
  • Regular Audits: Conduct regular audits of user accounts and permissions to detect and remove unnecessary access.

Application Security​

  • Secure Development: Follow secure coding practices and conduct regular code reviews and security testing.
  • Vulnerability Management: Regularly scan applications for vulnerabilities and apply patches promptly.
  • Web Application Firewalls (WAF): Use WAFs to protect web applications from common attacks such as SQL injection and cross-site scripting (XSS).
  • API Security: Secure APIs by using authentication, authorization, and input validation.

Incident Response​

  • Incident Response Plan: Develop and maintain an incident response plan to handle security breaches effectively.
  • Regular Drills: Conduct regular incident response drills to ensure preparedness.
  • Monitoring and Logging: Implement continuous monitoring and logging to detect and respond to security incidents in real-time.
  • Forensics: Have procedures in place for digital forensics to investigate and understand security incidents.

Compliance and Auditing​

  • Regulatory Compliance: Ensure compliance with relevant laws and regulations, such as PDA and PCI-DSS.
  • Regular Audits: Perform regular security audits and assessments to identify and address vulnerabilities.
  • Documentation: Maintain thorough documentation of security policies, procedures, and incidents.

Last updated on 19 May 2024