8.1 Security Principles
- Confidentiality: data is protected from unauthorised access.
- Integrity: data is protected from unauthorised modification.
- Availability: data is accessible when needed.
- Authenticity: data origin and identity are verified.
- Non-repudiation: actions cannot be denied.
8.2 Architecture Layers
- Application: input validation and sanitisation, output encoding, error handling, secure coding.
- Data: AES-256 encryption at rest, secure key storage, database access control, audit logging.
- Network: TLS 1.3 in transit, certificate pinning, secure API design, rate limiting and DDoS protection.
- Infrastructure: secure configuration, access control, monitoring and alerting, incident response.
8.3 Encryption Standards
| Data State | Algorithm | Key Size | Standard |
|---|---|---|---|
| At Rest | AES | 256-bit | FIPS 140-2 |
| In Transit | TLS | 256-bit | TLS 1.3 |
| Backups | AES | 256-bit | FIPS 140-2 |
8.4 Access Control
- Role-based access control (RBAC).
- Principle of least privilege.
- Multi-factor authentication (optional).
- Session management and audit logging.
8.5 Monitoring & Logging
Real-time security monitoring, intrusion detection, log aggregation and analysis, alert mechanisms, and incident response procedures are maintained.
8.6 Vulnerability Management
We carry out regular vulnerability scanning, penetration testing, secure code review, dependency management, and patch management.
8.7 Incident Response
Our process covers detection and reporting, investigation and containment, eradication and recovery, and post-incident review with continuous improvement. See Section 10 for full detail.