Security at Basecone, an ongoing project

Welcome back again. It has been a while since last announcement of ‘Improvement Fridays’, my last entry in this blog,

As well as then, I would like to get a few minutes of your attention in order to explain you a bit more about security and how we handle it here in Basecone. We know it is important for you and so it is for us too.

First of all, tell you that we take Security very serious here in Basecone. But Security is not about brick-proving our servers and storages or double-firewalling every single entry point in our environment, it goes far beyond that.

Following is a conversation between one of our customers and me.

Hello Daniel, this is Mr Doe, head of ICT at XXX. I am contacting you in regards Security at Basecone.

Hello Mr. Doe. Well, let me explain you: Security at Basecone starts with you and with your organization. Most studies on security acknowledges that bad practices in password storage management within organizations lead to security breaches. Please, keep your username and passwords for yourself. Do not share it with your co-workers, If you require more logins, don’t hesitate and contact us. You would never write the address of your house in your keychain, hence, don’t leave a sticky note in your computer with your login details.

Thank you! We will contact your support dept. for the necessary logins for our organization.

Great! Well done. Now that we have all of you now login with your unique user credentials, and you guys are keeping your passwords secure – if you need more help with this, contact us, we can recommend you tools and practices to secure your passwords but for sure your IT organization can help you in this too. Ask them! Sure they like to hear your concerns on security. They worry as much as we do.

(silence)…

Ok, so now you are ready to log into Basecone.

How is security involved in this process?

Very good question. Let me explain a bit….
Let’s see our login page: https://identity.basecone.com

First of all, pay attention to the URL of your login screen, https://identity.basecone.com. We call it “identity” but that’s just a name, the important part is the S in the protocol (HTTPS). It stands for Secure. In the moment the login form loads, the content of the password field is encrypted at input level. You input a character, it gets masked. In the moment you click the Login button, all the information in the login form is encrypted first and then transmitted to our servers. The Inspector Tool from any browser (google chrome in this case) will tell you the security level of the connection, have a look to it.

Aha…

VSo, now you are securely connected to Basecone. All the information from your computer to Basecone goes over an end-to-end protected tunnel (https)

How is the security from this point onwards?

Again, very good question! I’m starting to wonder how precise your questions are… Our entry point https://identity.basecone.com resides in an AWS Elastic Load Balancer (ELB).

AWS?

Yes, you didn’t notice yet? We are a cloud company and AWS is our cloud provider.

Wow! I didn’t know. So? Is AWS secure? How is Security handled in AWS?

Oh my! I like your curiosity, let me explain a bit of it. Back in the days of the Datacentres, your DC should be certified to ensure customers that everything within the premises of the DC is secure. Nowadays in the Cloud Computing era, datacentres are not visible to customers anymore and Cloud providers do a big effort to ensure everything is secured. They have a million certifications and compliances in place, they can be seen in their website, here is the link for AWS but the best way is to see this image (extracted from their website)

Ah! Ok, Good to know! And… Elastic Load Balancer means?

Okay, let’s carry on…

Elastic? The Term Elastic comes from the capacity to adjust to traffic demands, this means that depending on the demand of https://identity.basecone.com the entry point adjust sizes to fit our customer’s demand.

Load Balancer? Indeed, it balances the requests incoming into https://identity.basecone.com between our frontend servers, the ones that serve our Websites and APIs. It is covered by the “Networking” box in the diagram above. This gives us out of the box security settings like DDoS protection, SSL Security Protocols, Cyphers and Options, but, not only that! We also get them updated and patched automatically by AWS, so we cannot miss it. Thank you AWS Security Engineers, you are doing good job.

Ok, so, for me to recap… From my office to your servers, all traffic goes in a kind of isolated tunnel that has a Security Guard in the door.

Yes, that is correct!

But, I’ve seen security guards that sleep during office hours and don’t really pay attention to who enters or who does not. Is this kind of Security Guard the one you have?

Luckily, this is a process and not a person, so, it does not sleep.

Umm… And should I be worried about any other entry point? Do you have security guards in the windows? Or in the backyard door?

I see your concern, yes, we do have security guards in the backyard door, aka the management entry point. There is a MUST to establish a VPN secure connection tunnel (from a well-known place to our backdoor address) to access the lock on the backyard door. Still, you need to have the key. So, there are 3 levels of security at our backyard. A valid VPN connection (from a well-known place to our backdoor address) where to reach the key lock, and the key itself.

Ok, now I’m confident that, technically nobody unknown to the company can gain access to your backdoor. but… what else?

Well, as you well pointed, technically nobody unknown to the company can gain access to your backdoor and because we are a 100% Cloud Based, everything happens within the safety of AWS, so, nothing leaves it, nothing enters in it.

Ok, but what about the data? You have a database behind the scenes, don’t you? And Storage? Where are all our files stored? What is the security for that storage service?

Yes, we do have a Database behind the scenes… in fact we have a few not only one. We utilise a complex Data Model represented in it. Only a select number of employees have access to these databases, temporary access can only be granted by our CEO.

Only one access route is granted to talk to the database. Its like a firewall, only server A can talk to server B, if it comes from somewhere else it simply gets lost.

Ok, so Database Access is secured and under control. What about backups or the storage?

We are very strict in those two items. We do run (in a daily bases) full Database Backups and full Restore. Our process is tested daily. Until now, I have not seen any problems with it. We can sat its a very robust process and I’m proud of it.

That satisfies me for now in terms of data integrity, but, what if the DB server breaks down? How are you going to extract the data on it?

 

For storage we have even a more strict procedure. By making use of the AWS API, we trigger the creation of an image of the storage drives for the database (and file server) We take snapshots in a 4h basis. It is a fully automated process and AWS guarantees us we can reattach the snapshot in any other machine/database/fileserver. Also, as this is AWS Storage we are fully covered by their certifications. We are confident in it.

So, you mentioned a File Server, tell me more about the security of it.

Basically it is under the same service level agreement as our database. Access to it must be granted by our Director, it is a temporary access in case any incident happens, never permanent. In terms of HDD, we also follow the same practices, we take HDD snapshots in a 4h basis and because it is AWS Storage we are fully covered by their certifications. We also are confident in it.

So, it seems you have some control over the topic. Glad to hear that. I think I need to sleep over all the information you have told me, Can I contact you in the future if I have any more questions?

Yes, of course. Do not hesitate, I understand the complexity of the subject and all the concerns that It raises, so, please, do not hesitate and contact me.

Thanks very much.

You are welcome.

If you ever feel the need to have such conversation with me, do not hesitate and leave a message in the blog. I will be happy to reply to you.