Skip to main content

Security

Application security​

From an application point of view, MyTower manages application security on three aspects: Web security (verified with penetration tests), authentication security (SSO, password management) and source code security (verified by static source code analysis)

Web security​

Our solutions are checked against the most common risks and vulnerabilities, as recommended by OWASP.

Our Cybersecurity Department conducts periodic penetration tests and verifies, among other things:

  • SQL injection attacks

  • Cross Site scripting (XSS)

  • Authentication attacks

  • Authorization attacks

  • Customer-side attacks

  • Information disclosure attacks

  • Logical attacks

  • JavaScript and ajax attacks

  • Denial of Service

  • Brute force attacks

  • Abusive file download

The services exposed by the MyTower apps are all encrypted in transit with TLS 1.3 (HTTPS and SFTP).

Authentication security​

For authentication security, the MyTower recommendation is to delegate authentication to the customer's SSO systems (see Single Sign-On below).

In the event that the customer does not wish to use the SSO, a MyTower password management policy applies. This policy is available on request.

Source code security​

MyTower uses SonarQube to perform code security scans at each commit. Sonar's remarks block the merge of the commits, so a correction of these remarks is necessary before the merge of the code in question is done.

Infrastructure security​

The following security measures are applied to the infrastructure:

  • Access

    • Isolation of infrastructure (masters and workers) in private network (VPC, see paragraph on infrastructure).

    • Access only to the Kubernetes master API. Named access for authorized persons only. This is the access that allows application deployment.

  • Hardening

    • SSH access is not authorized to the masters and workers from the WAN network

    • The only flows allowed on the workers are the flows needed for the operation of kubernetes.

  • OS:

    • SECURITY at the OS level is managed by the Scaleway. All OS patches are managed by the host.

    • Antivirus: BitDefender antivirus is installed on different nodes and managed by the hosting provider.

Single Sign-On (SSO)​

MyTower supports connectivity on customers' SSO systems. This connectivity will allow:

  • Automatic user creation in MyTower

  • Authentication of customer users in MyTower using their credentials in customer systems.

  • Delegate authentication security to the Customer: complexity/periodicity of passwords, multi-factor authentication, etc.

This connectivity can be either via SAML2 (Security Assertion Mark-up Language) or OIDC (OpenID Connect). MyTower supports both modes.

The customer takes the role of an SSO (Identity Provider or IdP) provider and MyTower the role of a Service Provider (SP).