Security guidelines for Expertiza: Difference between revisions

From Expertiza_Wiki
Jump to navigation Jump to search
No edit summary
No edit summary
Line 19: Line 19:
====Adding encryption to an Expertiza model====
====Adding encryption to an Expertiza model====
Encryption in Expertiza uses the security module of Expertiza, so you must require the security module before you can add encryption to a model.
Encryption in Expertiza uses the security module of Expertiza, so you must require the security module before you can add encryption to a model.
  class Team < ActiveRecord::Base
    require 'expertiza_security'

Revision as of 15:19, 2 May 2018

Security Guidelines

Web applications such as Expertiza present a complex set of security issues for users, designers, and developers. The most secure and hack-resilient Web applications are those that have been built from the ground up with security in mind.

In addition to applying sound architectural and design practices, incorporate deployment considerations and corporate security policies during the early design phases. Failure to do so can result in applications that cannot be deployed on an existing infrastructure without compromising security.

This guideline presents a set of secure architecture and design guidelines we have followed to ensure that Expertiza is designed with security at it's core.


Security Upgrades

Each of the security upgrades covered in this section contribute to the end goal of a more secure Expertiza.

Encryption

A lot of information stored in the Expertiza database is personally identifiable. Expertiza now implements transparent encryption of the data at rest to ensure that a comprise of the actual database or data leak does not yield any useful information to the adversary. This satisfies Expertiza's security goal of ensuring confidentiality.

Encryption can simply be added to any model by calling a new method provided by Expertiza's security module. Before implementing encryption, a few considerations will have to be made. The attributes that have to be encrypted have to be a string to text type, since the output of any encryption method is an encrypted text block. To encrypted numerical, time or other attributes, the attributes must be converted to string before being stored in the database and converted to the appropriate type in Rails.

Adding encryption to an Expertiza model

Encryption in Expertiza uses the security module of Expertiza, so you must require the security module before you can add encryption to a model.


 class Team < ActiveRecord::Base
   require 'expertiza_security'