Security guidelines for Expertiza

Security Guidelines

Web applications such as Expertiza present a complex set of security issues for users, designers, and developers. The most secure and hack-resilient Web applications are those that have been built from the ground up with security in mind.

In addition to applying sound architectural and design practices, incorporate deployment considerations and corporate security policies during the early design phases. Failure to do so can result in applications that cannot be deployed on an existing infrastructure without compromising security.

This guideline presents a set of secure architecture and design guidelines we have followed to ensure that Expertiza is designed with security at it's core.

Security Upgrades

Each of the security upgrades covered in this section contribute to the end goal of a more secure Expertiza.

Encryption

A lot of information stored in the Expertiza database is personally identifiable. Expertiza now implements transparent encryption of the data at rest to ensure that a comprise of the actual database or data leak does not yield any useful information to the adversary. This satisfies Expertiza's security goal of ensuring confidentiality.

Encryption can simply be added to any model by calling a new method provided by Expertiza's security module. Before implementing encryption, a few considerations will have to be made. The attributes that have to be encrypted have to be a string to text type, since the output of any encryption method is an encrypted text block. To encrypted numerical, time or other attributes, the attributes must be converted to string before being stored in the database and converted to the appropriate type in Rails.

Adding encryption to an Expertiza model

Encryption in Expertiza uses the security module of Expertiza, so you must require the security module before you can add encryption to a model.

 class Team < ActiveRecord::Base
   require 'expertiza_security'