Security of your web applications
Developing a secure application requires engineers to take into account security issues while designing the application. The development process then integrates all the required security processes to successfully implement and enforce the security policy.
In order to achieve an optimum level of quality, we can offer a complete analysis of your security needs: which need? Which security policy: DAC, RBAC ? ... Based the formalization of this policy, we will then accompany you throught its implementation.
Regarding PHP solutions, we can also offer you an analysis of your solutions to validate the security of the information flows (internal flows, AJAX, .. ). Our methodology relies on in-house tools and open source tools like Spike, and PHPSecInfo PHPSecurityScanner.
Security of your web services
To ensure maximum security, we offer you not only the functional configuration of the servers (physical and software) but also the configuration of their security. This second configuration consists in several levels.
First, we propose the implementation of a security policy that aims at isolating the server applications, either by isolation at the process (a process by different user with limited privileges) or isolation software (chroot). Thus, each applicative server is seen as an independent entity. This lowers the risks of the propagation of an attack.
Second, we propose the implementation of a security policy on the server, including defining security policies on the inbound and outbound requests. This second configuration lowers the risk of an attack by blocking entry points of the server (ports) or limiting access to predefined addresses. To do this, we personalize iptables.
Third, we offer a "traffic monitoring" solution that allows you to get a daily report of the network traffic, simplified and clear. Thanks to this tool, we can offer you a real-time monitoring with automatic and instant alerts and real-time management of the critical ones.
Security of your data
Adding security mecanism to your applications may sometimes, however, not be sufficient. Attacks may occur at other levels such as the physical level (destruction, theft) with direct attacks, or at the network and servers level (DDOS, ...). To ensure the security of your data, it is then also essential to ensure a daily automated backup of your data. This let you easily counter any attack (destruction, removal, compromise), but this also let you deal with other contingencies (hardware failure, network failure, ...).
To guarantee this level of safety and security, we implemented
- a tool which provides you with automatic and daily backups of your database
- an interface which allows you to easily recover those backups
- a tool which performs a daily reminder inviting you to download these backups
- a fully adapted interface and configurable
- a tool which performs incremental backups of your data (for example appendices directories for Drupal)