Applicable plans:
| The free plan | The complete plan | On-demand plan |
|---|---|---|
 |  |  |
This article describes the internal security processes in place at Waldo. |
As described in our architecture diagram, the Waldo app relies on Microsoft technologies. Our development processes are tightly integrated with Azure DevOps. In this article, we will outline the measures we have taken to ensure the security of our DevOps environment.
1 - Endpoint Security Measures
All endpoints, including developer workstations, are configured with Multi-Factor Authentication (MFA) to prevent unauthorized access, even if credentials are compromised.
Users are required to create and regularly update strong, complex passwords, reducing the risk of brute-force attacks.
All endpoint devices are equipped with BitLocker encryption, ensuring that data is protected in the event of device theft or loss.
We deploy Microsoft Defender for Endpoint Protection on all endpoints to provide real-time protection against malware, viruses, and other security threats.
Automatic updates are enabled to keep operating systems and software applications up-to-date with the latest security patches and fixes.
2 - Azure Security Measures
We use Microsoft Defender for Cloud to protect our cloud workloads on Microsoft Azure.
Azure Web Application Firewall (WAF) is employed to protect web applications from common web-based attacks, including SQL injection and cross-site scripting (XSS) attacks.
We leverage Azure Application Insights to gain visibility into the performance and behavior of our applications, helping us identify and resolve issues promptly.
Azure Sentinel serves as our centralized security information and event management (SIEM) solution. It collects and analyzes security data from multiple sources, allowing us to detect and respond to security incidents effectively.
3 - Continuous Monitoring and Incident Response
We enable Azure's extensive logging capabilities, collecting logs from endpoints, applications, and Azure services to monitor for suspicious activities.
A comprehensive incident response plan is in place, defining roles and responsibilities for handling security incidents. Our team is trained to respond swiftly and effectively.
4 - User Awareness and Training
Our team undergoes regular security training to stay informed about the latest threats and best practices.
We foster a security-aware culture where employees are encouraged to report security concerns and follow established security protocols.
5 - Secure Code Practice
We integrate code scanning tools into our Azure DevOps pipelines to identify and remediate security vulnerabilities in the application code during the development process.
All code changes are digitally signed to verify the authenticity and integrity of the code.
Sensitive data such as API keys, passwords, and connection strings are stored securely in Azure Key Vault, reducing the risk of exposure in the DevOps environment.
We ensure that Azure DevOps pipelines are configured securely, with restricted access and strong authentication, preventing unauthorized changes to the deployment process.
6 - Development stages
Our software development process is divided into three critical stages: Developer, Validation, and Production. Each stage serves a distinct purpose, and security considerations are integrated into every phase.
In the Developer Stage, our development teams work on coding, testing, and refining new features and improvements.
Secure coding practices are emphasized, and regular code reviews are conducted to identify and address security vulnerabilities at an early stage.
Sensitive or production data is never used in this environment, ensuring data privacy and security.
Validation is a crucial testing environment where we validate new features and conduct extensive testing before deploying to the production environment.
Access to Validation resources is strictly controlled, and user permissions are limited to only those required for testing.
In the Production Stage, our application is live and serving users. Any changes made here are critical and must undergo rigorous testing.
Changes are implemented using a well-defined change control process, ensuring that only approved and thoroughly tested updates are deployed.
7 - Feature flags and hotfixes
Feature flags, also known as feature toggles, play a significant role in our development process. They allow us to enable or disable specific features or functionalities within our application, even in the Production Stage. This approach enhances our ability to manage security and mitigate risks effectively.
Feature flags enable us to roll out new features gradually, reducing the risk of potential security issues affecting all users simultaneously.
In the event of a security vulnerability or unexpected issue, we can immediately disable a feature at the flick of a switch, ensuring swift mitigation.
Feature flags also support A/B testing, allowing us to assess the security impact of different feature variations in real-world scenarios.
We can deploy emergency hotfixes by toggling off problematic features without a full application redeployment.
8 - Backup and restore process.
Every day, a backup job runs to identify and back up only the data that has been modified or added since the last backup (incremental backup).
On a weekly basis (every Friday night), a full backup job runs to capture all data within the defined backup scope. This backup provides a baseline for restoring data in case of a catastrophic failure.
Once a month, a backup restore testing procedure is executed to ensure that backup data can be successfully restored.
This testing includes restoring both incremental and full backups to verify their completeness and accuracy.
Any issues or inconsistencies discovered during testing are addressed promptly to maintain the reliability of backups.