Security & Compliance
Office Security Best Practices
The Australian Signals Directorate (ASD) “Essential Eight” is a set of baseline cybersecurity strategies to mitigate cyber threats in an organisation. These recommendations are designed to provide effective, prioritized guidance to enhance their security posture of a business.
Our development studio and procedures are currently compliant with Level One of the Australian Signals Directorate Essential Eight recommendations. We’re actively improving and investing in our development environment to achieve compliance with higher levels of this security framework.
The Essential Eight consists of the following strategies:
APPLICATION WHITELISTING:
Only allow approved applications to execute on systems to prevent unauthorized or malicious software from running.
CONFIGURE MICROSOFT OFFICE MACRO SETTINGS:
Configure Microsoft Office to block macros from the internet, and only allow vetted macros either in ‘trusted locations’ with limited write access or digitally signed with a trusted certificate.
PATCH APPLICATIONS:
Regularly update and patch applications to address vulnerabilities that attackers may exploit.
Essential Eight
USER APPLICATION HARDENING:
Configure web browsers and Microsoft Office to block malicious websites and macros, ensuring the secure configuration of PDF viewers.
RESTRICT ADMINISTRATIVE PRIVILEGES:
Restrict administrative privileges to essential users only to prevent unauthorised access and reduce the impact of successful attacks.
MULTI-FACTOR AUTHENTICATION:
Implement multi-factor authentication for all users, particularly for remote access to critical systems, to enhance authentication security.
PATCH OPERATING SYSTEMS:
Regularly update and patch operating systems to address vulnerabilities and minimize the risk of exploitation.
DAILY BACKUPS:
Regularly back up important data and ensure backups are stored securely offline to facilitate recovery in case of data loss or ransomware attacks.
Application Development Security Standards
Modern applications require security awareness at the code, infrastructure, and runtime levels to ensure deployed applications are hardened against all potential attack vectors. Gemma is designed and developed closely following the Guidelines for Software Development chapter of the Information Security Manual (ISM) published and updated by the Australian Signals Directorate (ASD). The ISM is considered the Intelligence Services Act 2001-designated best practices document of the Australian Signals Directorate (ASD). You can access the full text of ISM from this link.
Below is the summary list of each specific guideline and the current state of our development practice, software code and infrastructure with respect to compliance with that guideline. CLICK on each item for further details.
Control: ISM-0400; Development, testing and production environments are segregated. Compliant
Technologies Used : Azure App Configuration – Separated SQL Servers – App Service (Different Deployment Slots)
Control: ISM-1420; Data from production environments is not used in a development or testing environment unless the environment is secured to the same level as the production environment. Compliant
Use of different SQL servers for development and production environment data bases
Control: ISM-1816; Unauthorised modification of the authoritative source for software is prevented. Compliant
Access to the software’s source code is restricted to developers with authorisation and protected by multi tier security credential checks both at the work station and version control domains.
Control: ISM-1422; Unauthorised access to the authoritative source for software is prevented. Compliant
Access to the software’s source code is restricted to developers with authorisation and protected by multi tier security credential checks both at the work station and version control domains.
Control: ISM-0401; Secure-by-design and secure-by-default principles, use of memory-safe programming languages where possible, and secure programming practices are used as part of application development. Compliant
C# is recognised by the standard as a qualified language for compliance with this requirements. Use of Blazor front end technologies allows utilisation of C# for Gemma’s entire front end development.
Control: ISM-1780; SecDevOps practices are used for application development. Progressing
Control: ISM-1238; Threat modelling is used in support of application development. Progressing
Control: ISM-1796; Files containing executable content are digitally signed as part of application development. Progressing
Control: ISM-1798; Secure configuration guidance is produced as part of application development. Compliant
Control: ISM-1730; A software bill of materials is produced and made available to consumers of software. Progressing
Control: ISM-0402; Applications are comprehensively tested for vulnerabilities, using both static application security testing and dynamic application security testing, prior to their initial release and any subsequent releases. Progressing
Control: ISM-1616; A vulnerability disclosure program is implemented to assist with the secure development and maintenance of products and services. Compliant
Our Vulnerability Disclosure Policy can be accessed from Legal page.
Control: ISM-1755; A vulnerability disclosure policy is developed, implemented and maintained. Compliant
Our Vulnerability Disclosure Policy can be accessed from Legal page.
Control: ISM-1756; Vulnerability disclosure processes, and supporting vulnerability disclosure procedures, are developed, implemented and maintained. Compliant
Our Vulnerability Disclosure Policy can be accessed from Legal page.
Control: ISM-1717; A ‘security.txt’ file is hosted for all internet-facing organisational domains to assist in the responsible disclosure of vulnerabilities in an organisation’s products and services. Compliant
Our security.txt can be accessed from the following link;
Control: ISM-1909; In resolving vulnerabilities, software developers perform root cause analysis and, to the greatest extent possible, seek to remediate entire vulnerability classes. Compliant
Control: ISM-0971; The OWASP Application Security Verification Standard is used in the development of web applications. Progressing
Control: ISM-1849; The OWASP Top Ten Proactive Controls are used in the development of web applications. Progressing
Control: ISM-1850; The OWASP Top 10 are mitigated in the development of web applications. Progressing
Control: ISM-1239; Robust web application frameworks are used in the development of web applications. Compliant
Use of Microsoft ASP.NET web application framework and associated underlying technologies
Control: ISM-1552; All web application content is offered exclusively using HTTPS. Compliant
HTTPS is enforced at public and portal access level of the web application and all general and support websites. Azure App Services servers configured for mandatory use of HTTPS for all application instances.
Control: ISM-1851; The OWASP API Security Top 10 are mitigated in the development of web APIs. Progressing
Control: ISM-1818; Authentication and authorisation of clients is performed when clients call web APIs that facilitate modification of data. Compliant
Any modification of client’s data is performed through the application portal behind robust authentication and authorisation gates with multi factor authentication.
Control: ISM-1817; Authentication and authorisation of clients is performed when clients call web APIs that facilitate access to data not authorised for release into the public domain. Compliant
Any access for observation or modification of client’s data is performed through the application portal behind robust authentication and authorisation gates with multi factor authentication.
Control: ISM-1910; Web API calls that facilitate modification of data, or access to data not authorised for release into the public domain, are centrally logged. Compliant
Any access for observation or modification of client’s data via an API is performed through the application portal behind robust authentication and authorisation gates with multi factor authentication. All modifications of client data are adequately logged when applicable.
Control: ISM-1240; Validation or sanitisation is performed on all input handled by web applications. Compliant
Use of C# property validation data annotation at application presentation layer combined with data integrity and sanitisation controls at the persistence layer.
Control: ISM-1241; Output encoding is performed on all output produced by web applications. Compliant
Exclusive use of view models for data presentation and total separation from business layer and persistence layer data entities by means of inversion of control and separated name spaces
Control: ISM-1424; Web applications implement Content-Security-Policy, HSTS and X-Frame-Options via security policy in response headers. Progressing
Control: ISM-1862; If using a WAF, disclosing the IP addresses of web servers under an organisation’s control (referred to as origin servers) is avoided and access to the origin servers is restricted to the WAF and authorised management networks. Progressing
Control: ISM-1275; All queries to databases from web applications are filtered for legitimate content and correct syntax. Compliant
Use of Microsoft Entity Framework for secure and correct persistence layer access to the database
Control: ISM-1276; Parameterised queries or stored procedures, instead of dynamically generated queries, are used by web applications for database interactions. Compliant
Control: ISM-1278; Web applications are designed or configured to provide as little error information as possible about the structure of databases. Compliant
Use of development environment exception page and logging of error message details exclusively by use of Azure Application Insights
Control: ISM-1536; All queries to databases from web applications that are initiated by users, and any resulting crash or error messages, are centrally logged. Compliant
All relevant queries and data modifications are being logged in the database by suitable data structures. All application errors and exception details are centrally logged and stored by means of Azure Application Insights service
Control: ISM-1911; Web application crashes and error messages are centrally logged. Compliant
All application errors and exception details are centrally logged and stored by Azure Application Insights service