Online services consist of various elements that must be secured to ensure overall service integrity. This section covers a broad range of topics from managing data within your service to protecting its various components.
While no system can claim to be completely secure, designing an online service that is as secure as necessary is essential. This section aims to enhance organizations’ confidence in the security of the components they manage, thereby providing assurance for the overall service.
Secure Development and Design
It is critical to consider security from the beginning of the design and development process of an online service. All aspects of the service should have security implemented by default. The NCSC’s Secure Design Principles and our Digital Service Security Guidance set essential baselines for creating secure systems. The OWASP Top 10 Web Application Security Risks details common threats, and it is vital to defend against these throughout development.
Following secure development practices is crucial. The NCSC’s Secure Development and Deployment Guidance can assist in this area. For tailored application guidance, particularly for mobile apps, refer to our Application Development Guidance. Our advice on producing clean and maintainable code lays the groundwork for building secure applications.
The NCSC blog post Defending Software Build Pipelines from Malicious Attacks emphasizes the importance of securing development pipelines.
When implementing an API, it is crucial to understand the security risks involved. The OWASP API Security Top 10 provides insights into prevalent threats. A comprehensive guide on implementing a secure API solution can be accessed via the GDS API Technical and Data Standards.
Platform and Server Security
The NCSC has released guidance on securing platforms and servers, which include:
- For specific platform guidance, consult the NCSC Device Security Guidance. Though primarily targeting desktop systems (Android, Chrome OS, iOS and iPadOS, macOS), consider our guidance on Ubuntu and Windows as initial references for server setups, which can also address deployment scripts and policy settings.
- Management interfaces execute privileged actions, necessitating strict security measures. See our blog posts on how to Protect Your Management Interfaces and Protecting Your Privileged Access Management. The Security Architecture Anti-Patterns white paper and guidance on Systems Administration Architectures can also offer insights.
- For online services leveraging cloud technology, understand the associated risks and consult cloud service vendors’ security guidance. Resources like the Microsoft Azure Well-Architected Framework and AWS Well-Architected can assist in ensuring robust security.
- Ensure confidence in the hardware, operating systems, services, and applications utilized in building and delivering your online service. Consider using products and services that adhere to NCSC standards.
Network and Service Security
Design your online service to avoid direct connections to untrusted networks, such as the internet. Aim to prevent lateral movement within your systems should an attacker gain access.
Employ network and application layer security measures, such as firewalls and security groups, to safeguard and segment your services. The NCSC’s guidance on Architecture and Configuration and Preventing Lateral Movement offers additional insights.
Protect against Denial of Service (DoS) attacks, which can overload servers. The NCSC’s Denial of Service Guidance outlines preparation and response strategies.
Risk occurs when bringing data from unknown sources, as many attacks stem from malicious input. The NCSC’s Pattern for Safely Importing Data provides a defensive approach for handling external data.
Data Security
Protect all data processed by your online service from unauthorized access, changes, and deletions, especially sensitive personal information. The NCSC’s Protecting Bulk Personal Data Guidance discusses encryption standards for personally identifiable information. Utilize our secure design principles and cloud security guidance to make informed data protection decisions.
Inadequate protection of personally identifiable information can lead to legal actions, financial loss, and reputational damage. The NCSC’s GDPR Security Outcomes Guidance details necessary security measures under the UK General Data Protection Regulation.
Attackers frequently target data stores aiming to misuse the accessed information. Such information may include user credentials, potentially leading to breaches of other accounts, known as credential stuffing. More details are available in the NCSC’s advisory on credential stuffing tools.
Secure Disposal of Data
When data is no longer needed, it must be disposed of securely, including erasing any associated customer information. The NCSC’s Secure Sanitisation Guidance emphasizes the importance of this practice. Insecure disposal can lead to unauthorized data release, posing legal and reputational risks.
Data in Transit
‘Data in transit’ refers to information moving from one location to another, whether via the internet, a private network, or removable media. Although sensitive data will transit within systems, it is vulnerable to interception or alteration while en route.
Protect sensitive information during transit using encryption and cryptographic techniques. The NCSC provides guidelines on Using TLS to Protect Data and Using IPsec to Protect Data, which can enhance the security of data in transit. Be mindful of connection risks for devices that do not support current security protocols.
Secure Administration
Administering an online service involves granting privileged access, which can expose systems to significant risks. To counteract this, utilize multi-factor authentication (MFA) for management access and privileged access management solutions that restrict access to trusted devices. The following NCSC resources provide further guidance:
- Multi-Factor Authentication for Online Services
- Gain Trust in Your Management Devices
- Use Privileged Access Management
- Security Architecture Anti-Patterns
- Operating a Secure Digital Service
Supply Chain Security
The security of your supply chain is critical to your online service’s overall security. Any vulnerabilities from third-party hardware, software, or services can compromise your service and its data. Assess the risks posed by suppliers, ensuring their cybersecurity responsibilities are detailed within contracts. The NCSC’s Supplier Assurance Questions can assist in reinforcing these relationships, while our guidance on Supply Chain Security outlines 12 principles for effective oversight.
Support Systems
Human support is vital for all online services. It is essential to ensure that staff and third-party service providers possess the necessary technical expertise to manage your services securely. User education and awareness are crucial in cultivating this confidence. Thorough pre-employment checks and security vetting can help ensure that those overseeing your online service are well-equipped to do so without compromising security.
Based on an article from ncsc.gov.uk: https://www.ncsc.gov.uk/guidance/building-operating-secure-online-service
