If your system or application is mobile app based which security measures have been built into your code to avoid OWASP Top 10 mobile issues.

For reference see [Link]. Our app is built on top of the Cordova Framework which we upgrade regularly whenever new version are released. As such, our apps are just a website run locally on the device while interacting with our API’s. This also means that the only code we maintain is javascript/HTML/CSS. M1 – Improper Platform UsageWe only ask for the permissions we need. Currently that is internet connectivity, data storage, push notification, device id (used by push) M2 – Insecure Data StorageWe only store a user token for the logged in user. No PII og health data is

If your system or application is Web based and connects to a data base what measures have been taken to mitigate SQL Injection

All interactions between our web servers and database servers are carried out by Entity Framework which ensures that no SQL statements are written “by hand” and all values are parameterized. Also, we have applied SQL Database Threat Detection to capture any anomality.

If your system or application is Web based which security measures have been built into your code to avoid OWASP Top 10 web risks.

Use [Link] or [Link] and [Link] for guidance. We used Detectify to stay up to date with the current OWASP Top 10

How and which security measures have been built into your API’s – Please elaborate.

Our API’s uses JWT and like technologies to facility authentication and authorization. Furthermore, we use Azure AD (and Azure AD B2C) to detect malicious login attacks.

Do you utilize any form of SDL – Security Development Lifecycle in your code development framework.

We strive to follow the SDL for Agile Development where applicable in our software lifecycle. Code modifications to security related modules (database access and filtering, authentication, authorization etc.) is marked for Security Review by another Team Member with the necessary training and seniority. We use filtering and escaping libraries the validate and mitigate XSS and Injection attacks. Furthermore, large parts of our authentication and cryptography relies on proven technologies like Azure AD, Azure AD B2C and Azure KeyVault.

Has the system or application been tested for privacy breach vulnerabilities – please elaborate.

We use Detectify to test our services for vulnerabilities on a weekly basis. The system scans for 500+ known attacks and constantly adding more. If any new vulnerabilities show up then our Security Team is notified automatically.

Has the system or application been tested for security vulnerabilities and has your code been screened for security issues – please elaborate

Please provide us with any security process or control certification such as ISO27001/2 and describe what is covered by your certification (ISO27001 SoA).

Is available from Microsoft Azure and for further details please see document “WLB Security document.pdf”

Please provide us with your latest audit report – SSAE16 SOC 2 and/or ISAE 3402 based on infrastructure controls – this documentation is often readily available by your hosting or cloud provider.

Is available from Microsoft Azure and for further details please see document https://wlbpubliccontent.blob.core.windows.net/public/E-bog%20dokumenter/Technical%20Fact%20sheet.pdf

If your system or service is Cloud based – Please provide us with a description of what type of Cloud Computing model you have based your solution on – is it IaaS (Infrastructure-as-a-Service), PaaS (Platform-as-a-Service) or SaaS (Software-as-a-Service).

Microsoft Azure – SaaS

Everything you need in one place

Wellbeing Resources

Themes

If your system or application is mobile app based which security measures have been built into your code to avoid OWASP Top 10 mobile issues.

If your system or application is Web based and connects to a data base what measures have been taken to mitigate SQL Injection

If your system or application is Web based which security measures have been built into your code to avoid OWASP Top 10 web risks.

How and which security measures have been built into your API’s – Please elaborate.

Do you utilize any form of SDL – Security Development Lifecycle in your code development framework.

Has the system or application been tested for privacy breach vulnerabilities – please elaborate.

Has the system or application been tested for security vulnerabilities and has your code been screened for security issues – please elaborate

Please provide us with any security process or control certification such as ISO27001/2 and describe what is covered by your certification (ISO27001 SoA).

Please provide us with your latest audit report – SSAE16 SOC 2 and/or ISAE 3402 based on infrastructure controls – this documentation is often readily available by your hosting or cloud provider.

If your system or service is Cloud based – Please provide us with a description of what type of Cloud Computing model you have based your solution on – is it IaaS (Infrastructure-as-a-Service), PaaS (Platform-as-a-Service) or SaaS (Software-as-a-Service).

Get Started

Solution

Knowledge Hub

Howdy

Follow Us

Newsletter

Everything you need in one place

Wellbeing Resources

Themes

Tags