Alpha Software Blog



Alpha Cloud Security Capabilities

Application-Security-564344-editedIn this article, we look at “in transit” security; getting your data from the desktop or device to a web application server without having it read or changed by others, and being assured that the exchange is only between the two.  We will show that Alpha Cloud automatically configures a server to make secure connections the default.

 

Background

Publicly available web applications and services are under constant attack from hackers all over the world!  Security is not just a nice thing to have, but a fundamental necessity to ensure continuity of business and to meet regulatory requirements.

There are several areas that we look at when assessing the security of an application. 

  • Is the information being kept private, or can it be read by others?
  • Is access to information limited to only those who “should” have that access?
  • Is it possible to tamper with the information?
  • Can we tell who had access to the information and who made changes?

 

When implementing a software system, we must consider the points where data might be accessed:

  • While being sent from the client to the server or the server to a database; referred to as “in transit”.
  • While being processed by the application code; “in use”.
  • While stored by the database or other storage server; referred to as “at rest”.

 

In Transit Security

In transit security is generally handled by using the TLS (Transport Layer Security) protocol.  You may have heard the acronym SSL (Secure Sockets Layer).  This older protocol has been superseded by TLS; but the term is often used today to mean TLS.

You can think of TLS as both an encryption and an authentication process for the server.  We use TLS to provide a certificate of authenticity that the web server you are contacting is the one you asked for.  Once that step is out of the way, the TLS client and server negotiate a key to use to encrypt all traffic between them.  As you might guess, this is a complex exchange of information and it depends on a combination of technology and a process - that of vetting and certifying that a web site is “who” it claims to be.

Secure connections between a desktop browser or a mobile device and a web application can be compromised if you don’t configure your server properly.  You have to be careful to remove obsolete ciphers, hashes, and protocols.  If you aren’t sure what these are, there is a good chance you haven’t got a secure server connection using TLS (also called SSL).  The default Windows™ Server installation is not “hardened” in this respect.

 

Alpha Cloud TLS Support 

Every deployed web site on Alpha Cloud is bound to a certificate authenticating that you are communicating with Alpha Cloud.  In addition, you can (and should) purchase and install a certificate that renames the web site (creates a unique URL) that your users can know is you.

Every Alpha Cloud server is automatically configured, by default, to include only secure ciphers, hashes, and protocols on a Windows™ Server.

Don’t take our word for it!  Below is a screen shot of the analysis of an Alpha Cloud test site done by Qualys SSL Labs. 

See for yourself!

  1. Open your browser and navigate to https://www.ssllabs.com/ssltest/analyze.htm
  2. Enter the host name alphasoftware-helloworld.cloud.alphasoftware.com.
  3. Qualys Labs will probe the site extensively to see what protocols, ciphers and hashes are available. 

Note: The probe is done on three different addresses.  This is because Alpha Cloud runs deployed application a minimum of two different data centers; so failover is automatic.

 

Data “At Rest”

Services like Amazon RDS (Relational Database Services) and S3 (Simple Storage Service) are highly recommended in a cloud deployment.  These services can provide encryption of your data when stored on physical media.  You should always take advantage of these options by selecting them when you create database server instances or data storage buckets!

You can also control access to the database and storage, and you want to limit access to both by selecting the proper settings on each service.

 

Data “In Use”

While “In Transit” and “At Rest” are important parts of securing your application, you must also be sure that your application code itself does not compromise data in the way it behaves. 

Alpha Cloud creates a sandbox for your deployed web site isolating it from the Windows Server using the principal of “least permissions”.  Even in public tenancy (where your application and others may share the same virtual machine), the other applications can’t access your data and processes, and you can’t access theirs. 

Alpha Cloud and Alpha Anywhere can be used to build a secure application. But, with all of the tools and features available to you, you must still take responsibility for verifying that the web application you build does not undermine what Alpha Cloud and Alpha Anywhere Application Server provide. 

Other things you should consider in building a secure application:

  • Do you pass data on to other services? Is that connection secure?  Is the service itself secure?
  • When you connect to your database from Alpha Anywhere Application Server, do you set your connection string to use TLS? If your database is hosted on Amazon RDS or Microsoft Azure, this is simply a matter of checking a box on the TLS page of the connection string dialog.
  • Do you store information on a storage server such as S3? Is your connection secure?  If you use Alpha Anywhere storage connection strings, data transfer is secure by default.

 

Closing Thoughts

Security is hard!  We provide you with an environment that is automatically configured using Amazon, Microsoft and Google technology and using best practices; to save you from having to become an expert in every security technology to deploy applications.

Security is never “done”.  The bad guys are always trying to come up with new ways to break into other people’s applications.  Keep your servers up to date, watch for new releases of Alpha Anywhere.  We update Alpha Cloud whenever a new security patch is made available by Amazon.  We do so without the need to interrupt your running application.

Security is a team sport.  The major vendors are constantly tightening up security.  By working together to keep current on features and facilities we can all protect your application and its data better.


alphacloud-mobile-business-cloud
Considering the move to Alpha Cloud for your Alpha Anywhere applications? 

Learn more about Alpha Cloud or view a Total Cost of Ownership Study.

 

Prev Post Image
Alpha Cloud Australia Goes Live
Next Post Image
COVID-19 Challenges Business to Go Paperless

About Author

Kurt Rayner
Kurt Rayner

Kurt Rayner drives product architecture in areas including object modeling, language, code generation, and database integration. With more than 25 years of experience, Kurt's passion is creating architectures for tools that empower developers to build sophisticated, cost-effective business applications. Prior to joining Alpha, Kurt ran a software development consultancy, directed the development team for PowerBuilder at Sybase Inc., and developed software and managed development teams at Boston Financial Data Services, Cullinet Software, and Foxboro. He holds master's degrees in computer science from Boston University, and education counseling from Boston State College, and a bachelor's degree in psychology from Barrington College.

Related Posts
Future Trends in AI Integration Services: What Businesses Need to Know
Future Trends in AI Integration Services: What Businesses Need to Know
Top Security Concerns for Low-code and No-code Development
Top Security Concerns for Low-code and No-code Development
No-Code, Low-code ERP System For a Rail & Power Station Manufacturer
No-Code, Low-code ERP System For a Rail & Power Station Manufacturer

The Alpha platform is the only unified mobile and web app development and deployment environment with distinct “no-code” and “low-code” components. Using the Alpha TransForm no-code product, business users and developers can take full advantage of all the capabilities of the smartphone to turn any form into a mobile app in minutes, and power users can add advanced app functionality with Alpha TransForm's built-in programming language. IT developers can use the Alpha Anywhere low-code environment to develop complex web or mobile business apps from scratch, integrate data with existing systems of record and workflows (including data collected via Alpha TransForm), and add additional security or authentication requirements to protect corporate data.

Comment