Security responsibilities of partners #

This page is for partners who build, host or maintain Exponential sites. Under the partner contract, "7x does not warranty the products/services delivered by partners" (https://exponential.earth/partner/program): the security of your customers' sites is your responsibility.

Shared responsibility #

Write the split into each contract.

Per-site checklist #

• To do: Hardened as in Security hardening and doc/eng-us/install/13-security-hardening.md
• To do: Default and shared passwords changed (Default administrator password, Change the admin password)
• To do: Setup wizard and installer files not reachable
• To do: TLS everywhere; security headers; the administration's Content Security Policy not weakened
• To do: Debug output off in production
• To do: Two-factor authentication offered to administrators where available (Accounts and sign-in)
• To do: Custom code reviewed for SQL injection, XSS and CSRF (Security hardening)
• To do: Updates applied on a schedule (Keeping customer sites current)
• To do: Backups tested

Credentials #

• Never in tickets, chats, e-mails or Git repositories.
• Hand credentials to customers through a secure channel; make them change passwords on first sign-in.
• Remove accounts of staff who leave, on your side and the customer's.

Vulnerabilities #

Report privately to [email protected]; never in public (Escalations and security issues).

Incidents #

Have a short plan for every customer:

1. Contain: take the affected part offline or block the attack path.
2. Preserve: keep logs and copies for analysis.
3. Inform: the customer at once; authorities if the law requires it.
4. Fix: apply the fix, rotate credentials, restore clean backups.
5. Learn: write down what happened and change the process.

Related pages #

• Escalations and security issues
• Protecting customer data
• Security hardening
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.