Skip to main content

Security Best Practices for Fiscus SDK

Security is one of the core pillars of the Fiscus SDK. When handling APIs and sensitive user data, it's paramount to follow best practices that safeguard confidentiality, integrity, and availability. This guide outlines the critical security measures and recommendations for integrating the Fiscus SDK into your applications while aligning with globally recognized standards like OWASP, NIST, GDPR, CCPA, SOC 1, SOC 2, and AWS security principles.

Core Security Principles​

Confidentiality​

Confidentiality ensures that sensitive information is accessible only to those authorized to view it. The Fiscus SDK maintains confidentiality by:

  • API Key Management: All API keys and secrets should are stored securely using best practices such as environment variables or secrets management tools (e.g., AWS Secrets Manager or HashiCorp Vault).
  • Data Encryption: All communication between the Fiscus SDK and external services uses Transport Layer Security (TLS) 1.2 or higher, ensuring data confidentiality during transmission.
  • Access Control: Fiscus supports Role-Based Access Control (RBAC), limiting access to data and operations based on user roles and policies. This ensures that only authorized users can perform specific actions within an API.

Integrity​

Integrity refers to the protection of data from being altered by unauthorized parties. Fiscus enforces data integrity by:

  • Data Validation: Input data is validated before being processed, ensuring that malformed or malicious data cannot affect the API.
  • Hashing and Encryption: Sensitive data, including passwords, tokens, and other credentials, are hashed or encrypted at rest using industry-standard encryption algorithms (e.g., AES-256).
  • Secure Communication Protocols: Fiscus SDK enforces the use of secure communication protocols like TLS for all API requests to prevent tampering during transmission.

Availability​

Availability ensures that data and services are available when needed. Fiscus SDK provides high availability and reliability by:

  • Redundancy and Failover: Fiscus leverages AWS infrastructure to provide redundancy across multiple Availability Zones (AZs), ensuring high availability of services.
  • Rate Limiting and Throttling: Built-in rate limiting and connection pooling prevent overloading of API endpoints, preserving system performance and avoiding Denial-of-Service (DoS) attacks.
  • Retry Logic: Fiscus SDK includes customizable retry mechanisms to handle transient failures and ensure the completion of API calls.

 

Compliance with Industry Standards​

OWASP​

The Fiscus SDK aligns with the OWASP Top Ten, a set of the most critical web application security risks, including:

  • Injection Protection: Fiscus employs input validation and sanitization to prevent SQL Injection and Command Injection attacks.
  • Broken Authentication: The SDK uses secure authentication practices, ensuring that tokens and credentials are handled safely and are not exposed.
  • Sensitive Data Exposure: Data is encrypted both in transit and at rest, reducing the risk of exposing sensitive user information.

NIST​

Fiscus follows guidelines from the National Institute of Standards and Technology (NIST), specifically:

  • Encryption Standards: Fiscus uses NIST-recommended encryption algorithms like AES-256 for data at rest and TLS for data in transit.
  • Identity Management: Fiscus implements multi-factor authentication (MFA) and OAuth flows, following NIST’s recommendations on identity management.
  • Secure Development Lifecycle: Secure coding principles are adopted throughout the development process, ensuring adherence to NIST guidelines.

GDPR and CCPA​

Fiscus SDK supports compliance with GDPR and CCPA, helping protect personal data and ensuring user rights. Key practices include:

  • Data Minimization: Fiscus only processes the minimum amount of personal data required to perform tasks.
  • User Consent Management: Mechanisms are provided to obtain and manage user consent for data processing.
  • Data Subject Requests: Fiscus enables applications to handle data subject requests, such as access, deletion, or rectification of personal data.

SOC 1 and SOC 2​

Fiscus aligns with SOC 1 and SOC 2 principles, ensuring robust internal controls for security, availability, processing integrity, confidentiality, and privacy.

  • Audit Trails: Fiscus SDK includes built-in audit logging, providing a traceable history of actions for compliance purposes.
  • Access Control Policies: RBAC and API key management ensure that only authorized personnel can access and modify sensitive data.

 

Data Protection​

Encryption in Transit​

All communications between the Fiscus SDK and external services are encrypted using TLS 1.2 or higher, ensuring that data cannot be intercepted or tampered with during transmission.

  • TLS Configuration: Ensure that all services interfacing with Fiscus enforce TLS 1.2 or above to mitigate risks such as man-in-the-middle (MITM) attacks.
  • Certificate Management: Follow best practices in managing SSL/TLS certificates, such as using trusted certificate authorities and regularly rotating certificates.

Encryption at Rest​

Data at rest is encrypted using AES-256 encryption, one of the strongest encryption standards available.

  • Storage Encryption: All sensitive data, including logs, backups, and databases, are encrypted at rest to protect against unauthorized access.
  • Backup Encryption: Backups of sensitive data are also encrypted to maintain confidentiality, even in disaster recovery scenarios.

Key Management​

Encryption keys are managed securely using AWS’s Key Management Service (KMS), ensuring that:

  • Key Rotation: Keys are rotated regularly, minimizing the risk of key compromise.
  • Access Control: Access to encryption keys is tightly controlled using AWS Identity and Access Management (IAM) policies.

 

Authentication and Authorization​

API Keys and Secrets​

  • Secure Storage: API keys and secrets should never be hardcoded or stored in version control. Use secrets management tools like AWS Secrets Manager or HashiCorp Vault.
  • Least Privilege: Apply the principle of least privilege when creating API keys, ensuring that each key has the minimum required permissions.
  • Rotation and Expiration: Regularly rotate API keys and set expiration policies to reduce the risk of key exposure.

OAuth Flows​

Fiscus handles OAuth flows securely, supporting token-based authentication with:

  • Secure Token Storage: Tokens are encrypted at rest and in transit.
  • Token Refresh: The SDK automatically handles token refresh, ensuring long-lived connections without compromising security.

Role-Based Access Control (RBAC)​

Fiscus’s RBAC system ensures that users can only access the APIs and operations for which they have explicit permission. Key features include:

  • Dynamic Permissions: User roles and permissions are evaluated at runtime, ensuring up-to-date access control.
  • Policy Management: Centralized policy management allows administrators to easily update and enforce access control across the organization.

 

Secure Coding Practices​

Input Validation​

Fiscus validates and sanitizes all user inputs to prevent security vulnerabilities like injection attacks.

  • Whitelisting Inputs: Use a whitelist approach to validate inputs, only accepting expected values.
  • Regular Expressions: Implement strong regular expressions to validate input patterns.

Error Handling​

Proper error handling practices are followed to avoid exposing sensitive information.

  • Avoid Information Leaks: Error messages returned to users should not reveal sensitive data. Developers should use generic messages for end-users and detailed logs for debugging.
  • Graceful Failure: Fiscus ensures that operations fail gracefully without leaving the system in an insecure state.

Logging and Monitoring​

Fiscus SDK provides detailed logging and monitoring features to detect and respond to potential security incidents.

  • Audit Logging: Comprehensive audit trails are available, logging every action taken within the SDK. These logs are critical for forensic analysis and compliance.
  • Monitoring: Use monitoring tools to track unusual activities, such as multiple failed authentication attempts, which could indicate a security threat.

 

Infrastructure Security​

AWS Security Measures​

Fiscus is built on AWS, leveraging its robust security infrastructure and best practices to ensure a secure environment.

  • IAM Policies: AWS Identity and Access Management (IAM) is used to define granular access control policies, ensuring that only authorized services and users have access to Fiscus resources.
  • VPC Isolation: Fiscus services are deployed within Amazon Virtual Private Cloud (VPC), ensuring network isolation and secure communication between services.
  • Security Groups: AWS Security Groups are configured to control inbound and outbound traffic to instances, preventing unauthorized access.
  • AWS Shield and WAF: AWS Shield is used to protect against Distributed Denial of Service (DDoS) attacks, while the AWS Web Application Firewall (WAF) filters malicious traffic.

Network Security​

  • Firewalls: Firewalls are used to protect network boundaries, ensuring that only authorized traffic can access sensitive resources.
  • Intrusion Detection: Intrusion Detection and Prevention Systems (IDPS) monitor traffic for suspicious activity and block unauthorized access attempts.

Disaster Recovery and Business Continuity​

  • Regular Backups: Data is backed up regularly, and restore procedures are tested to ensure quick recovery in case of a disaster.
  • Multi-AZ Deployment: Fiscus utilizes AWS’s Multi-AZ (Availability Zone) deployments to ensure high availability and reduce the risk of data loss.

 

Operational Security​

Patch Management​

Fiscus follows a rigorous patch management process to ensure that all software and dependencies are up to date with the latest security patches.

  • Regular Updates: All libraries and dependencies are updated regularly to include the latest security patches and improvements.
  • Automated Patch Deployment: Tools like AWS Systems Manager are used to automate patch management, ensuring timely updates without manual intervention.

Security Assessments and Audits​

Fiscus will conduct regular security assessments and audits to identify and fix vulnerabilities:

  • Penetration Testing: External and internal penetration tests will be conducted regularly to ensure the system is resilient to attacks.
  • Code Reviews: Peer code reviews and automated tools are used to identify security issues early in the development cycle.
  • Compliance Audits: Fiscus will undergo regular compliance audits to ensure adherence to GDPR, CCPA, SOC 2, and other relevant security standards.

Incident Response​

Fiscus has a comprehensive incident response plan to quickly detect, mitigate, and recover from security incidents.

  • Monitoring and Detection: Systems are continuously monitored for signs of compromise, and any anomalies trigger immediate alerts.
  • Incident Response Plan: Fiscus maintains a documented incident response plan, outlining roles, responsibilities, communication strategies, and recovery steps.
  • Post-Incident Analysis: After an incident, a thorough analysis is conducted to identify the root cause and implement security improvements to prevent recurrence.

 

Best Practices for Developers​

Secure Configuration​

  • Use Secure Defaults: Ensure that secure defaults are applied and only allow explicit opt-in for less secure configurations.
  • Configuration Management: Use configuration management tools (e.g., AWS Systems Manager Parameter Store, Ansible) to manage settings securely across environments.

Secrets Management​

  • Avoid Hardcoding Secrets: Never hardcode API keys, tokens, or passwords in the source code. Instead, store them securely using a secrets management tool like AWS Secrets Manager or HashiCorp Vault.
  • Rotate Secrets Regularly: Implement policies to rotate API keys, tokens, and other secrets regularly to minimize the risk of exposure.

Regular Updates​

  • Dependency Management: Use automated tools to monitor and update dependencies. Tools like OWASP Dependency-Check can help identify vulnerabilities in third-party libraries.
  • Stay Informed: Subscribe to security advisories for your software components and stay informed about new vulnerabilities and patches.

 

Additional Resources​

By following these security best practices and leveraging the powerful features of the Fiscus SDK, you can ensure that your applications are secure, compliant, and resilient to security threats. Whether you're developing for a small startup or a large enterprise, Fiscus helps you build robust API integrations while maintaining the highest standards of security.