Google Cloud Platform
- We use Pulumi infrastructure management to store your cloud configuration in version control.
- We generate one service account per element of your application, with a single role and access. This means that each key is revokable and replaceable, and the impact of leaked keys (however improbable), is kept to a minimum.
Amazon Web Services
Our AWS infrastructure is also managed in Pulumi, and again we use a 1:1 IAM:Resource setup to ensure that there are no access keys floating around with too many permissions
In both instances, two senior roles have access to the master accounts which have resource creation and deletion properties. Both of these 2FA protected accounts are secured with keys that are rotated every 90 days.
Github
Our code is actively stored on Github and protected with 2FA and password managers. Repositories are backed up periodically to a second location.
Main branches are protected and can only be modified through a pull-request flow.
Snyk
Snyk is a suite of application security tools. Through Snyk, the dependencies to all our projects are continuously monitored for upgrades and security alerts.
Snyk notifies whenever a dependency requires an update or a security vulnerability is found, and automatically creates the code require to update our applications, ensuring a swift and timely resolution.
We also offer Snyk application analysis, which can find common security flaws in custom applications.
Legacy server infrastructure
When working with “legacy” server infrastructure, we always endeavour to upgrade workflows and systems to use secure protocols like SSH over FTP.
For the PHP applications in our stable, we use Envoyer.io deployment manager, which brings best-practice deployment processes like Git flow, deployment hooks, and build notifications to legacy systems.