Skip to main content

Data Security

Overview​

Cyber-security is a critical component of the STF network, ensuring that all data and transactions are protected against unauthorized access and breaches. The network employs a multi-layered security approach, incorporating industry best practices and standards to safeguard sensitive information.

Security Measures​

  1. Data Encryption: All data transmitted over the network is encrypted using advanced encryption standards (AES-256) within TLS to prevent interception and unauthorized access by encrypting data in transit and at rest.
  2. Access Controls: Strict access controls are implemented to ensure that only authorized users can access specific data and functionalities within the network. Network connections for systems access utilises OAuth and JSON Web Tokens and user access adheres to enterprise Single Sign-On (SSO) and Role-based access control (RBAC), based on the claim received from the Microsoft Work/School account login success, to manage permissions effectively. This means that user access controls are firmly in the control of your enterprise domain security administration controls and policies.
  3. Authentication and Authorization: Multi-factor authentication (MFA) is required for all internal users accessing the network, adding an extra layer of security beyond just usernames and passwords.
  4. Regular Audits and Monitoring: Continuous monitoring of network activity is conducted to detect and respond to potential security threats utilising Microsoft Azure Defender threat surface detection tools, global ingress contoller Microsoft Front Door and Microsoft Sentinel. Regular security audits are performed to identify vulnerabilities and ensure compliance with security policies.
  5. Compliance with Standards: The STF network adheres to relevant industry standards and regulations, such as GDPR, POPIA and others, to ensure that data protection and privacy requirements are met.

There is no direct access to the STF network or its data stores. All interactions with the network are conducted through secure API endpoints operating on a Command Query Responsibility Segregation (CQRS) pattern, ensuring that data is transmitted and received in a controlled and secure manner, which reduces the attack surface.