Previous topicNext topic
 Link Technologies - LinkSOFT Documentation 
Help > Installation > Frequently Asked Questions >
How is security handled in LinkSOFT

Here is a summary of the security standards we have implemented. All these platforms are part of the Best Practices that are required by ISO and OWASP standards. 

  1. Support for Multi-Factor Authentication
    1. Two Factor Authentication
      1. Google Authenticator
      2. Microsoft Authenticator
    2. Email Two Factor Authentication
  2. Identity 4.0 for LinkSOFT has the following features:
    1. Account Lockout after X attempts with Time laps to enable retry
    2. Password stored as irreversible encryption with unique system-generated salt for each user
    3. Password complexity policy with
      1. Question and Answer
      2. Minimum Length
      3. Non Alphanumeric characters
  3. Forms-based authentication inside the LinkSOFT application allowing users to create "Roles" and allocate "users" to Roles. Roles can then be allocated "form" access
    1. Users can be deleted at any time
    2. User accounts can be disabled temporarily

Please note that Link Technologies provides the tools and features for users to enable on their web server. It is the client's responsibility to ensure that they implement these features.  For example, if a client decides to use a simple password with no multi-factor authentication, the risk to the site can be quite high.  Alternatively, clients can choose complex passwords with multi-factor authentication to prevent unauthorised access.

Link Technologies recommends that all clients implement the following:

  1. Apply a 256 bit SSL Certificate with a minimum key length of 2048 bits to their published site
  2. Implement a password complexity and update the published site with the appropriate policy
  3. By default, Email "Two Factor" is enforced. Users need to register and opt into OTP or Authenticator App
  4. System Audit and Audit Logs are maintained by the system including user activity. System administrators can receive regular alerts showing user activity
  5. User access maintenance would be reviewed regularly
  6. Use router policies to restrict access to authorised regions
  7. Use complex API keys and change them regularly