The importance of protecting Personally Identifiable Information (PII) is critical. Implementing a least privilege model using role-based access can ensure data is only accessible to those who have a need to know. eComp restricts access based on roles and tokens issued by an authentication server to securely identify the user who is assigned those roles. eComp also ensures the databases are secure both at rest and in transit.
User Security
Authentication
eComp uses JSON Web Tokens (JWT) to securely send an access token from the Authentication server to the Application server.
Access Token
The Access Token identifies the user for each request from the browser. Each token is signed, and the issuer ("iss") and expiry date ("exp") fields are verified after ensuring the signature is valid. There are no claims that provide system access to the user in the access token – only the identity of the user.
Authorization
Once the access token is validated, eComp performs a lookup of the authorization claims for the identity. The application uses role-based security which is applied in layers – this gives you the ease of using role-based security with additional flexibility to customize where required. Also, since the authorization is at the application level - access can be immediately revoked if required. Eliminating the need to revoke the JWT token.
Authorization could also be used to restrict data based on a user's hierarchy. Roles can be configured to allow access to PII data.
Database Security
Transparent Data Encryption (TDE)
Access to data is protected with Transparent Data Encryption (TDE) for data at rest. This applies to data on the disk and the database backups.
Transport Layer Security (TLS)
Transport Layer Security protects the data in transit between the client and the server.
Always Encrypted with secure enclaves
Always Encrypted with secure enclaves encrypts uses Intel Software Guard Extensions (Intel SGX) enclaves - a hardware technology supported in databases that use the new DC-series hardware generation in Azure. eComp uses this feature to encrypt designated Personally Identifiable Information (PII) making it unreadable outside of the application itself.
By Steve McCrea · October 7, 2021