Security Strategy

From Lingoport Wiki
Jump to navigation Jump to search

Overview

Lingoport works to provide customers with a reliable service that safeguards private information. We implement security-centric policies in support of these principles. Our security standards are built to support security-conscious customers, including those in industries such as Human Resources, Finance, and Medical Systems.

For more details on any of these, please see Lingoport Security Overview.

Typical Deployment of the Lingoport Suite and Ports

There are many ways to set up the Lingoport Suite on a customer's system. The diagram below shows the main components and data flows of a typical setup; the Ports section below covers external access. At the center is the Lingoport automation environment, which usually includes Command Center, Globalyzer, Localyzer, and automation such as LingoBot.

  • The automation environment needs to read the code repository, and in some workflows to write to it as well. That access runs through Command Center projects, Localyzer automation, and LingoBot. The repository holds the source code Globalyzer scans for internationalization and localization issues, along with the resource files that go out for translation and come back.
  • Command Center brings together the configuration, functions, and dashboards for Globalyzer and Localyzer workflows. It is deployed and updated with Docker. Data sources include GitHub, AWS S3, and Bitbucket, and each user is given a role: Administrator, Manager, Developer, Translator, or API User.
    • Administrators manage users, teams, licenses, data credentials, machine translation, and translation management systems.
    • The API User drives API-based integrations and cannot log in to Command Center.
  • Globalyzer rule sets can live in a few places: on Lingoport's Globalyzer Server, on a customer-managed Globalyzer Server, in the repository, or on the Lingoport automation server itself. When a Globalyzer Server is used, it stores the rule sets and user access information. It never needs the customer's source code or the data being scanned.
    • Lingoport-managed application passwords are salted and hashed before storage.
    • Globalyzer Server hashes passwords with bcrypt.
    • Globalyzer Server can be configured with SAML/SSO in addition to LDAP.
    • A forgotten password triggers a reset, not a retrieval.
    • Our products are checked against common web application risks, including the OWASP Top 10, during development and release. We also guard against clickjacking and directory/path traversal attacks.
    • Keeping rule sets in the repository or on the automation server can remove the need for a separate Globalyzer Server connection.
  • The automation environment may need to exchange resource files with a Translation Management System, Machine Translation Engine, or whichever translation vendor the customer chooses.
    • Those files move over encrypted channels, usually SFTP/SSH or HTTPS/TLS, and some vendor integrations use HTTPS APIs.
    • If a customer prefers, Lingoport can host the SFTP endpoint.
  • The automation environment also has administrative needs: access to package repositories and product update sites, SMTP for mail, and SSH for maintenance.

Ports

Please refer to Deployment_Scenarios#External_Access_and_Ports.

Other aspects

  • Notifications go out through an SMTP account, so the system needs access to a mail server (for example, smtp.yourcompany.com).
  • The automation environment can run in the cloud on an Amazon AWS instance. See AWS Security for the details.
    • Hosted by Lingoport.
    • Hosted by the customer from a Lingoport-provided base image.
  • Lingoport-hosted AWS systems sit behind AWS security groups, with admin access over SSH keys and data on encrypted EBS volumes. We monitor them and keep backups, and access is granted as needed.

FAQ

Can other customers see our rulesets and information on Globalyzer.com?

No. Each company gets its own administrator and users, and there is no path for another company's administrators or users to see or modify your rule sets.

Does Lingoport perform vulnerability scans against the software?

Yes.

At the application level, Lingoport performs security-aware software review through developer-led pull request review and automated security analysis against our codebases.

At a system level, Lingoport runs vulnerability scans against deployed software, adding a check on top of the code-based review. These scans run during development and release cycles, and hosted infrastructure is reviewed for network exposure and configuration risk.

Findings are ranked by severity and tracked in our bug tracker. They are weighed against other development priorities and verified by retesting or rescanning once fixed.

Is data transferred between the customer and the Lingoport automation environment securely?

Yes. Lingoport-hosted systems use HTTPS/TLS 1.2+ for web access. Other data moves over SSH, SFTP, or a vendor's HTTPS API.

Customers may also host most or all of the Lingoport software on premise. In that case the transfer can stay inside the customer's own network, using customer-managed HTTPS certificates and configuration.

Is data transferred between the Lingoport automation environment and the translation vendors?

Lingoport's Localyzer automates translation for software. Localyzer sends translation content to the customer's selected translation vendor. This content is made up of partial or whole resource files, which hold the lists of English or translated strings the application displays.

The destination varies by translation vendor. Most often it is one of:

  • A customer-managed SFTP server. Lingoport can also host one if that is preferable to the customer.
  • A translation vendor's HTTPS API.
  • A Machine Translation Engine, running on either Lingoport or customer credentials.
  • FTPS, where a vendor specifically requires it.

What newer integrations and data flows should customers consider?

A few Lingoport workflows move more than resource text. These should be reviewed as part of security and data-transfer planning.

  • Globalyzer i18n Express and Localyzer Express are GitHub applications. i18n Express scans the files added or changed in a commit and can post a summary back as a commit comment. Localyzer Express handles automated translation for the repositories and branches selected for it.
  • InContext Translation can store translation context on a Lingoport InContext Server and pass context associations, URLs, and page decorations to a Translation Management System.
  • Localyzer and related Command Center workflows may connect to machine translation engines, translation management systems, or design and LLM tooling. Where an LLM is used, this can include prompts, images, a private LLM endpoint, and the endpoint's connection settings.
  • Credential ownership varies by workflow: some integrations run on Lingoport credentials, others on the customer's own vendor accounts.

For Services customers, how do you ensure that the code and company information is secure?

Lingoport works closely with customers to ensure the best security protocol. We want the customer comfortable and confident letting us work with their code. For services engagements, Lingoport needs access to the source code repositories that are in scope for internationalization analysis and refactoring under the service contract. We do not need any other customer data to do the work.

  • Lingoport can provide secured laptops for authorized Services personnel who need access to the company's repositories.
  • Lingoport has also worked with special VPN access to the code repositories.
  • Access is limited to what the engagement needs, and removed once it is no longer needed.
  • Confidential data should be transported and stored securely, and reported immediately if it is lost or stolen.
  • Systems and endpoints used for services work follow Lingoport's security requirements: disk encryption, access controls, and encrypted channels for remote access.

How are security issues and concerns handled within the company?

Security issues are dealt with as soon as they are detected, and then become part of our ongoing security tests.

To ensure that issues are not missed, processes are in place to raise detected issues, assign them, and track them through resolution. Suspected security events or weaknesses should be reported to security@lingoport.com.

How does Lingoport monitor an AWS VM for security issues (logins, invalid logins, data transfers, etc.)?

Comprehensive system logs are maintained and secured, and reviewed for suspicious events.

On AWS we monitor and alert on both system health and security-relevant conditions. Security groups restrict network access and EC2 access uses SSH keys. Hosted systems run on encrypted EBS volumes, and backups are kept for recovery.

How does Lingoport handle business continuity and recovery?

Lingoport keeps backup and recovery procedures for its hosted systems. For AWS-hosted systems, that includes AWS-based backups and restoration. Hosted systems are backed up daily. That gives a recovery point objective of 24 hours, and a recovery time objective of 1 business day where Lingoport assists in the recovery. Backups are replicated to a second AWS region more than 100 miles away. Customer-hosted deployments may use the customer's own backup and recovery systems, with Lingoport providing product expertise when needed.

How does Lingoport handle reportable security incidents?

For current information about reportable security incidents or customer-impacting security events, please contact security@lingoport.com. Lingoport handles suspected incidents through its incident response process and provides notifications when they are required.

Where do I send my security concerns?

Please send any security inquiries or reports to either support@lingoport.com or security@lingoport.com.

What encryption protocols are in place?

HTTPS traffic (Lingoport-hosted systems)

For systems that Lingoport hosts and controls, HTTPS is encrypted with TLS 1.2+. Those hosted web applications use certificates and server configuration for the hosted environment. Where a customer hosts the software, they may use their own HTTPS certificates and configuration.

SSH and SFTP

Lingoport uses SSH for administration and SFTP for file transfer. AWS-hosted systems use SSH key-based access. Translation file transfer commonly runs over SFTP, and some translation vendor integrations use HTTPS APIs.

Disk Encryption

Lingoport uses AWS for hosted servers. Those systems use EBS encryption (AES-256) with an AWS-managed key.

Password encryption

Lingoport-managed application passwords are salted and hashed before they are stored. The Globalyzer Server uses bcrypt.

Any third-party components in a deployment keep their own credential stores. We configure those to follow the vendor's current security guidance.

General Encryption

Encryption varies with the data and the deployment. Web traffic runs on HTTPS/TLS. SSH and SFTP handle transfer and administration, and hosted AWS systems use encrypted volumes. When the customer hosts the software, they bring their own certificates and network controls.

Does Lingoport support LDAP?

The Globalyzer Server supports LDAP, and can also be configured for SAML/SSO. Command Center manages its own users and roles. Other components do not need LDAP.

Retrieved from "https://wiki.lingoport.com/index.php?title=Security_Strategy&oldid=100062"