AWS Security - Revision history

Masnes at 20:08, 11 February 2021

2021-02-11T20:08:16Z

← Older revision		Revision as of 20:08, 11 February 2021
Line 51:		Line 51:
	* LRM (Lingoport automation) retrieves the files from that end point. The files are not the SFTP any longer.		* LRM (Lingoport automation) retrieves the files from that end point. The files are not the SFTP any longer.

	~~The transfer is secure~~:		Transfer security:
	* The protocol used is Secure FTP (SFTP)		* The protocol used is Secure FTP (SFTP). Or with specifical allowance and request FTPS.
	* The SFTP server only allows the minimum IP range necessary:		* The SFTP/FTPS server only allows the minimum IP range necessary:
	** Dedicated VM IP range		** Dedicated VM IP range
	** Translation Group IP range		** Translation Group IP range
	** The protocol is SSH or SSL		** The protocol is SSH (SFTP - Recommended) or SSL (FTPS - as a fallback where specifically requested).

	For specific translation vendors, direct connections to the vendor API point may be substituted for SFTP. These connections are encrypted over HTTPS(TLSv1.2), using an api token to authenticate.		For specific translation vendors, direct connections to the vendor API point may be substituted for SFTP. These connections are encrypted over HTTPS(TLSv1.2), using an api token to authenticate.

Masnes: /* Secure Transfer of Resource Files to/from Translation */

2021-02-10T20:33:23Z

Secure Transfer of Resource Files to/from Translation

← Older revision		Revision as of 20:33, 10 February 2021
Line 45:		Line 45:
	The AWS Lingoport Dedicated VM has code obtained from the repositories on the customer's version control system. A few files, those which require translations, need to be sent to a translation group (See Language Service Providers, TMS, etc.). Those application files are called 'Resource Files'. They are not the code of the application, they are the user visible strings. The resource files are typically .properties, .json, .resx, etc. They are not .java, .js, .c#, etc.		The AWS Lingoport Dedicated VM has code obtained from the repositories on the customer's version control system. A few files, those which require translations, need to be sent to a translation group (See Language Service Providers, TMS, etc.). Those application files are called 'Resource Files'. They are not the code of the application, they are the user visible strings. The resource files are typically .properties, .json, .resx, etc. They are not .java, .js, .c#, etc.

	In order to secure the send the resource files to and from the translation group, the files transfer over Secure FTP:		Most commonly, in order to secure the send the resource files to and from the translation group, the files transfer over Secure FTP:
	* LRM (Lingoport automation) deposits the files on an SFTP endpoint		* LRM (Lingoport automation) deposits the files on an SFTP endpoint
	* The Translation group retrieves the files. They are not on the SFTP any longer		* The Translation group retrieves the files. They are not on the SFTP any longer
Line 57:		Line 57:
	** Translation Group IP range		** Translation Group IP range
	** The protocol is SSH or SSL		** The protocol is SSH or SSL

			For specific translation vendors, direct connections to the vendor API point may be substituted for SFTP. These connections are encrypted over HTTPS(TLSv1.2), using an api token to authenticate.

Rdaly: /* The Lingoport Dedicated VM Restricted Access to the Repository */

2019-07-18T20:27:57Z

The Lingoport Dedicated VM Restricted Access to the Repository

← Older revision		Revision as of 20:27, 18 July 2019
Line 10:		Line 10:
	[[File:AWS Security 2.PNG\|500px]]		[[File:AWS Security 2.PNG\|500px]]

	The first step in this deployment is to instantiate an AWS VM. The Customer IT adds only that VM to the list of specific IP's which can access the repositories. The only access provided is to version control systems such as Git (GitHub, Bitbucket, Gitlabs), TFS, or ~~SVN~~.		The first step in this deployment is to instantiate an AWS VM. The Customer IT adds only that VM to the list of specific IP's which can access the repositories. The only access provided is to version control systems such as Git (GitHub, Bitbucket, Gitlabs), TFS, or Subversion.

	No customer data or systems (credit card information, live databases, client data, etc.) are granted access to the Lingoport Dedicated VM.		No customer data or systems (credit card information, live databases, client data, etc.) are granted access to the Lingoport Dedicated VM.

Rdaly: /* The Customer Network without the Lingoport Suite */

2019-07-18T20:26:40Z

The Customer Network without the Lingoport Suite

← Older revision		Revision as of 20:26, 18 July 2019
Line 5:		Line 5:
	[[File:AWS Security 1.PNG\|500px]]		[[File:AWS Security 1.PNG\|500px]]

	The customer network before any Lingoport dedicated VM. It is expected to be a secure environment.		The customer network before any Lingoport dedicated VM. It is expected to be a secure environment. The code repository is in the secure environment.

	== The Lingoport Dedicated VM Restricted Access to the Repository ==		== The Lingoport Dedicated VM Restricted Access to the Repository ==

Rdaly at 20:17, 18 July 2019

2019-07-18T20:17:41Z

← Older revision		Revision as of 20:17, 18 July 2019
Line 1:		Line 1:
	Deploying the Lingoport Dedicated VM using AWS has many security advantages. This section develops some of the layers starting with a customer's network to the full implementation of the dedicated VM accessing the customer's network Git repositories.		Deploying the Lingoport Dedicated Virtual Machine (VM) using AWS (https://aws.amazon.com/what-is-aws/) has many security advantages. This section develops some of the layers starting with a customer's network to the full implementation of the dedicated VM accessing the customer's network Git repositories.

	== The Customer Network without the Lingoport Suite ==		== The Customer Network without the Lingoport Suite ==

Olibouban: /* Secure Transfer of Resource Files to/from Translation */

2019-06-03T22:07:37Z

Secure Transfer of Resource Files to/from Translation

← Older revision		Revision as of 22:07, 3 June 2019
Line 42:		Line 42:
	== Secure Transfer of Resource Files to/from Translation ==		== Secure Transfer of Resource Files to/from Translation ==
	[[File:AWS Security 5.PNG\|500px]]		[[File:AWS Security 5.PNG\|500px]]

			The AWS Lingoport Dedicated VM has code obtained from the repositories on the customer's version control system. A few files, those which require translations, need to be sent to a translation group (See Language Service Providers, TMS, etc.). Those application files are called 'Resource Files'. They are not the code of the application, they are the user visible strings. The resource files are typically .properties, .json, .resx, etc. They are not .java, .js, .c#, etc.

			In order to secure the send the resource files to and from the translation group, the files transfer over Secure FTP:
			* LRM (Lingoport automation) deposits the files on an SFTP endpoint
			* The Translation group retrieves the files. They are not on the SFTP any longer
			* The Translation group pushes the translated files to another SFTP endpoint.
			* LRM (Lingoport automation) retrieves the files from that end point. The files are not the SFTP any longer.

			The transfer is secure:
			* The protocol used is Secure FTP (SFTP)
			* The SFTP server only allows the minimum IP range necessary:
			** Dedicated VM IP range
			** Translation Group IP range
			** The protocol is SSH or SSL

Olibouban: /* HTTPS and IP Restrictions to the Lingoport Applications */

2019-06-03T22:01:15Z

HTTPS and IP Restrictions to the Lingoport Applications

@@ Line 25: / Line 25: @@
 == HTTPS and IP Restrictions to the Lingoport Applications ==
 [[File:AWS Security 4.PNG|500px]]
 == Secure Transfer of Resource Files to/from Translation ==
 [[File:AWS Security 5.PNG|500px]]

Olibouban: /* Restricted Access to the Lingoport Dedicated VM */

2019-06-03T21:56:52Z

Restricted Access to the Lingoport Dedicated VM

← Older revision		Revision as of 21:56, 3 June 2019
Line 15:		Line 15:

	== Restricted Access to the Lingoport Dedicated VM ==		== Restricted Access to the Lingoport Dedicated VM ==

	[[File:AWS Security 3.PNG\|500px]]		[[File:AWS Security 3.PNG\|500px]]

			Conversely, only a restricted set of IP's are allowed to access the Lingoport Dedicated VM. For instance, a system has to be either in the Customer's network or in the Lingoport network to be granted access to the Lingoport Dedicated VM.
			It behaves as an extension of the customer's network. No other party can gain access to the Lingoport Dedicated VM.

			Furthermore, access to the AWS Lingoport Dedicated VM is restricted by SSH key. A public key needs to be set on the Dedicated VM to access connections.

	== HTTPS and IP Restrictions to the Lingoport Applications ==		== HTTPS and IP Restrictions to the Lingoport Applications ==
	[[File:AWS Security 4.PNG\|500px]]		[[File:AWS Security 4.PNG\|500px]]
	== Secure Transfer of Resource Files to/from Translation ==		== Secure Transfer of Resource Files to/from Translation ==
	[[File:AWS Security 5.PNG\|500px]]		[[File:AWS Security 5.PNG\|500px]]

Olibouban: /* The Lingoport Dedicated VM Restricted Access to the Repository */

2019-06-03T21:53:33Z

The Lingoport Dedicated VM Restricted Access to the Repository

← Older revision		Revision as of 21:53, 3 June 2019
Line 9:		Line 9:
	== The Lingoport Dedicated VM Restricted Access to the Repository ==		== The Lingoport Dedicated VM Restricted Access to the Repository ==
	[[File:AWS Security 2.PNG\|500px]]		[[File:AWS Security 2.PNG\|500px]]

			The first step in this deployment is to instantiate an AWS VM. The Customer IT adds only that VM to the list of specific IP's which can access the repositories. The only access provided is to version control systems such as Git (GitHub, Bitbucket, Gitlabs), TFS, or SVN.

			No customer data or systems (credit card information, live databases, client data, etc.) are granted access to the Lingoport Dedicated VM.

	== Restricted Access to the Lingoport Dedicated VM ==		== Restricted Access to the Lingoport Dedicated VM ==

Olibouban: /* The Customer Network without the Lingoport Suite */

2019-06-03T21:50:27Z

The Customer Network without the Lingoport Suite

← Older revision		Revision as of 21:50, 3 June 2019
Line 4:		Line 4:

	[[File:AWS Security 1.PNG\|500px]]		[[File:AWS Security 1.PNG\|500px]]

			The customer network before any Lingoport dedicated VM. It is expected to be a secure environment.

	== The Lingoport Dedicated VM Restricted Access to the Repository ==		== The Lingoport Dedicated VM Restricted Access to the Repository ==