The ‘Hidden Gems’ Series < The What & How of Super Security >
Our mission: To help all clients using our technology, whether using their own Private Label brand or the Now Sorted brand … this is to help you. Created • Owned • Managed • Secured • in Australia
Background
Recent press article > Financial business breach •
Just recently, an article in Money Management referred to an organisation’s cyber-security breach.
•
The firm involved was heavily penalised.
•
It’s at times like this that, at Now Sorted, we need to reassure our clients on our security protocols.
•
We stress our approach to security in almost every communication … and always will.
•
This Gem article explains our security protocols.
•
If you have any questions or concerns, please get in touch.
Let’s start with fundamentals …
Before the technicalities, some basics > •
One of the weakest links in data and identity protection is the frequent human tendency to unwittingly give away login details, such as usernames and passwords.
•
These should never be shared with anyone except the closest and most trustworthy persons, such as, maybe, a close family member and trusted professional adviser(s).
•
If an unsolicited phone call or email arrives suggesting a suspicious benefit (an unexpected refund, etc.) and requesting screen access to an account – hang up!
•
Another ‘no-no’ is logging into an online vault using nonsecure wi-fi, as used in public places (e.g. shops).
•
And if you receive a message / email asking you to click a link from a source you do not recognise, do not do it. There is evidence that unintended personal carelessness leads to victimisation by criminals using these ruses. Be security aware.
10 plus 1 Security Protocols = Super Secure The protocols on a page (with active links) (click on the page image to download it)
The protocols explained …
Protocols 1 to 4 1. Your password requires at least 8 characters, a number, a capital letter, and a symbol, to login into the system. (Your keyboard comprises 47 keys - and double that when you press the Shift key; this means that an 8-character structured password enables trillions of permutations; the more characters you use, the greater the number of permutations to deny unauthorised entry.)
2. Usernames & passwords are encrypted to stop any attempts at ‘sniffing’ the password. (Criminal elements often use apps to surreptitiously ‘sniff’ vault entry methods while in, say, public places – Now Sorted’s end-to-end encryption methodology helps block such attempts.)
3. Two-factor authentication (validating that a User is who they say they are) is required if wrong password is used or is forgotten. (Receiving a message or email request to input a code to gain access to a sensitive site is becoming a standard option … we’ve had it for years and it can be turned on under Profile in your vault.)
4. Role based security is used to limit access to data within the system. (We have built ‘user roles’ into the system so that anyone pretending they have a non-assigned role is denied vault entry.)
The protocols explained …
Protocols 5 to 8 5. All data travelling between the users browser and application servers are encrypted using Transport Layer Security technology (TLS). (This is sophisticated cryptology to communicate across a network in a way that prevents eavesdropping and tampering.)
6. Advanced Encryption Standard 256 (AES256) is used as the standard for data and documents stored and encrypted within the database. (AES encryption has become the industry standard for data security. AES comes in 128-bit, 192-bit, and 256-bit implementations, with AES 256 being the most secure; with the kind of computers currently available to the public it would take literally billions of years to break this type of encryption.)
7. All servers are behind firewalls with specific access control lists that only allow authorised traffic flows. (This protocol confirms that the gateways to the system are well armed and protected against unauthorised entry.)
8. There is no access to user data without valid credentials being passed. (As the previous protocols indicate there are multiple barriers to suspicious entry attempts and no access is possible without all credentials being verified.)
The protocols explained …
Protocols 9, 10, and 11. 9. Servers are located in Australia and are security hardened to have a minimum set of services running. (It is strict Australian jurisdiction – not US - that governs access to the Amazon servers used to store Now Sorted client data and documents.)
10. Each Now Sorted vault - and its data - is separate from all other vaults. (Which means that even if – ‘a very big if’ - one vault ever fell victim to a hack – e.g. by unintended client carelessness – all other vaults would retain their integrity because they are all separated.)
11. Integrated into the previous 10 protocols, we added a highly secret eleventh, the details of which are known only to three stakeholders in the company. (This extremely robust element will never be revealed.)
Additional points on security: 1. Q > Can any person at Now Sorted Pty Ltd see client data? A > Absolutely not. The Now Sorted administration system allows us to know when data and documents have been entered but never what has been entered. 2. Q > Who may see vault data and documents? A > Only the person (User) who signed up for the Now Sorted licence, unless the licensed User grants ‘permissions’ for invited trusted others to view and/or edit and/or delete data and documents. Granting permissions is at the sole discretion of the User.
And finally …
Our protocols enable peace of mind for all •
The very architecture of Now Sorted is built around extremely high level security; protocols PDF is here.
•
End-to-end encryption is always ‘on’.
•
We have also built ‘not-for-publication’ hurdles into the software to deny hacker access when trying to trick users into giving away vault access.
•
We invite any registered user requiring further reassurance to contact us at any time.
•
Here are two government websites with tips on protecting against identity theft: one is here and the other is here.
To Contact Us Clarifying notes • We have the great privilege to work with professional advisers who have introduced this vault technology to their clients. • Some have used their practice’s private label brand and others have used the Now Sorted brand: the technology is exactly the same in both cases.
• If you have been introduced by a professional adviser, and you have a question, the best thing is to contact them directly; if they can’t answer it, they will get in touch with us. • If you have come to us directly, by all means contact us as per the detail below – we are here to help in any way we can. For general enquiries
[email protected]
For technical support:
[email protected]
For Affiliate enquiries:
[email protected]
Disclaimer: Please note that we at Now Sorted specialise in secure, organising technology and do not give advice on any accounting, legal, or financial planning matters … such advice is the province of qualified professionals in these fields. Now Sorted Pty Ltd ABN 76 168 812 655 © All rights reserved