KIIK National Image
Union Catalogue
Home / Security & Compliance

Security & compliance

Security controls already installed in the KIIK demo, stated honestly — separated from what requires an organisational / certification programme at national production scale.

01

Brute-force resistant + 2FA

Login is rate-limited: 5 failed attempts / (email + IP) → 60-second lockout, plus an IP cap of 10/min. Every failed attempt & lockout is recorded. Accounts can enable two-factor (TOTP) for a second factor. (FR-IAM-010, 011)

02

Transport & hardening

Full HTTPS (TLS, Let's Encrypt certificate) · HSTS · CSP (source restrictions) · anti-clickjacking · nosniff · Referrer-Policy · Permissions-Policy · session cookies Secure + HttpOnly.

03

Application layer

CSRF protection on every form · passwords hashed (bcrypt) · parameterised queries (ORM — anti SQL-injection) · output escaped (anti-XSS) · masters outside the web root (only after payment).

Control map → URS requirements

Mapped to NFR-SEC & Section C (compliance). Honest status: Built = active in the demo · Partial = foundation present, needs production hardening · Programme = requires organisational/certification processes, not code alone.

ControlWhat is installedStatusURS
Anti brute-forceRate-limit + lockout per (email+IP), IP cap 10/min, attempt loggingBuiltIAM-010/011
Secure sessionsID regenerated after login, Secure+HttpOnly cookies, auto-expiry on inactivityBuiltIAM-015/017
TLS / transportFull HTTPS + HSTS 1 year (includeSubDomains)BuiltNFR-SEC-1
Security headersCSP · X-Frame-Options · nosniff · Referrer-Policy · Permissions-PolicyBuiltNFR-SEC-3
OWASP Top 10CSRF, password hashing, ORM (anti-SQLi), escaping (anti-XSS), hardening headersBuiltNFR-SEC-3
Masters protectedFull-resolution files outside the web root; 404 from the web; only after paymentBuiltNFR-SEC-2
Audit trailLogin/failure/lockout logs; licence transaction trailPartialNFR-SEC-3, CR-6
PDPA 2010Privacy notice + data minimisation principle; consent & data subject rightsPartialCR-2
Two-factor (MFA)TOTP authenticator app · encrypted secret · single-use recovery codes · replay guard · attempt lockoutBuiltIAM-007/014
SSO · MyIdentityArchitecture ready; OAuth2/OIDC/MyIdentity federationProgrammeIAM-001/002
ISO/IEC 27001 (ISMS)Annex-A aligned technical controls; certification = audit + organisational policyProgrammeNFR-SEC-3
NACSA / CNIIHardening aligned to the guidelines; formal assessment at agency levelProgrammeNFR-SEC-1/3
Penetration testingBaseline guards installed; independent pre-launch pentestProgrammeNFR-SEC-3

Honest limits

  • PDPA, ISO 27001 & NACSA are not "code features" that can be ticked off as done. They are programmes: written policies, organisational access control, training, independent audit, and (for ISO) certification by an accredited body. The demo installs the technical controls that support those programmes — it does not claim the system is already "certified".
  • Brute-force resistant ≠ resistant to every attack. Lockout stops large-scale password guessing; MFA is now built (TOTP), but a WAF and continuous monitoring remain part of the production plan (full IAM + NFR-SEC-1).
  • The demo CSP allows 'unsafe-inline' for the existing inline scripts/styles; a production version should move to nonces/hashes for full hardening.
  • Full Zero-Trust (IAM), immutable audit, encryption-at-rest are phased national architecture components — specified in the URS, built in phases, not in this demo.

In short: this demo is password-guessing resistant & hardened to OWASP practice, with a clear path to full PDPA/ISO/NACSA compliance as an implementation programme — stated without overstatement.