Hardening and Security Configurations at CrowdHandler

CrowdHandler implements security hardening and baseline configurations on all systems supporting our service to minimize vulnerabilities. Our hardening procedures include:

AWS Configuration and Hardening

All AWS services we utilize are configured according to AWS security best practices:

  • RDS MySQL - RDS security groups, parameter groups, and options are used to restrict access and enforce encryption, audit logging, complex passwords, etc.
  • Lambda - Execution environments are locked down and all traffic uses VPC endpoints. Environment variables are encrypted using KMS.
  • S3 Buckets - S3 buckets are not public, and bucket policies/ACLs are used to enforce access controls. Versioning and encryption are enabled.
  • IAM - IAM policies are least privilege, MFA is required, and password policies are strong. Creds are rotated regularly. API keys are not used.
  • CloudFront - CloudFront distributions require TLS, field encryption is on, and access is restricted based on origin requirements.
  • EC2 servers - Where used, servers are in private subnets, follow a secure baseline config, have limited ports/protocols/ciphers open, and are on a patch schedule.

Patch Management

We maintain automated patch management policies across all of our infrastructure:

  • RDS database - Auto minor version updates are enabled to automatically patch DBs. Major version upgrades are also performed regularly based on AWS release schedules.
  • Lambda runtime - We update to the latest supported Lambda runtime libraries and environment to pick up available patches.
  • S3/CloudFront - These services are automatically updated by AWS and require no customer patch management.
  • EC2 servers - Where used, servers follow a regular patch schedule for all updates. Patching is automated as much as possible using tools like Systems Manager.

CrowdHandler's hardening and configuration policies are designed to reduce attack surface and vulnerabilities across the systems that support our service. Automated patching, least-privilege access and security controls aim to maintain continuous compliance and maximum infrastructure protection according to best practices.