Document toolboxDocument toolbox

(sv) Application & System Security

Owned by Maciej Zabielski
Last updated: Sept 12, 2024
2 min read

Application Access Control

Access to the application is controlled using various security settings based on users, roles and groups. To find out more about application-level security, please refer to users manual: (sv) Säkerhet

The application server is capable of handling user authentication internally, but can also use federated authentication services based on SAML, for example, corporate ADFS or Azure based SSO.

For more information on SSO, please refer to (sv) ADFS / AZURE / SAML Single Sign On



Internal User Management

Information for customers willing to use internal user database:

  • User password is stored in hashed "salted" form

  • The password is required to be passed over a secured connection

  • System provides brute force password crack prevention (the account is locked for 60 seconds after three failed attempts)



External user management

When external (federated) user management is used, the password is never passed to application server. 

Full authentication process takes place within the external provider and only final result of the authentication is passed on to our system.

System Monitoring

All vital elements of the infrastructure are monitored. In case an abnormal situation is detected, a system support engineer is alerted and can take actions as quickly as possible.

Metrics being monitored include:

  • application availability in general

  • application server load (CPU load, number of processes, response time)

  • storage system (free space, load, availability)

  • database servers

  • network status

  • all other services used by the application server 

System Log Management

Application server environment is using a log management system that gathers, filters and manages logs from application servers and other components of the system.

This allows us to identify any problems or abnormal operation quickly. 

Antivirus protection

User files uploaded and stored in a file repository are scanned using a server installed anti-virus software.

E-mail server used for sending out notifications is using an email scanner anti virus software to eliminate the risk for spreading infected files through e-mails. 

Application Server Security Patching

  1. Security updates installed once a week, if a critical security update is released it is installed as soon as possible

  2. Updates are installed and tested in a staging environment before installing to production servers