Following are all the areas of security that we have developed and constantly focus on improving as we advance our product with new features and new modules based on client requests.
Environment and Database Encryption
KYC Portal is an on-premise solution which allows our customers (the company that bought KYC Portal) to be in full control of the solution as well as the data within it. It is a solution that is installed on their preferred environment. It does not matter if it is a local server, virtual environment or any type of Cloud environment, KYC Portal is deployed within their infrastructure allowing them to be in full control of the low-level security mechanisms that are implemented on the server itself. This allows our customers to tailor the entire architecture of the server and the required level of security on the hardware itself. The architecture in fact varies on their requirements both regulatory as well as internal.
Whilst the out of the box offering of KYC Portal comes packaged with the free version of MySQL, our customers also have the option to upgrade this to the licensed version of MySQL (or MySQL as a service on Cloud) in order to enable encryption on the filing system where the database is located.
System Internal and External Modules
KYC Portal has various modules and features all of which are categorised based on the type of access that is required namely INTERNAL or EXTERNAL.
INTERNAL refers to all the modules of the product that are used by the employees of our customer. These modules are deployed on the servers that are sitting behind the firewall and accessed by internal employees. Usually access to such modules / servers is only via internal office protocols such as restricted / dedicated IP addresses, VPN and similar network restrictions. There are specific features / modules of KYCP that require access to the internet for them to be able to work. These include modules such as third-party screening for PEPs and Sanctions, company house data providers and SMS integration for added authentication. Whilst our customer has the option not to make use of these features altogether, we do have customers who open up access to specific URLs / ports on the internal servers so that the internal server of KYCP can reach and communicate with such third party services. Any such connection is also protected by SSL so that any data in transit is encrypted.
Separate from the above internal modules, KYC Portal comes packaged with a number of features that allow our customers to give access to their clients. These are called the EXTERNAL modules. There are features to send links to their clients to fill in forms, upload documents, conduct face to face meetings and fill in questionnaires. There is also a central console called the Customer Outreach Tool (COT) where our customers can give access to their B2B clients to manage their applications in their entirety. All of these modules are deployed on an external-facing server in the DMZ for security purposes. These modules would sit on a publicly available (web) server of our customer secured by all the protocols that they require. Such modules communicate with KYC Portal on the internal (application server) via the API connection of KYC Portal which is fully authenticated and secured via SSL.
System Access and Whitelisting
KYC Portal has two types of users, (i) internal users that usually consists of the compliance teams and operational users using the tool on a regular basis and (ii) clients who they give access to so that they can fill in the details requested. Such user access is governed and managed by our customer through the user management module of the product.
Internal users have a username (that our customers define when they create the user in the first place) and a password that needs to be filled in. On several repeated mistakes when entering the password the system will block-delay access for a few minutes for the user to retry later. Once these have been authenticated the user will be sent a six-digit code to their mobile number (also inputted by our customer when they create the user first time round) for two factor authentication (2FA). This is used to add an extra layer of security and ensure that the user logging in is indeed the right user. Since internal users usually work from the office or through a VPN, KYC Portal allows our customer to whitelist a range of IP addresses that they trust. Adding these ranges would mean that any internal user who is accessing KYCP from such an IP range will not be prompted with the 2FA message and would be able to login with just the username and the password. This approach will also allow any user that might be working remotely or from a different location to still login to KYC Portal however they would require the 2FA on their mobile to be able to login since they are not within a whitelisted IP range.
External users on the other hand will always have to verify their login with 2FA that is sent to their mobile phone. This adds a layer of security which is critical when dealing with external parties as it ensures the true identity of the person logging in.
The 2FA mechanism on KYCP works through a third-party provider whereby we send an SMS to the user in question or else via an authenticator app called Authy.
KYC Portal also offers the option of integrating with our customers internal authentication method such as Active Directory. This would allow them to have users synched with their authentication mechanism, automatically inheriting all the security policies that they have placed in their company.
Separate from all the above, when setting up users in KYCP they have full control on defining which programmes the users can access and also the ability to create ROLES themselves and assigning which RIGHTS are linked to the respective ROLE. “Rights” refer to the granular functionality within KYC Portal (such as Ability to Delete Document). They are in full control of defining these for each ROLE giving them the ability to manage what users can see and do in the system.
File Management and Uploads
There are features in KYC Portal that allow the internal or external users to upload documents (files) in the system itself. These would be any type of documentation that they require as part of their ongoing due diligence process (such as Proof of ID).
KYC Portal limits the type of files that can be uploaded based on the extension of the file itself. When the file is uploaded, it is encrypted at REST by a key that can only be deciphered by KYC Portal itself. This means that all files sitting on the server (or filing system of choice) cannot be accessed directly. Files can only be processed through KYC Portal user interface by a user that is authenticated in the system. If logged in as a user in the system, the user will be able to view such documents through KYC Portal’s embedded document viewer and the file can also be downloaded (if the user has the RIGHT to do so based on their ROLE). Such download will decrypt the file and store on the local device that the user is using.
There are other optional custom addons that we can offer based on a case-by-case basis such as third-party anti-virus applications that offer real time API based calls to check the files before being stored.
Pen Testing by third parties
Separate from all of the above, we conduct a yearly deep-dive review of our software with regulated third-party companies that specialise in pen testing of software. This is done purely on the software side of the product, and we always recommend that our customers conduct a separate pen-testing exercise when KYC Portal is deployed on their environment. The difference is that whilst we conduct pen-testing on the software itself, the second one provides a holistic pen-test of the software and the hardware/infrastructure that it is sitting on.
This yearly session of pen-testing focuses on the more granular aspects of security within the software itself ensuring that the new features that are being launched in the product have not created any kind of risk or breach of security. Such sessions analyse the way the code is communicating between modules, highlight potential breaches in access, low level scripting issues and much more. The result of which helps us in ensuring that the infrastructure of our customers is as secure as possible.