Security
Security is a shared responsibility. The web platform should use HTTPS, supported software, least-privilege access, secure configuration and controlled deployments.
- Use HTTPS for all public web traffic and do not introduce mixed HTTP/HTTPS content.
- Use strong authentication and multi-factor authentication where supported.
- Grant Sitefinity and infrastructure permissions according to job responsibilities and least privilege.
- Keep Sitefinity, .NET dependencies, container base images and third-party libraries supported and patched.
- Use approved CAPTCHA/anti-abuse controls on public forms where appropriate.
- Validate and encode user input. Do not trust query-string, form, API or CMS data by default.
- Maintain Content Security Policy and other security headers appropriate to FSCJ integrations.
- Store secrets in approved configuration/secrets mechanisms, never in source control.
- Use logging and monitoring sufficient to investigate errors and suspicious activity.