---
title: 'Security mechanisms and technologies'
section: 'Concepts'
weight: 1
description: A layered approach to platform security — physical, network, OS, application, and data-storage layers, and the mechanisms implemented at each level.
related:
- security/data-security
- security
- operations/backup-and-restore
- eu-compliance
---
import Alert from '@/components/docs/Alert.astro';
Modern systems require a layered approach to security, where each layer performs specific functions and interacts with the others to [create a comprehensive security system](#implemented-security-mechanisms). Let's look at the key layers, their mechanisms and technologies, and the best practices for implementing them.
## System security levels
### Physical layer
Physical security is the foundation of the entire defense system. It aims to prevent unauthorized
access to hardware resources and infrastructure.
- **Server rooms and data centers:**
Equipment must be located in secure data centers with multi-level access control systems: biometric authentication, RFID cards, and video surveillance. The premises must be equipped with fire extinguishing, climate control, and protection against voltage fluctuations.
- **Perimeter protection:**
Physical barriers (for example, double door locks), motion sensors, and 24/7 security are used. For critical facilities, the principle of "defense in depth" applies — multi-layered security with regular vulnerability audits.
- **Infrastructure redundancy:**
Backup power supplies (UPS, generators), duplicated communication channels, and distributed data centers (geographic isolation) are used to minimize risks.
### Network layer
This layer ensures the security of data transmission, prevents attacks on network resources, and controls traffic.
- **Firewalls:**
Modern NGFWs (Next-Generation Firewalls) analyze traffic at the application level, blocking suspicious sessions. For example, you can configure rules to deny outbound connections to the Tor network or to block ports that the system does not use.
- **Protection against DDoS attacks:**
Cloud-based services (for example, Cloudflare) filter traffic by recognizing anomalous patterns. Local solutions include rate limiting and blackhole routing.
- **Network segmentation:**
Networks are divided into VLANs, DMZs, and isolated subnets. Dedicated APNs (Access Point Names) are used for IoT devices to prevent them from interacting with corporate traffic.
- **Intrusion detection and prevention systems (IDS/IPS):**
Tools like Snort or Suricata analyze packets in real time, blocking attacks based on signatures and behavioral anomalies. Integration with SIEMs (for example, Splunk) enables an automated response.
- **Traffic encryption:**
Mandatory use of TLS 1.3 with modern ciphers (AES-GCM, ChaCha20). For VPNs, the WireGuard or IPsec protocols are recommended instead of legacy PPTP/L2TP.
### Operating system layer
OS security is achieved through strict configuration, timely updates, and process isolation.
- **Containerization (Docker, Kubernetes):**
Each service runs in an isolated container with limited rights. For example, a web server is assigned a separate user with no access to system files.
- **Mandatory Access Control (MAC) modules:**
- **SELinux:** Implements label-based policies to prevent the execution of unsigned binaries.
- **AppArmor:** Profiles applications, restricting their access to the file system.
- **Auditing and monitoring:**
Tools like Auditd or Osquery monitor changes to critical files (for example, /etc/passwd). ELK stacks (Elasticsearch, Logstash, Kibana) or Grafana are used to analyze logs.
- **Updates and patches:**
Automation via utilities like unattended-upgrades (Linux) or WSUS (Windows). For critical systems, pre-test updates in a staging environment.
### Application layer
Application security requires a combination of built-in mechanisms and adherence to development standards.
- **Authentication and authorization:**
- Multi-factor authentication (MFA) via OTP, U2F keys, or biometrics.
- OAuth 2.0/OpenID Connect implementation for delegated access.
- RBAC (role-based access control) with least privilege.
- **Web attack protection:**
- **CSRF:** Token generation using cryptographically secure algorithms (HMAC-SHA256).
- **XSS:** Input sanitization via libraries like DOMPurify, and a CSP implementation with the `default-src 'self'` directive.
- **SQL injections:** Use of an ORM (Hibernate, SQLAlchemy) or prepared statements.
- **Secure development (DevSecOps):**
Integrate vulnerability scanners (OWASP ZAP, SonarQube) into the CI/CD pipeline. Conduct regular pentests and code reviews.
### Data storage layer
Ensure the confidentiality, integrity, and availability of data.
- **Encryption:**
- **At rest:** Using LUKS (Linux) or BitLocker (Windows) with AES-256.
- **In transit:** TLS for transmission between servers and clients.
- **Keys:** Storage in a hardware HSM (Hardware Security Module) or a cloud KMS (AWS KMS, HashiCorp Vault).
- **Redundant copying:**
3-2-1 strategy: 3 copies, on 2 different media, 1 off-site. Automation via BorgBackup or Veeam.
- **Access control:**
- **RBAC/ABAC:** Dynamic rights management based on user attributes (job title, location).
- **Audit:** Logging of all operations (CREATE, UPDATE, DELETE) with integration into a SIEM.
Multi-layered security requires not only the implementation of technology. It also requires
constant monitoring, employee training, and adaptation to new threats. Regular audits, the use of
standards (ISO/IEC 27001, NIST), and process automation are key to long-term sustainability.
## Implemented security mechanisms
### Network layer security
- **Incoming and outgoing traffic filtering** is configured to block unauthorized connections. To increase security, it is recommended that you restrict system access to trusted IP addresses (over the Internet) or to connections via VPN only.
- **Use a dedicated APN** in the SIM card settings of telemetry (IoT) devices. This isolates the devices from general Internet traffic and increases data protection.
- Access to the web interface is via the **HTTPS protocol** (TLS/SSL certificates), which encrypts traffic between the client and the server.
### Operating system layer protection
- **Process isolation** increases resilience to system failures and hacks. On an IoT server, each part of the system is isolated using Docker containerization. Containerization isolates the different parts of the system from each other, which minimizes the possible damage from attacks and failures.
- The use of AppArmor, SELinux, or Parsec modules (optional). **Security modules** provide additional protection at the operating system level, strengthening access control and helping to prevent unwanted actions in the system.
- **Policy customization**: create strict security policies to restrict access to critical resources.
- **Security audit**: regularly analyze logs to identify suspicious activity.
### Application layer protection
- The web part of the system is protected against attacks like **Cross-Site Request Forgery (CSRF)**. Built-in mechanisms generate a unique token for each form, preventing request forgery. SameSite cookie attributes and Referer checks are also used.
- The system has built-in protection against **Cross-Site Scripting (XSS)** attacks, including the filtering of user input to prevent the injection of malicious JavaScript code.
- Content Security Policy (CSP): configuring policies to restrict the sources from which scripts and other resources can be loaded.
- Data escaping: automatically escape HTML, CSS, and JavaScript in user input.
- Interaction with the database is performed using an **ORM module**, which has built-in protection against SQL injection (it cannot execute arbitrary SQL code) and also logs queries to detect suspicious activity.
### Data storage layer protection
- **Data encryption:** uses encryption algorithms (for example, AES-256) to protect data on disk and in transit.
- **Backup:** data is backed up regularly and stored in secure storage.
- **Access control:** Role-Based Access Control (RBAC) and auditing of all data operations in the storage are used.