Basic security
Keeping laptops and phones secure is vitally important. We're a software company and many of us have access to secure systems (both our own and our customers).
The following guidelines apply to how we physically secure our laptops and mobile devices that may contain customer or user data.
General
- Make a note of serial numbers, model information
- Two Factor Authentication and strong passwords
- Keep your operating system and applications up to date
- Lock your device when you are away from it.
- Don't leave your devices unattended in an unsecured area.
- Install a device tracking and remote data wipe tool such as Prey.
Desktop
- Encrypt your hard drive
- Mac users must add a firmware password
- Non Mac users must add a BIOS password
- Disable automatic login for OSX
- Auto logout after five minutes inactivity
- Require password after screensaver or sleep
- Only work from company laptops or follow BYOD policy
- Install iCloud/Find My Mac
Mobile
We all use personal mobile devices, so your options are either not to add any company accounts to your phone (this includes Slack, Gmail etc), or to follow the checklist below.
- Ideally disable finger print login (or at least have TouchID on).
- Create a 6 digit passcode (or better)
- Turn on auto lock after 5 mins
Using passwords
- Use a unique password for every account you create.
- Use a tool like pwgen or 1password to generate random passwords.
- Use a tool like GnuPG to encrypt passwords if you need to share them with somebody.
Security report
When someone finds a possible security issue in our software, we encourage them to report it to our security@d.foundation email address.
When an email comes in through this channel, reply quickly with confirmation (and CC security@d.foundation so others know that it has been handled) and the information for our PGP key, which is located at https://d.foundation/security.
