Spyber Polymath approaches software engineering and systems administration under an uncompromising Zero Trust framework: "Never trust, always verify."
•
Least Privilege Access:All internal services, APIs, and administrative personnel operate with minimal necessary operational permissions. Standing superuser or root privileges are disabled in production.
•
Defense-in-Depth:Multiple independent verification layers protect our network perimeter, application code, containerized services, and data storage layers.
•
Continuous Verification:Every interaction across network boundaries requires cryptographic identity assertion, token validation, and contextual access checks.
SECTION 02
2. Linux VPS & Cloud Infrastructure Hardening
Our production Linux servers (Ubuntu/Debian LTS) and container clusters adhere to rigorous server hardening baselines:
•
SSH & Remote Access:Password authentication is disabled. Access is strictly enforced via Ed25519 cryptographic SSH key pairs on custom non-default ports, protected by fail2ban and rate limiting.
•
Firewall & Port Isolation:Uncomplicated Firewall (UFW) and iptables rules enforce default-deny policies, exposing only necessary web ports (80/443) behind reverse proxies.
•
Automated Kernel & Patch Management:Automated security updates (unattended-upgrades) ensure Linux kernels, OpenSSL packages, and system dependencies receive critical CVE patches immediately upon release.
•
Container Security:Docker containers run strictly with rootless execution, read-only root filesystems where feasible, and explicit memory/CPU cgroup resource limits.
SECTION 03
3. Cryptography & Transport Security
We enforce modern cryptographic standards across all transport channels and persistent data stores:
•
TLS 1.3 Strict Enforcement:All web endpoints require modern TLS with Perfect Forward Secrecy (PFS) using strong ciphers (ChaCha20-Poly1305, AES-256-GCM). Deprecated protocols (SSLv3, TLS 1.0, TLS 1.1) are permanently rejected.
•
Security Headers Suite:We serve strict HTTP headers: Content-Security-Policy (CSP), Strict-Transport-Security (HSTS with max-age=63072000; includeSubDomains; preload), X-Content-Type-Options: nosniff, and X-Frame-Options: DENY.
•
Storage Encryption:Persistent block storage volumes, automated database snapshots, and off-site backup archives are encrypted using AES-256 with managed key rotation.
SECTION 04
4. Secure Software Development Lifecycle (SSDLC)
Application development integrates automated security gates throughout the engineering lifecycle:
Spyber Polymath maintains a formalized Cyber Incident Response Plan (CIRP) to rapidly identify, contain, and remediate anomalous security events:
•
Phase 1: Detection & Triage:Continuous telemetry and log aggregation trigger real-time alerts to the on-call systems administrator upon detecting repeated failed auth or privilege escalation anomalies.
•
Phase 2: Isolation & Containment:Compromised VPS instances or containers are immediately quarantined via network isolation while volatile memory forensics are collected.
•
Phase 3: Remediation & Hardening:Vulnerabilities are patched, system images rebuilt from verified golden templates, and all access tokens revoked and reissued.
•
Phase 4: Statutory Notification:In the event of a confirmed breach involving sensitive personal data, we notify affected clients and relevant regulatory bodies (including the Indian Computer Emergency Response Team - CERT-In) in compliance with statutory deadlines.
SECTION 06
6. Disaster Recovery & High Availability
To safeguard against data loss, catastrophic infrastructure outages, or localized hardware failures, we maintain redundant disaster recovery topologies:
•
Automated Off-Site Backups:Nightly incremental and weekly full database backups are encrypted and mirrored across distinct geographical regions.
•
Recovery Time & Point Objectives:Our operational targets for critical production systems aim for an RPO (Recovery Point Objective) of under 4 hours and an RTO (Recovery Time Objective) of under 2 hours.
•
Disaster Simulation Testing:Backup restoration protocols and server failover scenarios undergo quarterly validation drills.
