cloud security

1. Securing user data

1.1. 256bit SSL

1.1.1. for paying users

1.2. Encrypted backups

1.2.1. geographically separated location

1.2.2. Daily backup, weekly copy

1.2.2.1. 500 GB

2. Securing against attacks

2.1. Rails built-in stuff

2.1.1. SQL injection

2.1.2. XSS (Ajax)

2.1.3. CSFR (authenticity token)

2.2. PCI DSS

2.2.1. Approved since 2012

2.2.2. Scans

2.2.2.1. every 3 months

2.2.2.2. XSS

2.2.2.3. SQL Injection

2.2.2.4. Versions of used software

2.2.2.5. Known threats

2.3. May 7, 2014, Teamsecur3: XSS vulnerability detected!

3. Securing user access

3.1. OAuth 2.0

3.1.1. External Logins

3.1.1.1. Facebook

3.1.1.2. Twitter

3.1.1.3. Google

3.1.2. External Services

3.1.2.1. Google Drive

3.1.2.2. Evernote

3.2. Two-factor authentication

4. Securing admin access

4.1. Access to admin UI

4.1.1. only with 2-factor token

4.2. Access to servers

4.2.1. IP v6 only

4.2.2. with IP filter and ssh