Before you begin

  • No technical knowledge is required to read this article. Readers should have a basic understanding of signing in to Encrisoft and using their OneAuth app

Introduction

Imagine leaving your office door unlocked with a sign that says, "Please don't steal anything." Not exactly a winning security strategy, is it?

Online accounts need the same level of care. A password alone cannot protect an account from every possible threat, which is why security works best in layers. Encrisoft is designed with multiple security measures that help protect your organisation's account, control access, secure data in transit, and monitor suspicious activity. These measures work together to make unauthorised access more difficult and help protect your organisation as you use the platform. So, what happens behind the scenes when you sign in to Encrisoft? Let's break down the seven security layers and what each one does.

1. Multi-Factor Authentication (MFA): More Than Just a Password

A wide, blue cybersecurity banner promoting multi-factor authentication (MFA) for Encrisoft. The heading reads “Multi-Factor Authentication”, with the subtitle “Add an extra layer of security to your Encrisoft account.” On the right, a laptop displays a sign-in screen, a smartphone shows an authentication code prompt, and a glowing shield with a padlock symbolises secure account access. The Encrisoft logo appears in the top-right corner.

A password gets you to the door. Multi-factor authentication checks that you have the right key, too.

Multi-factor authentication (MFA) adds another verification step when you sign in. Instead of relying on your password alone, you must provide an additional form of proof that you are authorised to access the account.

How does it work in Encrisoft?

When you sign in to your Encrisoft account, the process works as follows:

  1. Enter your email address: This identifies the account you want to access.
  2. Enter your password: Encrisoft checks your login credentials.
  3. Open the OneAuth app: After the initial login step, you'll be prompted to enter an authentication code.
  4. Enter your authentication code: Open OneAuth and enter the current code displayed in the app.
  5. Access your account: Once your credentials and authentication code have been verified, you can proceed into Encrisoft.

The authentication code changes approximately every 30 seconds. That means you need to enter the current code before it expires. If it expires before you finish, use the new code displayed in OneAuth.

Why does this matter?

Imagine someone discovers your password. Without the additional authentication step, they may be able to attempt to sign in using that password alone. MFA adds another barrier, making it harder for someone to access your account using only stolen login credentials.

A quick security tip: Never share your authentication code with anyone. Even if someone claims to be from your support team, your code is yours alone.

2. Password Protection: Your First Line of Defence

A wide blue cybersecurity banner featuring the Encrisoft logo in the top-left corner. White text reads, “Weak passwords compromise strong systems. Stay secure with Encrisoft.” On the right, a glowing blue shield with a digital keyhole and circuit patterns hovers above a luminous, digital hand, symbolising password protection and secure access.

Your password is the first checkpoint when you sign in to Encrisoft. It helps verify that the person attempting to access your account has the correct credentials.

But here's the thing: a password like password123 is practically an invitation for trouble. Let's not make a cybercriminal's job any easier!

How does it work?

When you enter your email address and password, the authentication process checks whether the credentials match an account. If the credentials are valid, you can proceed to the next authentication step. In Encrisoft's sign-in process, that includes the OneAuth authentication code.

A strong, unique password helps reduce the risk of someone guessing your credentials or gaining access through a password you've reused on another website.

How can you protect your password?

  • Use a long, unique password that is difficult to guess.
  • Avoid predictable combinations such as your name, birthday, or common words.
  • Never reuse your Encrisoft password across multiple platforms.
  • Do not share your password with colleagues.
  • Consider using a reputable password manager to store your credentials securely.

Remember: Your password and MFA work together. One protects the initial login, while the other adds an additional verification step.

3. Access Control Lists (ACL): Not Everyone Needs Every Key

Imagine giving every employee in your organisation access to every document, department, and piece of information, even when their job has nothing to do with it. Sounds like a recipe for confusion, doesn't it?

That's why access control matters.

Access Control Lists (ACLs) help determine who can access particular resources and what they are permitted to do with them. In Encrisoft, access is organised around the people in your organisation, their departments, and the type of access they need.

Encrisoft People page showing the Departments tab, a Security Awareness department, the External Participants tab, and the Create department button.

How does it work in Encrisoft?

Encrisoft's People section allows you to manage employees, organise them into departments, and manage access to the platform.

Here's how it works:

1. Organise employees into departments

From the People section, you can create departments based on how your organisation is structured. For example, you might have a Security Awareness, Human Resources, or Finance department.

Organising employees into departments helps you manage people according to their roles and responsibilities, rather than treating everyone as though they need access to the same information.

2. Manage access according to responsibilities

Not every employee needs access to everything on the platform. Someone working in one department may need information relevant to their team's activities, while another employee may require access to a different set of information. Organising employees into departments helps support this separation, so access can be managed according to the needs of the organisation.

3. Manage external participants separately

Encrisoft also provides an External Participants section for people such as contractors who are not officially employed by your organisation. Unlike internal employees who may belong to different departments, external participants have more limited access to organisational information. This helps distinguish external collaborators from internal team members and limits the information available to them according to their access permissions.

Why is this important?

  • Limits unnecessary access: People do not need access to information unrelated to their responsibilities.
  • Supports departmental organisation: Employees can be organised according to the teams they work with.
  • Helps manage external access: Contractors can be handled separately from official employees, with more limited access to organisational information.
  • Reduces exposure: Limiting access can help reduce the amount of information exposed if an account is compromised.

Think of it this way: Your Finance team doesn't need the same access as your Security Awareness team, and an external contractor doesn't necessarily need the same access as a full-time employee. Everyone gets access appropriate to their role.

That's the idea behind access control: give people access to what they need, without automatically opening every door.

4. TLS 3.0: Keeping Your Connection Secure

Every time you sign in to Encrisoft, your browser exchanges information with the platform's servers. This information needs to be protected from unauthorised access while it travels across the internet. That's where Transport Layer Security (TLS) comes in. TLS helps secure the connection between your browser and Encrisoft, protecting the information exchanged as you use the platform.

How does it work?

When you connect to a website over HTTPS, TLS helps establish a secure connection between your browser and the website's server.

It provides three important protections:

  • Encryption: Helps keep sensitive information private by preventing unauthorised parties from reading data as it travels across the connection.
  • Data integrity: Helps detect if information has been altered while being transmitted.
  • Authentication: Helps your browser verify the identity of the server it connects to.

Why is this important for Encrisoft?

When you use Encrisoft, you may enter login credentials, complete authentication, and access information relating to your organisation. Securing the connection helps protect this information while it travels between your browser and the platform. Without appropriate connection security, sensitive information could be exposed to interception or tampering. TLS helps reduce these risks by protecting data in transit.

Think of it as a secure tunnel between you and Encrisoft. Even though your information travels across the internet, the connection is designed to help keep it protected from unwanted eyes.

The bottom line: A secure connection is an important part of protecting your Encrisoft account and the information you access on the platform.

5. Bot Detection: Keeping Automated Trouble in Check

Illustration showing Encrisoft's bot protection concept, highlighting verification checks and security measures designed to identify suspicious automated activity.

Not every visitor to a website is a real person. Some are bots, and while not all bots are harmful, some can be used to automate suspicious activity or abuse online services. Encrisoft uses Cloudflare Turnstile on protected workflows to help distinguish legitimate user interactions from automated requests.

How does it work?

When you perform certain actions on Encrisoft, you may be asked to complete an additional verification step before continuing.

Here's what happens:

  1. Verification begins: Cloudflare Turnstile helps assess whether the interaction is legitimate or potentially automated.
  2. The request is checked: The verification process evaluates the interaction according to the applicable security controls.
  3. The result determines what happens next: If verification is unsuccessful, the request may be rejected, or you may be asked to try again.

Encrisoft also uses Cloudflare's edge-security infrastructure to help identify and mitigate malicious traffic, including distributed denial-of-service (DDoS) attacks. Depending on the security controls involved, suspicious requests may be challenged or blocked before reaching the application.

Why is this important?

Bot detection helps reduce automated abuse while allowing legitimate users to access the platform.

Think of it as a security checkpoint: most legitimate visitors should be able to proceed, but suspicious activity may need an extra check before being allowed through.

6. Security Monitoring: Keeping an Eye on What's Happening

Infographic explaining Encrisoft security monitoring, with examples of security activity that may be recorded, including sign-in attempts, failed authorisation attempts, access and permission changes, administrative operations, security-setting changes, and application events. A central shield represents monitoring and accountability, while the right-hand section illustrates possible responses to security concerns, including additional verification, reviewing records, restricting access, investigation, and corrective action.

Security isn't just about preventing unwanted access. It's also about having relevant information available when something unusual happens.

Encrisoft incorporates security controls and auditing mechanisms to help protect customer accounts, organisational information, and platform operations.

How does it work?

Encrisoft monitors and records relevant activities to support security, accountability, and investigations.

These may include:

  • Authentication and sign-in activity: Records relating to attempts to access accounts.
  • Failed authorisation attempts: Instances where a request to access a resource is not authorised.
  • User access and permission changes: Changes that affect who can access particular resources.
  • Sensitive administrative operations: Records of important actions performed within the platform.
  • Security-setting changes: Changes to settings that affect security.
  • Significant application errors and operational events: Events that may help explain unexpected behaviour or operational issues.

Encrisoft also processes activity associated with its cybersecurity awareness features, including authorised phishing simulation results, training progress, and assessment outcomes. This information supports security-awareness reporting and organisational improvement.

What happens when a potential security issue is identified?

The response depends on the nature of the issue. If a request fails an applicable security check, Encrisoft may deny the request or require additional verification. Other security concerns may be assessed according to their nature and severity. Appropriate responses can include reviewing relevant records, restricting affected access, investigating the issue, and applying corrective measures.

Why is this important?

Security records help provide information about what happened, which activities were involved, and what may need further investigation.

Think of security monitoring as keeping a record of important events in a building. If something unusual happens, those records can help the security team understand the situation and decide what to do next.

7. Web Application Protection: Helping Keep Malicious Traffic Out

Illustration showing how Encrisoft's web application is protected, with Cloudflare's security layer filtering suspicious internet traffic, including DDoS attacks, malicious bots, and unauthorised access attempts, while legitimate traffic proceeds to Encrisoft. The diagram highlights DDoS protection, Cloudflare Turnstile bot verification, traffic filtering, and application-level security controls.

Web applications receive requests every time someone visits a page, signs in, or interacts with a feature. Most requests are legitimate, but some may be designed to disrupt services or exploit weaknesses.

Encrisoft uses Cloudflare for DNS and edge-security services, alongside application-level security controls, to help protect its platform and customer information.

How does it work?

Encrisoft uses several measures to help protect its web applications.

1. DDoS protection

Cloudflare provides protection designed to help mitigate distributed denial-of-service (DDoS) attacks against supported, protected services. These attacks attempt to overwhelm an online service with excessive traffic. DDoS protection helps reduce their impact and supports the availability of protected services.

2. Bot protection

As discussed in the previous section, Encrisoft uses Cloudflare Turnstile to provide additional verification for protected workflows and help reduce automated abuse.

3. Application-level security

Encrisoft also uses server-side authentication, authorisation, input validation, and organisation-scoped access controls. These controls help ensure that requests are checked, actions are authorised, and access is restricted according to the relevant organisation and permissions.

Why is this important?

These measures address different security risks and work together to help protect Encrisoft. For example, Cloudflare's edge-security services help protect against certain types of malicious traffic, while application-level controls help prevent unauthorised actions within the platform.

Think of it as protecting both the entrance and the rooms inside a building. The outer security measures help deal with suspicious traffic, while the internal controls help ensure people can access only what they're authorised to use. Together, these measures form part of Encrisoft's layered approach to protecting its applications and customer information.