High Security · Custom-built
A high security collaboration system for a pharmaceutical company
A pharmaceutical company wanted to hold online events with doctors and its representatives, and security was a major concern. We built a defense in depth system with layered authentication and encryption, most of it invisible to the people using it.
The problem
A pharmaceutical company wanted a system for holding online events with doctors and pharmaceutical representatives. Security was a major concern: the system would carry sensitive information, and it had to stay safe even if part of it was compromised.
At the same time, the people using it are busy doctors and company representatives. A system that made them jump through hoops at every step would not get used.
What we did
We built a high security system using state of the art defense in depth, with multiple layers of authentication and encryption.
- Layers that stay out of the way. Many of the security layers are automated and hidden, which keeps the interface simple for doctors and representatives.
- Two layers of access control. Users are assigned roles, and data access is controlled both by the authorization system and by encryption with keys unique to each user. Getting past one layer is not enough to read the data.
- Keys kept off the server. Sensitive data is encrypted with keys that are never stored on the server, so an attacker who breaches it does not get the keys needed to decrypt it.
What changed
The company can hold online events with doctors on a system built to assume an attack will happen, without asking doctors and representatives to deal with that complexity themselves.