EspoCRM Advise on Security Checklist

[espofam]

Hi, I'm new to EspoCRM. My customers are particularly concerned with security. Hope to get advice from the community and team on these aspects and if EspoCRM supports the security checklist out of the box. Or directions on how I could go about taking care of those requirements. Thank you.

Database Encryption:
- Sensitive data to be encrypted using AES (256-bit) for data at rest.
- User passwords are hashed using bcrypt or Argon2.

Authentication and Authorization:
- Multi-factor authentication
- Strong password policies and role-based access control
- Use of token-based authentication for secure sessions.

SQL Injection Prevention:
- Use of prepared statements and parameterized queries.
- Inputs are validated and sanitized regularly.

Cross-Site Scripting (XSS) Protection:
- User-generated content sanitization and CSP headers implementation.
- Secure frameworks automatically handle output encoding.

Cross-Site Request Forgery (CSRF) Protection:
- Anti-CSRF tokens integration into forms and sensitive actions.

Security Features:
- Comprehensive logging and code has been through vulnerability assessments

[yuri]

Database Encryption:
- Sensitive data to be encrypted using AES (256-bit) for data at rest.
- User passwords are hashed using bcrypt or Argon2.

Passwords are hashed with bcrypt.

We don't have data encryption feature. We do encrypt 3rd party passwords and secrets on application level (for example, if user stores an SMTP password)

Authentication and Authorization:
- Multi-factor authentication
- Strong password policies and role-based access control
- Use of token-based authentication for secure sessions.

All yes. Except we don't have a password expiration feature.

SQL Injection Prevention:
- Use of prepared statements and parameterized queries.
- Inputs are validated and sanitized regularly.

Our policy is not to write SQL in codebase. Everything is accessed via the ORM and Query Builders.

We have input validations. We don't sanitize input much deliberately. The nature of the software is such that excessive sanitization is not an option.

Cross-Site Scripting (XSS) Protection:
- User-generated content sanitization and CSP headers implementation.
- Secure frameworks automatically handle output encoding.

Proper CSP headers are used.

Output is encoded in templates by means of the framework (in most cases, in large scale applications there will be always cases when something is encoded manually).

Cross-Site Request Forgery (CSRF) Protection:
- Anti-CSRF tokens integration into forms and sensitive actions.

We have sensitive cookie protected with the SameSite parameter.