Security

Application Security

Revoking Access: In the event of a suspected security incident, Common Fate allows administrators to promptly revoke access sessions before their scheduled expiration..

Audit Trail Events: Common Fate maintains a comprehensive audit trail, recording key events to facilitate tracking and analysis of system activities for security and compliance purposes.

Disaster Recovery: Common Fate uses managed databases such as AWS RDS and supports point-in-time recovery.

Common Fate assigns roles to your existing users: We adopt the principle of least privilege when developing integrations for Common Fate. Wherever possible, our integrations only have permission to assign roles to users, rather than creating new roles or users.

Third-Party Penetration Testing: We conduct assessments through third-party penetration testing to identify and address potential vulnerabilities in our applications.

Vulnerability Scanning: We utilize systematic vulnerability scanning processes to proactively detect and mitigate security weaknesses within our applications.

High Level Architecture

Access Handler: The Access Handles is responsible for serving the APIs related to access requests and approvals.

Control Plane: The Control Plane module is responsible for serving the configuration API utilized by Terraform. Additionally, it executes cronjobs to periodically synchronize resource data from various integrations (such as AWS, GCP, PagerDuty, etc.) to the authorization storage.

Authorization engine: The Authorization Engine stores resource data and authorises Access Requests.

Third-party risk managment

Critical Third-Party Vendor Inventory: We maintain a centralized inventory tracking and managing critical third-party vendors.

Security, Privacy, and Annual Reviews: We assess vendors to ensure they meet our security and privacy standards. We perform annual reviews of critical vendors ensure ongoing compliance and risk mitigation.

Organizational Security

Background Verifications: New employees undergo thorough background checks to ensure a reliable and trustworthy workforce.

Security education: We keep our staff informed about the latest security practices and threats through comprehensive security training sessions held every year.

Password Management: We use a password manager to control access to sensitive credentials throughout our organization.

Multifactor Authentication and Single Sign-On (SSO): We enhance access control and authentication processes through the implementation of multifactor authentication and single sign-on solutions in our security framework when possible.

Vulnerability Reporting

We deeply appreciate any effort to discover and disclose any security vulnerabilities in Common Fate. We currently do not operate a public bounty program but individuals may be acknowledged in security notifications as appropriate.

If you would like to report a vulnerability, please email security@commonfate.io rather than raising an issue on GitHub. We ask that you follow the responsible disclosure model. You may encrypt your message with our PGP key printed below. We take all vulnerability reports seriously and will rapidly respond and verify the vulnerability before taking steps to address it.

PGP Public Key

Our PGP public key can be fetched from Keybase with fingerprint 65AB 725B 01E6 5C85 051F 9FD5 5024 78AB E3D8 ED71. A copy of the public key is included below.