Security Requirements

Security of your computers and smartphones

In your work you might use multiple devices, e.g. laptops, desktop computers, smartphones, or tablets, that have been provided by the company or that personally belong to you. Your devices can be from any manufacturer and run any operating system, but we ask you to apply the same basic security rules to all of them:

1. Enable automatic locking after any inactivity on both your computers and smartphones. Unlock can't be a simple swipe or click; it must be protected by a password, biometric ID, or something similarly secure;
2. Update the OS and other software in a timely manner, especially when the updates contain patches for security vulnerabilities;
3. If you sell, give away, or dispose of a device previously used for work, completely erase all the data from the device, and do so in a way that prevents it from being recovered;
4. The hard drives of your laptops must be encrypted so their contents won't be compromised if a device is lost or stolen.

Use Password Managers

Passwords that meet the following criteria are considered secure:

1. Length of 12 characters or more;
2. Composed of random letters and numbers, eliminating their vulnerability to dictionary search;
3. Never used twice. Each time you create an account, create a new password.

Use a password manager. Considering the number of systems we have to work with, it is the only realistic way to follow the guidelines above. LastPass, 1Password or Bitwarden are all examples. If you haven't started using a password manager yet, please start today.

Do not Share Passwords with Colleagues

If you need to give a colleague access to a system, create an account with a temporary password that they will change as soon as they log in. When possible, do not use shared logins. In exceptional cases, shared logins may be allowed for secondary non-critical systems that do not store important data, and for some reason do not allow a separate login to be created for each employee.

Use Two-factor Authentication

We urge you to enable 2fa on all systems that support it.

Requirements for SSH Keys

1. Each key must be signed with the owner's email address. Anonymous or unidentifiable keys are deleted from the servers without warning;
2. The key must be password-protected;
3. Use the Ed25519 key format instead of OpenSSH default;

ssh-keygen -t ed25519 -C $EMAIL

Non-disclosure of Confidential Information

The detailed terms and conditions of the NDA are described in the agreement that is signed between you and the company upon hiring. We would like to draw attention to two main points here:

1. The code you write for your job is owned by your employer and may not be disclosed or used on any third-party projects without explicit permission;
2. It is not permitted to publicly mention any projects that the company is or has participated in without explicit permission.