Security

IMPORTANT !! It is critical to follow these guidelines. We try to have a positive and free way of managing the business and people, but in this case, this is important. Not following those guidelines can put the entire company and all of our users at risk.

Cybersecurity is really important, in this light, anyone caught not respecting those guidelines will have a disciplinary measure taken immediately.

Using a new app

For compliance reason, whenever you start using a new app, you must inform Mael, so it is added to the list of software being used.

On creating passwords

Whenever possible, prefer configuring SSO, and/or use social logins (”Connect with Google”).

When this is not possible, use the company-backed password manager, and generate a password with this tool (currently we are using BitWarden).

In some special cases, it is not possible to use BitWarden (for example: desktop accounts), in this case, you need to create a strong password.

• Contrary to popular belief, you do not need a combination of characters, letters and numbers for a strong password
• To create a strong password, you need to pick at least 4 random words or more. they MUST be random (don’t use your dog's name). Even better if you vary languages. Ex: mure-staple-horse-voiture (of course do not use this one). You will realise quickly they are easier to remember AND much more secure than something like H3ll0.

Using your laptop/phone

What you can/must do

• Use the app centre for installing software, or FlatHub if you know how to use it. Avoid installing software unless absolutely necessary.
• For work, you can use ONLY Google Chrome. We have set up policies with this browser.
• For personal browsing, you must use the same account with a different profile, this is to ensure the policies stay on.
• You can browse the web aside from work (it’s ok to check your emails, watch YouTube, Netflix, listen to Spotify, etc), however, do not download anything while doing so.
• (devs) You have great powers, and great responsibilities, be careful about what you push on Git (passwords, tokens, etc)

What you cannot do

• Do not use your personal email to contact people in the company (this is a common impersonation/phishing trap). If someone works at ansearch, they should contact you by chat or company emails.
• Do not use your phone for 2FA, phone numbers are very insecure, use an authenticator app such as MS authenticator instead.
• When checking emails on your phone, do not open attachments! Use your laptop.
• You cannot download another app store (such as Steam).
• Do not install email applications (use the browser).
• Do not use any other browser than Chrome, and uninstall them.
• Do not, under any circumstance reuse a password.
• (devs) You cannot use a personal GitHub/Gitlab account. For learning projects use your Ansearch Github account, for strictly personal projects, code on your own hardware, and do not SSH your work laptop into a personal server.