Scheduled, regular updates and patch deployment for the hosted operating system and system applications on TDL servers.
Continual monitoring for DSpace service availability, with notifications sent to administrators in the event that the service is experiencing an outage. Outages, whether due to system or application failure or external attack are resolved as quickly as possible by TDL technical staff.
On-going review of known exploits which may affect DSpace hosting followed, as needed, by manual patching and updates to limit exposure.
Monitoring for notifications from customers of service failures, outages, or issues via the ZenDesk support system. Issue tickets are resolved by technical staff.
Monitoring of the DSpace technical community discussions for discovered security vulnerabilities. Discoveries of a security vulnerability are followed by integration of the fix into the deployed service.
Secure systems architecture
Virtual Private Cloud with firewall, for provisioning resources in a logically isolated network.
VPC peering, providing a networking connection between VPCs that enables routing of traffic using the private network.
Use of jumpboxes for SSH access and secure access through SSL VPN.
Layered IP filtering using Access Control Lists and Security Groups.
Primary authentication method is via member institution authentication systems using Shibboleth.
IP address / range authorization (e.g. for restricting access to specific collections to "on campus") is available.
Default DSpace authentication is available. (where DSpace manages all accounts, passwords and permissions)
All calls to hosted DSpace are encrypted using Transport Layer Security protocols (HTTPS). TDL requires HTTPS for all sites, and does not allow site data to be sent via plain HTTP.