Tech Talk: Security – can you trust the Citavi Cloud?

This is the second installment in our Tech Talk series, in which we take you behind the scenes of Citavi's development activities.

In light of the hacks we read about every week, how can the small Citavi team be trusted in terms of security? To put it bluntly: because we don't trust ourselves! We are aware that our team does not have the know-how, the manpower, and the resources to secure our offerings. Instead, we accept that other people know much better than we do, and we humbly follow their guidance.

Keep things as simple as possible

Security breaches typically occur due to outdated hardware, missing updates, or misconfigurations in a complex environment. The smaller your infrastructure, the easier it is to protect.

Years ago, we removed all servers from our premises. We will never miss a firewall firmware update since there is no firewall. No one will attack our file servers since there aren't any. We have moved everything to the cloud. This is not to say that the cloud will be unbreakable forever; the point is that an attack would be much easier against our own IT.

In the cloud, we avoid "infrastructure" like virtual machines and consistently use "services". Here again, we simplify so that we don't have to worry about operating system updates and the like.

We also strive to reduce the complexity in our programming tools. The fewer platforms, languages, and components, the better. To a developer, this may sound boring – but it makes us more efficient and our code safer.

Don't re-invent the wheel

Many really smart people in the industry work on security best practices all day long. Our job is not to think about security for our own special case; our job is to take the existing "wheels" and make them roll for us.

During the last few years, we went through no less than 1676 recommendations by the Federal Office for Information Security. Many of them were not relevant in our context, but we have implemented or enhanced dozens of internal processes.

We’ve also gone through hundreds of Azure Security Center recommendations to use the best security configurations for our cloud services (of course, this is an on-going and never-ending process). Let us give you a small example:

In our code, there are very few lines that we "invented" for security. Instead, we use well-known, established, and tested third-party components like Identity Server for Citavi Web. Similarly, in Citavi for DBServer we leverage the proven security of SQL Server (schemas, roles, etc.). Every night, we scan our code with "white box testing" tools that find flaws such as XML configuration errors or SQL injection vulnerabilities.

Expose yourself to attacks

With all these preparations, we were pretty confident that we were literally on the safe side. But how could we know for sure? We ran automated penetration tests (which found minor issues), but a serious hacker would try other attacks.

In the end, we decided to engage HackerOne to start a white hat hacker program. Hundreds of hackers try to find vulnerabilities in Citavi Web. If they succeed, we pay them a "bounty". The good news is that a hacker will earn at least $5000 for a critical bug – but none has been reported so far.

On the other hand, our hackers surprisingly have found many minor issues. For instance, if you enter a project title with HTML tags, an invited user could be tricked into opening a phishing site. We have paid several thousand dollars in bounties and hardened our app against the most exotic of attacks (like using the Cyrillic letter "а" as camouflage for the Latin letter "a").

Bottom line: can you trust the Citavi Cloud?

Our first recommendation is: don't trust any IT that is connected to the Internet.

Apart from this are we convinced that our security is word class – not because we are genius experts, but because we stand as dwarfs on the shoulders of giants.

We hope you enjoyed this second post in the Tech Talk series, which will run throughout the Citavi Web beta test. We love hearing from you, so if you’d like to share your feedback, please drop us a line.