Frequently Asked Questions

SOTERweb configures automatic screen locking on all end-user devices after 15 minutes of inactivity, with reauthentication required to unlock.

Controlled through the SOTERweb system parameters to meet the client's requirements.

SOTERweb enables host-based firewalls on all systems that support them, in addition to network-level controls managed by T3 Network Solutions. Our firewalls operate under a default deny policy for incoming traffic to enhance security and minimise unauthorised access risks.

Enables additional network security features within each segment as needed, including measures such as firewall protection, intrusion detection systems, and regular vulnerability assessments. This segmentation helps secure different network areas and aligns with our Cyber Essentials 'Plus' certification and adherence to ISO 27001 principles.

SOTERweb utilises network segmentation, supported by our partners T3 Network Solutions and Easyspace, to separate security domains, such as servers and administrative systems.

SOTERweb implements least privilege principles and maintains strict access controls, including IP restrictions, to secure all data and resources. Access is segmented based on roles and responsibilities, including sensitive configurations, logs, and backup data, in collaboration with our infrastructure and management partners, T3 Network Solutions and Easyspace.

We restrict inbound traffic to specific IP addresses and authorised services, protocols, and ports. This controlled approach is enforced through our network management partner, T3 Network Solutions, ensuring secure access and minimising potential vulnerabilities.

We don't use MFA for remote access to the server as Windows doesn’t support this, we do however use min 12character strong passwords and as stated in ACC.17 restrict access by IP Address.

We restrict access to administrative interfaces by allowing only authorised personnel, and our server management partner, T3 Network Solutions, limits access to these interfaces from designated static IP addresses.

We along with our Clients with an administration profile can and do periodically review user accounts and privileges, removing any accounts or permissions that are no longer required.

SOTERweb limits unsuccessful login attempts to three before temporarily locking the account. This rate-limiting measure helps prevent brute-force attacks and enhances account security.

Permissions are assigned based upon the least privileges necessary, ensuring that users have only the access required to perform their specific roles.

This is recorded inline with ISO 27001 standards.

Does your organisation ensure all passwords are at least 12 characters long OR have at least equivalent strength and complexity?

SOTERweb does not use default administrator or root passwords, as all accounts are set up with unique, secure credentials from the outset.

If any vendor solution arrives with a default account this is changed before integration. Aside from this SOTERweb does not use anonymous, or guest accounts, as all accounts are individually assigned to authorised users only.

Access control policies are in place to limit permissions based on roles and responsibilities

.

We employs secure authentication protocols, including multi-factor authentication (MFA) through Microsoft Authenticator and IP address access to servers as required.

Our Clients can manage manages access rights through a structured system of profiles, roles, and permissions, ensuring alignment with users’ job functions and the principle of least privilege. This approach includes allowing administrators to configure permissions precisely according to roles and responsibilities, which helps prevent unauthorised access.

We enforce session timeouts after 15 minutes of inactivity for systems, ensuring security while balancing user convenience. This timeout period is appropriate for preventing unauthorised access if a session is left unattended.

All accounts have aligned an unique identifier this includes administrators.