Cybersecurity & Systems Best Practices

This document outlines core cybersecurity and systems engineering best practices for maintaining secure, resilient, and compliant IT infrastructure across the Telenegar network, web applications, and email services.

Applying a defense-in-depth strategy—combining identity governance, network perimeter security, transport encryption, and continuous monitoring—minimizes attack surfaces and protects systems against unauthorized access, data breaches, and service disruptions.

Identity is the primary security boundary for modern cloud and infrastructure services.

• Enforce Multi-Factor Authentication (MFA): Require MFA (preferably TOTP or FIDO2 hardware keys) for all user accounts, administrative portals, SSH access, and Webmail.
• Principle of Least Privilege (PoLP): Grant users, application tokens, and service accounts only the minimum privileges required to perform their functions.
• Credential Management:
  • Prohibit hardcoding secrets, API tokens, or passwords in codebase repositories.
  • Use environment variables or secret managers (e.g., Vault, AWS Secrets Manager).
  • Enforce application-specific passwords or OAuth2 tokens for Mail Clients.

• Disable Unnecessary Services & Ports: Keep firewall rules strict. Expose only required ports (`80/443` for HTTP/S, `22` for SSH, `993/465/587` for Mail Services).
• Automate Security Updates: Implement automated patch management for operating system kernels, web servers (Nginx/Apache), and runtime dependencies.
• Disable Insecure Protocols: Decommission legacy, unencrypted protocols such as Telnet, FTP, HTTP, POP3 (`110`), and IMAP (`143`). Force encrypted alternatives (SSH, SFTP, HTTPS, IMAPS).

• Enforce TLS 1.2+ across all HTTPS websites and SMTP/IMAP services; deprecate SSLv3, TLS 1.0, and TLS 1.1.
• Use automated, short-lived SSL/TLS certificates (e.g., Let's Encrypt).
• Enforce inbound mail transport security by deploying MTA-STS and monitoring handshake health via TLS-RPT.

Hardened web applications and APIs must return protective HTTP headers to defend against browser-based vectors (XSS, clickjacking, MIME sniffing). Deploy standard baseline headers as outlined in HTTP Security Headers:

• `Content-Security-Policy` (CSP)
• `Strict-Transport-Security` (HSTS)
• `X-Frame-Options`
• `X-Content-Type-Options`
• `Referrer-Policy`

• Sanitize and validate all user-supplied input to prevent SQL Injection (SQLi), Command Injection, and Cross-Site Scripting (XSS).
• Use parameterized queries or ORM frameworks for database interactions.

Email protocols require explicit authentication mechanisms to prevent brand abuse, phishing, and spam generation.

• Centralized Logging: Aggregate server logs (auth, web access, SMTP logs) to a centralized, secure log management platform (SIEM).
• Audit Trail Analysis: Monitor raw Email Headers and HTTP request headers to investigate unauthorized access attempts or suspicious activity.
• Automated Rate Limiting: Implement rate limiting (e.g., Fail2ban, WAF rules) to protect login endpoints and mail relays from brute-force and credential-stuffing attacks.
• Backup Strategy (3-2-1 Rule): Maintain 3 copies of critical data on 2 different media types, with at least 1 copy stored securely offsite or in an immutable cloud bucket.

Regularly validate system security postures using Telenegar Audit Tools:

• Email & Server Security Audit: Test SPF, DKIM, DMARC alignment, STARTTLS compliance, and port status with the Telenegar Mail Check Tool.
• Global DNS & Propagation Check: Validate `A/AAAA`, `MX`, `TXT`, and `PTR` record consistency using the Telenegar DNS Check Tool.

• Telenegar Mail Check Tool — Automated email security and server diagnostic tool.
• Telenegar DNS Check Tool — DNS lookup and propagation testing tool.
• HTTP Security Headers — Technical configuration guide for web server security headers.
• Email Encryption — Transport and end-to-end encryption architecture.
• Email Spoofing — Countermeasures against exact-domain forging.
• Phishing — Defense against credential harvesting and malicious campaigns.
• Spam — Inbound filtering and outbound reputation defense.
• Email Deliverability — Best practices for inbox placement and domain reputation.