Did you know that Trader Joe’s has over 50 frozen meals? Neither did I, but that has nothing to do with this post. Apologies for the click bait, but I was pretty sure nobody would read a post called, “What you need to know about our server security.”
Due Diligence Documentation
Last Fall, North Bay Credit Union was insistent that we do more in the way of due diligence documentation and requested – demanded really – to see a variety of documents. Without getting into the weeds, we discussed things like:
- SOC (Standard Operating Controls) Reports, Type 1 and 2
- PCI DSS (Payment Card Industry Data Security Standard) Validation and Reports
- Network Vulnerability Testing Results and Reports
- App Penetration Testing Results and Reports
- Information Security Policies and Procedures
- And more!
Honestly, it was not an unreasonable request. If we want to get into the club to mingle with banks and governments, due diligence documentation is just the cover fee. We’ve made our due diligence documentation available in our Help Center. As you might expect from a startup, it is substantial but not exhaustive (yet).
Server Security
Are you still with me? Because I’m finally getting to the point of this post!
As part of this due diligence, we implemented a control to validate the ongoing security of our app and web servers. The control essentially requires us to use an independent testing service on a monthly basis and remediate issues in a timely manner based on severity. Test results are available in our Help Center. From the beginning, our servers have consistently earned an “A” grade for their security.
Until recently, that is. The test identified a minor issue with our app and web servers, downgrading them to a “B.” Dave and I discussed the issue to determine the severity. There was no immediate impact on users or visitors, but it introduced the possibility that a browser could pop-up a security warning. Gasp! We had visions of people jumping up and down, proclaiming us to be insecure, noncompliant, and unworthy!
Dave worked with Ceylon Solutions to prioritize the work. The remediation began earlier this week and was completed yesterday. I re-ran the tests today and confirmed that we are getting “straight As” again. Crisis averted!
Conclusion
The takeaway is not that our servers are secure (they are); it’s that we’ve implemented several security controls as part of our larger information security program and this is a very recent example of how a control was put to the test and passed with flying colors! Boom – mic drop.
About Those Frozen Meals
If you made it to the end of this post, you deserve to see the ranking of those Trader Joe’s frozen meals. Thanks for reading!
It should be noted that Trader Joe’s mini chicken tikka samosas are the best thing on a TJs (frozen) shelf. I’m guessing they didn’t include it because it’s not a “meal”, but they certainly keep me sustained while securing servers with Sri Lanka.
Looks like you can’t go wrong with the Tikka Masala. Thanks for the informative post, Rick!
Thanks Rick for sharing this information with us. Appreciate the insight. Nice work to Dave and the Ceylon team for getting it remedied quickly!
Here’s an *ACTUAL* Trader Joe’s frozen meals ranking list: https://bit.ly/3aNcVOK
Well done, guys! Very cool!