Background
At Reward Gateway, security is of utmost importance to us. Allowing our clients to easily manage their own security policies is as key. This article will explain some of the key security settings that can be changed by our clients to enhance the security of their program.
RewardGateway has established a set of foundational password rules based on industry best practices, enabling users to customize their passwords for enhanced security.
To access this feature, the client must first log in to Reward Manager and access their Security Setting Dashboard using the "Security" menu on the left-hand sidebar. This can be done by a client admin with the role 'Programme Security Administrator'.
Once accessed, a client will see the options shown below:
Basic Settings
Automatically log-out members who are idle
If this option is selected, any members who remain idle for a certain period of time will be automatically logged out from their account.
Allow "Remember Me" option on login
If this option is selected, members are given the option to remember their login details on their browser for up to 60 days. This would mean members would not need to re-authenticate on that device/browser for up to 60 days.
Detailed error messages
By default, all error messages across the platform are quite generic. This is so we do not reveal any sensitive information to any attackers which could allow them to figure out where a vulnerability lies. However, we do realize this can be sometimes poor for user experience as a legitimate end-user might not realize what has gone wrong.
If this option is selected, we show more detailed error messaging pertinent to the end-user.
Allow email address change (preload + Hybrid Onboarding Only)
Once enabled on a preload programme:
- Members will be able to update their email address in 'My Account' > 'Security Centre'
- Client admins with the 'Member Access Control Administrator' access role will no longer be able to update any member's email address in 'Members' > 'Browse Members' > 'Options' > ‘Edit’
- Any further changes to email address via membership uploads will be ignored
How this works on self-registration:
- Members are able to update their email address in 'My Account' > 'Security Centre'
- Client admins with the 'Member Access Control Administrator' role cannot update member emails (neither 'Members' > 'Browse Members' > 'Options' > ‘Edit’, nor via membership uploads)
- This can only be done for members with an empty License Key (aka Payroll ID)
Safelist IP Addresses
Reward Gateway operates rate limiting and CAPTCHA throttling checks on almost all areas of the site to control automated attacks against a client program. However, this could mean if a client has a majority of members accessing the platform from a single IP address it could be flagged as suspicious and slow down the programme.
To avoid this, clients can safelist their Office/Corporate IP Addresses which would mean these checks are ignored when members access the site while at work.
To safelist an IP Address, simply type in the IP Address and the Subnet Mask and select the "Add" button.
Password Management
This section would allow clients to define their own password policies on their Reward Gateway program.
Special characters in passwords
All user passwords must contain at least one uppercase, one lowercase and one digit.
Minimum Password Length
Clients can define their minimum password strength here. The minimum is 16 characters.
Prevent password Re-Use
Members cannot re-use any of the last ten passwords that they have used before on their Reward Gateway program.
Periodic password Refresh
Members will be asked to change their password at a set interval of every 60 days.
Password Refresh Period
This is by default 60 days.
Enforce these changes on next login
If this option is selected, the changes that were applied above will be enforced to all users on their next login into their Reward Gateway account.
This option becomes available to clients only if changes are applied to the required password length or the usage of special characters in members' passwords.
Login Challenges
This section would allow clients to control certain login challenges that can be enforced to end-users as well as administrators.
Digital Identity Verification
If this option is activated, all members will be asked to verify their information (Payroll number, employee id, date of birth etc) on their next login before getting access to their account.
Note: This is only available on non 'preload' programmes. See Registration Criteria for more information.
Paper Identity Verification
To be used on very rare occasions, if for some reason a client suspects fraudulent activity on their program they can request this option to be turned on. This request must be confirmed by Reward Gateways internal Information Security Team and once confirmed it would request all members login into the platform to upload an identity document (Driving Licence, Password etc) to verify themselves.
The verification process is handled by the Reward Gateway internal Information Security team.
Multi-factor Authentication
This is only applicable for any administrators accessing Reward Manager. Here a client can reset an administrator's Multi-factor settings or unlock their account if for some reason it was locked due to invalid multi-factor attempts.
Security and Privacy Resources
In this section, a client can download or view all Security and Privacy resources related to their program.
Audit Records
In this section, a client can view all audit records on their program.
The audit information held on Reward Gateway can be filtered based on certain events (Login attempts, Multi-factor attempts, etc). It can also be narrowed down to specific date ranges and to a specific member.