Security - A Guide to Managing Security Settings on a Client Program

Background

Allowing our clients to easily manage their own security policies is key. This article will explain some of the key security settings that can be changed by our clients to enhance the security of their program.

Reward Gateway has established a set of foundational password rules based on industry best practices, enabling users to customize their passwords for enhanced security.

To access this feature, the client must first log in to Reward Manager and access their Security Setting Dashboard using the Security menu on the left-hand sidebar.

This can be done by a client admin with the role Programme Security Administrator. 

Once accessed, a client will see the options shown below:

Basic Settings

Automatically Log-out Members who Are Idle

If this option is selected, any members who remain idle for a certain period of time will be automatically logged out from their account. 

Allow 'Remember Me' Option on Login

If this option is selected, members are given the option to remember their login details on their browser for up to 60 days. This would mean members would not need to re-authenticate on that device/browser for up to 60 days. 

Detailed Error Messages

By default, all error messages across the platform are quite generic. This is so we do not reveal any sensitive information to any attackers which could allow them to figure out where a vulnerability lies. However, we do realize this can be sometimes poor for user experience as a legitimate end-user might not realize what has gone wrong.

If this option is selected, we show more detailed error messaging pertinent to the end-user.

Allow Email Address Change (Preload and Hybrid Onboarding Only)

For instructions on allowing email change on these programmes see the following article. 

Safelist IP Addresses

Reward Gateway operates rate limiting and CAPTCHA throttling checks on almost all areas of the site to control automated attacks against a client program. However, this could mean if a client has a majority of members accessing the platform from a single IP address it could be flagged as suspicious and slow down the programme. 

To avoid this, clients can safelist their office/corporate IP addresses, which would mean these checks are ignored when members access the site while at work.

To safelist an IP address, simply:

1. Type in the IP address and the subnet mask 

2. Select the Add button

Password Management

This section would allow clients to define their own password policies on their program. 

Password Requirements

All user passwords must contain at least one uppercase, one lowercase, and one digit. 

Minimum Password Length

Clients can define their minimum password strength here. The minimum is 12 characters.

Prevent Re-use

If selected by an admin, members cannot re-use the last 7 password.   

Periodic Refresh

As a default setting members will be prompted to change their passwords every 120 days. Admins can customize the refresh period in the range 30 - 120 days. 

Send Password Reset Instructions

Search for members and dispatch a password reset instructions email.

Enforce These Changes on Next Login

If this option is selected, the changes that were applied above will be enforced to all users on their next login into their account.

This option becomes available to clients only if changes are applied to the required password length or the usage of special characters in members' passwords.

Login Challenges

This section would allow clients to control certain login challenges that can be enforced to end-users as well as administrators.

Digital Identity Verification

If this option is activated, all members will be asked to verify their information (Payroll number, employee id, date of birth etc.) on their next login before getting access to their account.

Note: This is only available on non 'preload' programmes. See Registration Criteria for more information.

Paper Identity Verification

To be used on very rare occasions, if for some reason a client suspects fraudulent activity on their program they can request this option to be turned on. This request must be confirmed by Reward Gateway's internal Information Security Team and once confirmed it would request all members login into the platform to upload an identity document (Driving Licence, Password etc.) to verify themselves. 

The verification process is handled by the internal Information Security team.

Multi-factor Authentication

This is only applicable for any administrators accessing Reward Manager. Here a client can reset an administrator's Multi-factor settings or unlock their account if for some reason it was locked due to invalid multi-factor attempts.

Security and Privacy Resources

In this section, a client can download or view all Security and Privacy Resources related to their program.

Audit Records

In this section, a client can view all audit records on their program.

The audit information held on Reward Gateway can be filtered based on certain events (login attempts, multi-factor authentication attempts, etc.). It can also be narrowed down to specific date ranges and to a specific member.