Web Application Security
OWASP Top 10, addressed in all development.
Application security is not a final-step audit at InWork Global. The OWASP Top 10 is addressed in every code review, dependencies are scanned for known vulnerabilities, and no system reaches production without a security review.
Security in the pipeline
The OWASP Top 10 is a development standard here.
The OWASP Top 10 represents the most critical web application security risks. At InWork, addressing them is part of how every system is built — not a box checked the week before launch.
Every code review accounts for the Top 10, dependencies are scanned for known vulnerabilities, secrets stay out of source code, and production deployments run in isolated VPCs with security groups. Security review is a gate, not a suggestion.
Development security
What we do on every build.
Security by design principles
The standards behind the code.
These principles govern every InWork engagement, drawn from our information security policy.
Authentication
All authentication uses MFA. Least-privilege access is enforced at all layers, with production access logged and monitored.
Encryption everywhere
All data at rest is encrypted with AES-256, and all data in transit is encrypted with TLS 1.3 or higher.
Reviewed before merge
All code goes through peer review before merge, and all third-party dependencies are scanned for known vulnerabilities.
Isolated environments
All production deployments run in isolated VPCs with security groups, and no secrets ever live in source code.
Vendor & dependency management
Third-party risk, accounted for.
All third-party vendors with access to client data must provide evidence of their own security certifications (SOC2, ISO 27001), sign a Data Processing Agreement, agree to InWork's vendor security standards, and notify InWork within 24 hours of a security incident affecting client data.
Top 10
Addressed in all development
OWASP Top 10 coverage in every code review, dependency scanning on every build, peer review before every merge, and a mandatory security review before any production deploy.