Specific security controls for a production Fineract deployment: gateways and WAFs, credentials and profiles, tenant secrets, patching, testing, encryption, fraud monitoring and audit.
Designing the edge in front of Fineract: an API gateway with route allow-lists, a WAF with SQL injection rules, rate limits, blocking test and self-service endpoints, and logging for incident response.
Pre-go-live checks: replacing the mifos/password login, confirming no test profile is active, choosing basic or OAuth authentication, and watching logs for DO NOT USE THIS IN PRODUCTION warnings.
Protecting tenant connection secrets: the tenant master password, encrypting tenant and read-only schema passwords, rotating the master password and keeping it out of images and source control.
Why the Fineract project advises leaving self-service APIs disabled, what customer-facing apps need instead, and how an isolated component with its own authorization can expose customer functions safely.
Staying patched on Fineract: the security reports page, the 1.15.0 SQL injection fixes, the case-by-case back-port policy, and a patch process for custom builds and forks.
Scoping a security test of Fineract: API authorization and tenant isolation, injection in search and report endpoints, maker-checker bypass attempts, the front end and gateway, and safe testing against a copy of production data.
Encrypting a Fineract deployment: TLS on every hop, database and backup encryption at rest, document storage encryption, and managing keys and secrets with a KMS or secrets manager.
Adding fraud controls Fineract does not ship: real-time monitoring of payments and transfers through events, holds on outgoing payments, rules engines such as Tazama, and alerting on account takeover patterns.
Using Fineract's command audit: what is recorded for every write request, searching audits by user, action and office, maker-checker entries, and exporting audit data to a SIEM.
Setting password rules for staff users: the pre-installed validation policies in password preferences, when to move authentication to an identity provider with MFA, and account lockout considerations.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.