J.A. Cooper & Associates Cybersecurity

Nomination Highlights

Our “website security” is superior to most everyone else simply because of the sheer level of our cybersecurity infrastructure (both server-side and website-level) protections that comes standard with all of our hosted sites. We provide strict transport security protection, strict referrer security protection, origin isolation protection, real-time security/integrity monitoring, SIEM (Security Information & Event Management), an IDS (Intrusion Detection System), an IPS (Intrusion Prevention System) and email address obfuscation, as well as protection against site SPAM, malware, phishing, unsafe plugins, URL redirection attacks, reflected XSS attacks, cross-origin resource attacks, MIME sniffing attacks, script/prompt injection attacks, eavesdropping attacks, clickjacking attacks, DDoS (Distributed Denial-of-Service) attacks, unauthorized domain name transfers and copyright infringement.

Our servers are ISO/IEC 27001:2013 certified, which is a widely recognized high standard for information management systems. With daily automatic backups, should our server ever fail, a backup server is ready to step in to go online immediately. The SIEM, IDS and IPS all use AI (Artificial Intelligence) to detect, deter and document anomalies, as well as to alert security staff of any unusual activity. Our prompt injection protection helps to mitigate script injection attacks and can even help prevent certain types of DDoS attacks. One can use “securityheaders.com” to easily see at a quick glance most of the above listed protections and please take note of “x-ws-ratelimit-limit” and “x-ws-ratelimit-remaining,” with the latter being a dynamic header that hints at one of our DDoS protections.

All of the following are protections using security headers:

1) Using “object-src” to protect against unsafe plugins
2) Using “base-uri” to protect against URL redirection attacks
3) Using “frame-ancestors” to protect against clickjacking attacks
4) Using “upgrade-insecure-requests” and “block-all-mixed-content” for securing any loaded resources that are cross-origin with “Content Security Policy”
5) Disallowing browsing-topics, display-capture, camera, microphone, serial ports, USB and payment methods with “Permissions Policy”
6) Securing resources during page load and protecting against eavesdropping attacks with a very robust “Strict Transport Security” policy
7) Deterring cross-origin resource attacks with “Cross-Origin-Resource-Policy”
8) Ensuring proper origin isolation with “Cross-Origin-Opener-Policy”
9) Mitigating reflective XSS attacks with “X-XSS-Protection”
10) Mitigating MIME-sniffing attacks with “X-Content-Type-Options”
11) Not leaking any sensitive info with a strict “Referrer Policy”
12) Mitigating clickjacking attacks with “X-Frame-Options”