Keeping Your Data Secure

LOVD contains several important security measures to protect your data from unauthorized access. This page explains IT experts what kind of security measures are implemented in LOVD, but it also shows what you as a LOVD user can do to protect your data.

Built-in security measures

After a public request on a programmer's internet forum a LOVD installation had been subjected to various attacks and hack attempts. Furthermore, the source code has been security audited by three different software packages to ensure no security holes were left open.
Some of the security risks LOVD protects you against, are displayed below.

Protection against SQL injection

SQL injection is the process of including unwanted SQL database commands into a database through the manipulation of online web forms. SQL injection can be used for, amongst other things, unauthorized modification of database contents or unauthorized access to the administrator account.

Protection against Cross-site scripting (XSS)

Cross-site scripting is a vulnerability where malicious users can include Javascript code into webpages, through entering a script in web forms, or including code in variables which are being printed on the web page. This can, for instance, be used to forward a user unnoticed to a different site.

Password protecting data manipulation forms

To prevent manipulation of your variant or patient data when your computer is used by someone else while you are logged into LOVD, all data manipulation forms are password protected. Before the form can be submitted and processed, your password is required to confirm the changes.

What you can do to protect your data

A chain is only as strong as the weakest link. Even with all the effort we have put into making LOVD as safe as possible, some weak links may still exists. Read this section to learn about how to protect LOVD further.

Choose your password carefully and protect it. Even though LOVD does include a password quality check, please take care in choosing a password that can not be guessed by others and you don't use for other systems as well. Also, don't write it down on a sticky note stuck near your computer.
Don't leave your computer unattended while logged in. This will give anyone who uses your computer in your absence access to the data stored in LOVD. Also, don't leave your computer unattended if you're not logged in but had your browser remember your password for you. Once you're done using LOVD, log out.
Use cookies. Make sure the "Use cookies for user authentication" setting in the LOVD system settings is enabled. Disabling it, allows others to hijack someone's user account more easily.
Use SSL. Ask your systems administrator to enable SSL (https) on the server your LOVD is installed on, and enable the "Use SSL only to access LOVD" option in the LOVD system settings. This encrypts any data exchange between you and LOVD, such as your password and sensitive patient information.
Don't allow access to your LOVD files or the database to other users on the server. If there are other users on the server you have LOVD hosted on, make sure they cannot access the LOVD directory or get access to the same database LOVD stores it's information in.
Verify LOVD modules. Modules for LOVD introduce new code in LOVD that can be malicious. Don't install a LOVD module unless you're sure it's from a trusted source.

« Updating LOVD