Process security

Each process executes in an environment that poses different threats to the process. In this layer of the security model, the focus is on ensuring that the software is robust and thoroughly analyzed from a security perspective.

Rugged software

For software to be considered as rugged, it must cope with all potential threats to the confidentiality, integrity, and availability of the information, and be robust when used in ways not anticipated.

Several mitigating actions have been implemented in the Qlik Sense software in order to make it rugged:

• Authorization of communication using certificates
• Validation of all external data that is sent to the system
• Encoding of content to avoid injection of malicious code
• Use of protected memory
• Encryption of data
• Audit logging
• Use of checksums
• Isolated execution of external components
• Escaping of SQL data

Threat analysis

To ensure that the Qlik Sense software is secure and rugged, threat analysis of the design has been performed as part of the development process. The following threat areas, often abbreviated as STRIDE, have been covered:

• Spoofing
• Tampering
• Repudiation
• Information disclosure
• Denial of service
• Elevation of privilege

In addition to the threat analyses, exploratory security testing has also been performed on the Qlik Sense software.