Procedures and methods for building secure solutions

A first step was to clearly separate frontend from backend, meaning the part of the system that users see has no direct contact with the database. In this way we could ensure that all calls to the database were correctly authenticated, without risk of accidentally granting incorrect permissions via the interface. This separation proved to be both a secure and efficient solution - not least because it also eased the division of labour between developers.

• It meant we could fully focus on our respective part of the system, and you could do your part as well as possible. We didn't have to spend time handling couplings between interface and databases, which saved us time since the project had a short timeframe, says Jimmy Haglund, developer at Bilvision.

A next step in the security work was carrying out penetration tests - that is, tests where the system is attacked in controlled ways to identify any vulnerabilities.

• We're already ISO certified for information security, which means we have established procedures and methods for how we build secure solutions. All these things we set up for Mobility Sweden we'd done many times before. There wasn't really any exciting new technology - it was about focusing on what we know and do best, says Jörgen Andersson, database developer at Bilvision, with a smile.

Jimmy Haglund, developer at Bilvision

Jörgen Andersson, database developer at Bilvision

The challenge: Access control and data security

Since the project involved delivering large amounts of data to Mobility Sweden and its member companies, it became particularly important to ensure that the right people could see the right information.

• We built an entirely new database structure to handle this. A member should, for example, never be able to see other members' data. Everyone can see the statistics at a highly aggregated level, and then members have access to detailed data tied to their own brands, Jörgen explains.

IT security - work that never ends To maintain good IT security even after delivery, ongoing operation and maintenance are required. Here Bilvision has set up automated routines that monitor the system after every update.

• We make small adjustments on an ongoing basis, and we want to quickly spot if something has gone wrong. I've set up automated tests with sample API calls, comparing data against what's in production. As long as they match, we know the system is working as it should, says Jimmy Haglund, and continues:

• This is what we call basic testing in connection with deployment. It's not about advanced security tests, but about ensuring that no errors slip through when we make a new update. It's a self-evident part of a secure way of working.

The industry has some way to go

Bilvision follows developments in IT security and the legal requirements that apply to it. In customer relationships they often have to act as experts on the topic, since customers don't always have a handle on what applies.

• Both customers we talk to and other players in the industry are often behind when it comes to IT security or legal requirements like GDPR. Often there's a legacy in the security-technology - old solutions and difficulty catching up on the technical debt that can build up. When doing an IT project, people often want it to work for ten years without needing to change - but security requirements and legislation change much faster than that. That's where risks arise, and where we hope to stay at the forefront, Jörgen Andersson concludes.

In the next part: Going live - and continuing the road ahead

In the final part we describe how Bilvision created a smooth rollout for the new platform through personal support and training webinars - and how the work continues going forward.