Home > Data Security

Data Security

At LabKey, security begins with educating our developers on avoiding security vulnerabilities through proper coding and best practices. Every feature is designed with security in mind, ensuring that only authorized users are able to view and modify data. Each release of LabKey Server SDMS undergoes extensive automated and manual testing to identify potential bugs and vulnerabilities before release. Additionally, we employ automated security scanners and regularly use independent cybersecurity firms to perform manual penetration testing of the platform. Detailed reports from these efforts are reviewed and any issues are quickly fixed.

Security Features

LabKey releases three major versions of the LabKey Server SDMS platform each year followed by subsequent maintenance releases. We encourage our users to always update to the most current release of LabKey Server to ensure they have the maximum protection against security risks. Below are just a few security features included in recent releases.

Authentication
User authentication is performed through LabKey Server’s core database authentication system by default. With Premium Editions of LabKey Server, other authentication methods including LDAP, SAML and CAS single sign-on protocols, and Duo two-factor authentication can also be configured. Premium Editions also support defining multiple configurations of each external authentication method.

User-Roles & Permissions
LabKey Server has a group- & role-based security model. This means that each user of the system belongs to one or more security groups, and can be assigned different roles (combinations of permissions) related to resources the system.

Cross-Site Request Forgery (CSRF) Protection
Beginning with version 19.1, LabKey Server enforces CSRF protection (requiring verification of a CSRF token) on all POST requests and, as of 19.3, it will detect all mutating operations and block them if they are attempted outside of a CSRF-protected POST request.

External Redirects Allowlist
LabKey Server restricts the host names that can be used in parameters that provide redirect URLs. By default, only redirects to the same LabKey instance are allowed. Other server host names must be added to the allow list by the administrator to allow them to be automatically redirected.

Antivirus Scanning (premium feature)
File uploads, attachments, archives and other content imported through the pipeline or webdav can now be scanned for viruses using ClamAV.

LabKey Cloud Data Security

Network Hardened Managed Firewall

We manage the firewall protecting client systems, ensuring that only authorized network traffic will reach the client environment.

Web Application Firewall

We employ a Web Application firewall to inspect traffic at the application layer and provide increased protection to block common attack patterns.

Database and File System Encryption

LabKey Compliance systems utilize database and file-level encryption, ensuring that all client data is encrypted at rest.

Encrypted Network Tunnels

All network traffic is encrypted using TLS 1.2 between the browser client and web servers. All database network traffic is encrypted using database encryption protocols.

Cybercrime IP Reputation Blocking

Network traffic from well-known malware/botnets is blocked at the firewall level and not allowed.

Application Monitoring

LabKey uses multiple monitoring systems to ensure the health of client systems.

Vulnerability Management & Resolution

On rare occasions, we may identify or be notified of an issue that poses a security risk. When this occurs, the LabKey team promptly assesses the issue and determines a timeline for resolution based on the severity of the risk. After our initial assessment, we fix the identified vulnerabilities and deliver maintenance releases of the latest production version to our clients as soon as possible. Maintenance releases are also delivered for critical security issues and high-priority bug fixes in older production versions of LabKey Server that are still in active use.