Dear integration partners,
In recent weeks, several Tripletex integration partners have experienced security incidents in their own systems, in which unauthorised parties gained access to the partner’s production database. Tripletex’s systems were not affected, and no data was retrieved from Tripletex.
These incidents nevertheless affect our shared customers. Any data a partner stores, including customer data, API tokens and passwords, may be exposed in such an incident. In addition, the Norwegian National Security Authority (NSM) has raised the national cyber risk level to HIGH, the second-highest level on its scale. NSM notes in particular that threat actors target suppliers and sub-suppliers in order to reach other organisations.
We therefore ask all integration partners to review the following measures.
1. Apply security updates promptly
Install security updates as soon as they become available, both in your own systems and in third-party libraries.
2. Protect credentials and API tokens
Consumer tokens and the employee tokens that customers create for your integration give access to their accounting data. Store them encrypted, preferably in a dedicated secrets manager, and never in plain text in databases, logs or source code. Create session tokens with a short expiry, and only when they are needed.
3. Minimise stored data
Store only the customer data your integration requires, and delete data that is no longer needed.
4. Apply the principle of least privilege
Limit access to production systems and databases to the people who need it, and grant each service only the permissions it requires.
5. Restrict access to internal tools
Administration, support and database tools should not be reachable from the internet. Place them behind a VPN or equivalent, and require phishing-resistant multi-factor authentication.
6. Report incidents without delay
If you discover or suspect a security breach, contact mailto:security@tripletex.no immediately. This allows us to block access and support you and our shared customers. Note that you may also be required to notify your customers and the Norwegian Data Protection Authority (Datatilsynet) under the GDPR.
Contact information
Tripletex notifies the registered technical contact for each integration about security incidents. If your technical contact has changed, please use the contact form and supply us with relevant details at https://developer.tripletex.no/contact-us/
Further resources
- NSM’s self-assessment tool, to identify which measures to prioritise: https://cybersjekk.no
- NSM’s basic principles for IT security: https://nsm.no/regelverk-og-hjelp/grunnprinsipper/
- NSM’s announcement of the raised risk level (in Norwegian): https://nsm.no/aktuelt/nsm-hever-det-nasjonale-cyberrisikonivaet-til-hoyt
Thank you for your continued cooperation in keeping our shared customers security intact.