Al Akhawayn University – Quick Access, All In One Search & CDN

Information Security & Digital Infrastructure Protection

ISO/IEC 27001 Aligned

Security is an essential part of the way we design, operate and maintain our digital infrastructure. We take a proactive and continuous approach to protecting websites, applications, data and digital services hosted within our infrastructure. Our environment includes a Linux Cloud infrastructure and AUI CDN services, supported by security controls covering access management, system updates, vulnerability management, malware protection, monitoring, backups, incident response and recovery. Our information security approach is guided by recognized best practices and the principles of ISO/IEC 27001, with a strong focus on risk management, continuous improvement and long-term security.

Security by Design and by Practice

We consider security throughout the lifecycle of our digital services — from infrastructure deployment and configuration to daily operations, maintenance, updates, monitoring and recovery. Our approach is based on six principles:

• Prevent — reduce security risks before incidents occur.
• Protect — implement technical and organizational safeguards.
• Detect — identify suspicious activity, vulnerabilities and security events.
• Respond — react quickly and appropriately to security incidents.
• Recover — restore affected services and information when necessary.
• Improve — learn from incidents, risks and operational experience to continuously strengthen our security.

Secure Linux Cloud Infrastructure

Our websites and applications are hosted within a professionally managed Linux Cloud environment. We continuously maintain and secure the infrastructure through appropriate technical controls, including:

• Firewall and network protection.
• Restricted administrative access.
• Secure SSH access.
• Access-control management.
• Server and service monitoring.
• Secure server configuration.
• Antivirus and anti-malware protection.
• Security scanning.
• File and directory permission management.
• SSL/TLS protection.
• Backup and recovery mechanisms.
• Vulnerability management.
• Security logging.

Infrastructure configurations are reviewed and strengthened according to identified risks and evolving security requirements.

System Maintenance & Security Updates

Keeping systems updated is one of the fundamental elements of our security approach. We regularly maintain infrastructure components and apply security updates according to their relevance, severity and operational impact. Depending on the environment, this includes:

• Linux operating system packages.
• Web server software.
• Apache.
• Web application software.
• OpenSSL.
• MySQL, MariaDB or PostgreSQL.
• DNS services.
• Email services.
• Security modules.
• Firewall components.
• System libraries.
• Application dependencies.

Critical security updates and vulnerabilities are prioritized to reduce exposure to known threats.

Website & Application Security

Security does not stop at the server level. We also consider the security of the websites and web applications operating within our infrastructure. Where applicable, we maintain:

• Web application core software.
• Extensions and modules.
• Themes and templates.
• Frameworks.
• Libraries.
• Application components.
• Application dependencies.
• Custom web applications and APIs.

Obsolete, unsupported or vulnerable components are identified and addressed through appropriate measures such as updating, replacing, isolating or removing them.

Malware & Virus Protection

Protecting websites and servers against malware is an important part of our infrastructure security approach. We use available antivirus and anti-malware mechanisms to help detect suspicious or malicious activity. Security scanning may identify:

• Malware.
• Malicious scripts.
• Webshells.
• Compromised files.
• Suspicious uploads.
• Known malware signatures.
• Unauthorized modifications.
• Compromised website files.

Security alerts are investigated and handled according to the nature and severity of the event.

Malware Detection, Removal & Recovery

When malicious activity is identified, we follow a structured approach to remediation.

• Detect — Identify the affected website, account, application, file or server component.
• Assess — Determine the scope, severity and potential impact of the incident.
• Contain — Quarantine or isolate affected resources where necessary.
• Remove — Remove malicious files, scripts or unauthorized modifications.
• Recover — Restore legitimate files or services from trusted backups when appropriate.
• Investigate — Identify the probable vulnerability, compromised credentials or entry point.
• Harden — Apply additional security measures to reduce the possibility of recurrence.
• Verify — Perform additional scans and checks to confirm that the threat has been addressed.
• Learn — Use lessons learned to improve our security controls and operational procedures.

Vulnerability Management

Cybersecurity risks continuously evolve. We therefore pay particular attention to vulnerabilities affecting operating systems, hosting platforms, websites, applications, plugins, libraries and other components. Vulnerabilities are considered according to factors such as:

• Severity.
• Exploitability.
• Internet exposure.
• Service criticality.
• Potential business impact.
• Data sensitivity.
• Availability of security updates.

Higher-risk vulnerabilities are prioritized for remediation.

AUI CDN & Secure Content Delivery

The AUI CDN forms part of our web delivery and resilience architecture. It helps us improve the performance, availability and resilience of websites and online services. Depending on the service configuration, the CDN can contribute to:

• Efficient content delivery.
• Traffic distribution.
• Secure HTTPS delivery.
• Improved availability.
• Reduced load on origin infrastructure.
• Additional protection for origin services.
• Greater resilience against certain network-level threats.

Our web architecture can be represented conceptually as:

Security considerations are applied across this architecture rather than relying on a single security mechanism.

SSL/TLS & Secure Communications

We use secure communication mechanisms to protect information exchanged between users, websites, applications and infrastructure. HTTPS and SSL/TLS are used where appropriate. Our security practices include:

• SSL/TLS certificate management.
• Certificate renewal.
• Protection of private keys.
• Secure TLS configuration.
• Secure administrative connections.
• Secure communication between infrastructure components where applicable.

Access Control & Administrative Security

Access to infrastructure and administration platforms is restricted to authorized personnel. We follow the principle of least privilege, meaning that access rights should correspond to legitimate operational responsibilities. Security practices include:

• Controlled server access.
• Controlled control panel access.
• Restricted SSH access.
• Strong authentication.
• Secure credential management.
• Periodic review of access rights.
• Removal of unnecessary or obsolete access.

Administrative access is treated as a critical security area and is subject to appropriate controls.

Database & Data Protection

Databases are an essential component of many hosted applications and are therefore included within our security approach. We apply appropriate measures to protect databases against unauthorized access and modification, including:

• Restricted database accounts.
• Appropriate authentication.
• Least-privilege permissions.
• Network access restrictions.
• Secure configuration.
• Regular backups.
• Monitoring where appropriate.

We also seek to prevent sensitive information from being unnecessarily exposed through insecure configurations or application vulnerabilities.

Backup & Recovery

Security also means being prepared for unexpected events. We maintain backup and recovery mechanisms for critical websites, applications, databases and configuration information according to operational requirements. Backups help support recovery from events such as:

• Malware infections.
• Website compromise.
• Accidental deletion.
• Data corruption.
• Hardware failures.
• Software failures.
• Cybersecurity incidents.

Recovery procedures are reviewed and, where appropriate, tested to help ensure that important services can be restored.

Security Monitoring

Continuous monitoring helps us identify abnormal activity and potential security events. Depending on the technology and service, monitoring may include:

• Authentication attempts.
• Administrative access.
• Malware detections.
• File modifications.
• Firewall events.
• Suspicious traffic.
• Server resource anomalies.
• Service availability.
• Backup status.
• Security alerts.
• Configuration changes.

Monitoring allows us to identify potential issues earlier and take appropriate action.

Incident Response

No security environment can eliminate every possible risk. Our approach therefore includes preparation for security incidents. Potential incidents may include:

• Malware infection.
• Unauthorized access.
• Website compromise.
• Credential compromise.
• Unauthorized file modification.
• Website defacement.
• Data loss.
• Service disruption.
• Suspicious network activity.
• Security vulnerabilities.

Depending on the situation, our response may involve detection, assessment, containment, remediation, recovery, verification and corrective action. Lessons learned from significant incidents can be used to strengthen our security practices.

Controlled Changes & Maintenance

Infrastructure security depends on controlled maintenance. Significant changes to production environments are considered carefully, including changes to:

• Server configuration.
• Linux servers.
• Firewall rules.
• DNS.
• AUI CDN configuration.
• SSL/TLS.
• Application software.
• Databases.
• Websites.
• Plugins and themes.
• Applications.
• System modules.

Changes are evaluated according to their potential impact on security, availability and service continuity.

Security Testing & Verification

Where appropriate, security controls and critical services are periodically reviewed or tested. This may include:

• Vulnerability scanning.
• Malware scanning.
• Backup verification.
• Recovery testing.
• Access-control reviews.
• SSL/TLS verification.
• Website security checks.
• Firewall reviews.
• Configuration reviews.
• Incident-response exercises.

The objective is not only to implement controls, but also to verify that they continue to work effectively.

Protecting Information

We recognize that information can be one of an organization's most valuable assets. Our security approach aims to protect information against:

• Unauthorized access.
• Unauthorized modification.
• Loss or destruction.
• Unauthorized disclosure.
• Service interruption.

Information protection measures are adapted according to the sensitivity, importance and risks associated with the information and service.

Continuous Improvement

We believe that information security is not a one-time project. Threats, technologies and business requirements change continuously. For this reason, we regularly seek opportunities to improve our security approach through:

• Risk assessments.
• Vulnerability management.
• Security monitoring.
• System and application updates.
• Malware analysis.
• Infrastructure hardening.
• Backup verification.
• Incident analysis.
• Corrective actions.
• Security testing.
• Access reviews.
• Internal reviews.
• Management oversight.
• Lessons learned.

Our objective is to continuously strengthen our ability to prevent, detect and respond to security threats.

Our Long-Term Commitment

We are committed to maintaining a secure, reliable and resilient digital infrastructure. Our approach is based on continuous improvement rather than a one-time security exercise. We continuously work to improve the protection of our:

• Infrastructure.
• Websites.
• Applications.
• Databases.
• Digital services.
• Information.
• Customers and users.

Our information security practices are developed with reference to recognized security principles and the ISO/IEC 27001 framework, particularly its risk-based approach and emphasis on continuous improvement. Security is an ongoing commitment. We continuously invest time, expertise and resources in maintaining and improving the security, reliability and resilience of the digital services entrusted to us.