Secure Build
Beyond Service Guide
Designed to not need to be rebuilt in 3 years
This is a contract development service that includes security design, load testing, monitoring design, and operational design as standard processes. The same team is responsible for everything from design to implementation, release decision, and subsequent operation
Design and development of ID and membership infrastructure
Define the expected load and conduct the test
The same team will be in charge after release
\ Response within one business day at the earliest /
Get started with a free consultationWISSUES
Do you have any of these concerns ?
- I'm worried about whether we can continue to expand our membership base at its current level
- I have separate accounts for multiple services
- We handle personal information, but there's no one to oversee its security
- I'm worried about whether it can handle periods of high traffic
- The infrastructure is handled by a separate company, making the responsibility unclear
- It is undecided who will oversee its operation after it is created
- The requirements aren't finalized, and I don't know where to begin with the consultation
- The old system had to be rebuilt within a few years
WHAT IT IS
About the service
Secure Build is a contract development service that handles not only the design and implementation of functions, but also identity and permission design, handling of critical data, definition and testing of expected loads, cloud configuration, and design of monitoring, backup, and operation as a single development process .
The company, whose main business is building cloud servers and providing 24/7/365 operation and maintenance, is also handling the development itselfThe application implementation and server configuration are designed by the same team, based on the same assumptions* The scope and process will vary depending on the scale and requirements of the system. If you wish to adjust the scope according to your budget, we will provide an estimate that clearly specifies which items will be excluded and which checks will become impossible as a result
Differences from typical contract development
| - | Typical contract development company | Division of labor between development company and infrastructure company | Secure Build |
|---|---|---|---|
| Functional design and implementation | ◎ Support | ◎ Support | ◎ Support |
| ID and permission infrastructure design | △ Implemented as one of the features | △ The development company made the decision on its own | ◎ Designed as a foundation |
| Security Design | △ Will be addressed if required | △ The division of responsibility is ambiguous | ◎ Included in the standard process |
| Design based on load | × Separate estimate required | △ Measures to be taken solely on the infrastructure side | ◎ Definition and testing will be conducted |
| Designing a Cloud Configuration | × Outsourcing | ○ Infrastructure company in charge | ◎ The same team is in charge |
| Monitoring and backup design | × Many are excluded | ○ Infrastructure company in charge | ◎ Included in the development process |
| Release Criteria | × Not explicitly stated | △ Standards differ from company to company | ◎ Planned in advance |
| Post-release operations | △ Maintenance contracts are separate | △ The contact point is split between two companies | ◎ Can be transferred as is |
* The two columns on the left summarize general organizational trends. Actual scope of service may vary depending on each company's contract
SERVICE
What we offer
01Hearing and Requirements Definition:Engineers participate from the conceptual stage and work together to determine the specifications.
02Basic Design (External Design): Design the screen, operability, and UI/UX.
03Detailed Design (Internal Design): Design the functions, operation, and data structure.
04ID and Permission Design:Design who can access what in a way that allows for changes later.
05Important Data Design:We design the storage location, encryption, and access routes for personal information and other sensitive data.
06Security Requirements Documentation:Anticipated threats and countermeasures are documented as requirements.
07Audit Log Design: We design a system that can track "when, who, and what was done."
08Cloud Configuration Design:We design infrastructure configurations that include redundancy and scalability.
09Program Development and Implementation:We will implement the program using PHP / Laravel, etc., according to the decided specifications.
10.Unit, Integration, and Systematic Testing:We verify functionality step by step, from individual units to the entire system.
11.Load Test Design and Implementation:Define the expected maximum access and verify its resilience.
12.Monitoring Design:This involves designing what to monitor and what events trigger notifications.
13.Backup and Recovery Design:Defines how far back you can recover in the event of a failure.
14.Operational Design and Runbook Preparation:We will design the operational procedures and system after the release.
15. We will pre-determine the criteria for deciding whether to release the product and move it to production.
*Items 04-08 and 11-15 are often quoted separately in typical contract development projects. Secure Build includes them in the standard process
A PROJECT IN PRACTICE
Actualdevelopment examples
IDENTITY & MEMBERSHIP PLATFORM
ID/Membership Platform Package
Separate IDs for each service, missed account cancellation processes, and organizational changes that can't be kept up with. The more you handle each service individually, the harder it becomes to integrate them later. This is an example of designing and developing a unified platform for ID, authentication, and access control across multiple services| Authentication and Identity Integration | Identity integration, single sign-on (SSO), OpenID Connect/SAML integration, external identity integration |
|---|---|
| Membership and Organization Management | Membership management, organizational management, access control at the school/class/company level, role design |
| Features designed with operational use in mind | Bulk registration, annual renewal, withdrawal/suspension/transfer processing |
| Logs and audits | Login history, operation logs, audit logs |
| Operational design | Operational design of the authentication infrastructure, and design of the scope of impact in the event of a failure |
Suitable customers
Educational servicesrequire school- and class-level access control.
Membership-based serviceswith a large number of members: B2C / B2B services
SaaStenant role management has become complex.
Handling medical and healthcare data requires special consideration
The operating company has multiple businesses,and each service has a separate ID.
for existing serviceshave become more complex.
CASE
Development of an ID infrastructure that spans multiple services
For a client operating multiple educational services, we consolidated their previously separate accounts. We designed and developed a system that includes school/class-level access control and annual renewal managementOUTCOME
What will change if you request our services ?
01
This will help avoid having to rebuild it a few years from now.
Even as the number of services and members increases, you can avoid having to rebuild the entire system due to issues with ID and permission structures. Permissions and data structures are designed with expansion in mindEven as the number of services increases, the underlying infrastructure can continue to be used as is02
the busy seasonwith a solid foundation.
When there's a surge in access during the start of a new fiscal year or a major event, you won't have to face the day without knowing if your system can handle it. We define the expected peak numerically and even conduct load testingYou can publish it knowing how many people it can handle03
The person in charge remains the same even after the release.
By separating the development and maintenance companies, the design intent is not lost, and there is no waste of having to start the investigation all over again with each modification. The engineers who developed the system are also involved in its operationSomeone familiar with the specifications will continue to handle the supportDOMAINS
Correspondingdevelopment areas
▶ High-load web service development
▶Development of educational DX services
▶Medical and healthcare web service development
▶Game and campaign platform development
▶ Reservation, application, and membership service development
▶SaaS management screen and API platform development
* We may be able to assist you with services not listed above, so please feel free to contact us for a consultation
CONTACT
