I'm working on an small web application (Flask). The application is only for distributed internal usage, e.g. only users with credentials created by the organization will have access to the services beyond the Login page and the organization creates the users. It needs to be distributed because some of the user base is traveling. The data hosted on the application is day to day operation stuff, inventories, invoices, clients contacts & similar. It is organization-sensitive in the sense that you wouldn't want competitors or third parties sniffing it out. No financial transaction, or bank accounts data are stored there.
From a security perspective, my thinking is that proper user management system with a solid implementation is a sufficient level of security for this, or more specifically:
- CSRF protection for anything getting user inputs (which Flask provides if using Flask Forms, or pluggins exists otherwise)
- XSS protection (Jinja templating goes a long way to protect from that). At any rate, all user inputs are sanitized and no html (or css) is served based on raw user inputs.
- And basically everything outlined in Flask's Security Considerations is followed & properly implemented, as relevant in the use case.
- An ORM is used, so that anything that goes in the DB is properly parametrized to prevent SQL injections.
- At any rate, only trusted users can connect to this beyond the login page (therefore the above protection would get into play only if, say, a malicious user managed to gain control of a user account, and use it to try to inject code)
- The application is containerized on Docker. No container runs with root, meaning that any attacker who would infiltrate a container would not be able to break out of that container, and all Docker recommendations are followed. In addition, the only container that is actually open to the web (e.g. the only port opened on the host) is the nginx one.
- App runs on https
- Nginx for reverse proxy, to provide a layer of abstraction between the server itself and any user, as well to add protection against DDOS (though unlikely in our use case), serve static files etc.
- As users are also a weakling in any security system, it will be recommended to connect to the application only thru trusted wifi or data from their own simcard/ISP. Humans being humans, this may or not be followed in all cases.
- There will be different user profiles, each having access only to the parts of the data that are actually relevant for their job.
Seems to me this results in a robust enough application from a safety standpoint. Do I have obvious blind spots here? In which case would a security specialist start to consider "no, that's not enough, we really need to add a VPN connection on top of this"?