Advanced Search
Search Results
17 total results found
Security at NFE
Security at NFE This book is adapted from the Security section of the GitLab Handbook (CC BY-SA 4.0), scaled down for a small team running self-hosted tools and field energy systems. See About this book at the bottom. Vision and mission Vision: keep the peop...
Reporting a Security Incident
Reporting a Security Incident Adapted from GitLab's "Engaging the Security Engineer On-Call". If in doubt, report it. A false alarm costs a few minutes. An unreported compromise cost us weeks in 2026 (see Incident Reports). What counts as an incident A lost o...
Security Incident Severity Matrix
Security Incident Severity Matrix Adapted from GitLab's Security Incident Severity Matrix. Purpose A standard way to classify how serious a security incident is. Severity decides how fast we respond, who gets involved and who we tell. It is set during the firs...
Security Incident Response Guide
Security Incident Response Guide Adapted from GitLab's Security Incident Response Guide (SIRT). Scope Any event that may harm NFE, our customers, partners or team members, or that breaks our security or acceptable-use policies. That includes incidents at provi...
Leaked Credentials Runbook
Leaked Credentials Runbook Use this when an NFE password, app password, API key or SSH key may be known to someone else. It was written after the 2026 mailbox compromises. Important: at NFE, one LDAP password unlocks Nextcloud, IMAP/SMTP mail and Roundcube we...
Responding to Ransomware
Responding to Ransomware Adapted from GitLab's "Responding to Ransomware". Ransomware encrypts files and demands payment. It can arrive through a phishing attachment, a compromised account, or an exposed device or server. NFE's position: we restore from backup...
Password Guidelines
Password Guidelines Adapted from GitLab's Password Guidelines, which follow NIST SP 800-63B. Passwords are still the main lock on most NFE systems. Our NFE password (LDAP) opens Nextcloud, mail (IMAP/SMTP) and Roundcube webmail. Treat it as the key to everythi...
Accounts, 2FA and App Passwords
Accounts, 2FA and App Passwords Adapted from GitLab's identity and access guidance, for NFE's Nextcloud + LDAP setup. How NFE accounts work System How you log in Notes Nextcloud (files, Talk, Deck, Mail app, Calendar) NFE username + LDAP password Suppor...
Email Security and Phishing
Email Security and Phishing Adapted from GitLab's Phishing Program and Email Security Standards. Email is the most common way into an organisation: phishing pages steal passwords, attachments install malware, and fake invoices or "urgent" requests trick people...
Device and Network Security
Device and Network Security Adapted from GitLab's device standards and "Isolating your work laptop from other devices in your home". Your laptop and phone hold your NFE sessions, synced files and often saved passwords. An infected device leaks everything on it...
Onboarding and Offboarding Access
Onboarding and Offboarding Access Adapted from GitLab's CorpSec Onboarding/Offboarding Services. Onboarding checklist (new team member) NFE account created in LDAP/Nextcloud, with only the groups the role needs (not admins by default). The new member sets t...
Access Management Policy
Access Management Policy Adapted from GitLab's Access Management Policy. Purpose and scope Make sure only the right people have access to NFE systems and data, with no more access than they need. This covers Nextcloud, mail, LDAP, BookStack, ERPNext, Plane, se...
Audit Logging Policy
Audit Logging Policy Adapted from GitLab's Audit Logging Policy. Why We can only investigate what we logged. In the 2026 mailbox incidents, the login and source-IP evidence had already gone from Nextcloud's activity stream (it kept about 6 months), and mail su...
Encryption Standard
Encryption Standard Adapted from GitLab's Encryption Policy. In transit Every NFE web service (Nextcloud, BookStack, ERPNext, webmail) uses HTTPS with TLS 1.2+. Plain HTTP only redirects to HTTPS. Mail clients connect with TLS (IMAPS 993, SMTP submission 587 ...
Transparency by Default
Transparency by Default Adapted from GitLab's "Transparency by Default" for Security. Openness is one of NFE's values. In security, being open about how we work, what went wrong and what we changed makes the whole team stronger. Hiding incidents means repeatin...
Field Device and Code Security Baseline
Field Device and Code Security Baseline Adapted from GitLab's Product Security, Vulnerability Management and Secure Coding pages, for NFE's field hardware and software. What NFE deploys at customer sites (meters, hybrid inverters, OpenEMS on Raspberry Pi, the ...
2026 Mailbox Compromises: spam sent from NFE accounts
Incident report: spam sent from aaron.tushabe@nearlyfreeenergy.com (31 Mar – 1 Apr 2026) Prepared 20 Oct 2026 · read-only investigation (nothing was changed, deleted or sent) · Status: open, severity S2 (see the severity matrix) Summary The spam was real, auth...