Badan Meteorologi, Klimatologi, dan Geofisika
Stasiun Meteorologi Maritim Kelas I Merak Penyeberangan Merak–Bakauheni · Selat Sunda

Information Security Standards

How we protect this site, data, and the station’s digital public services

Last reviewed: 25 Juli 2026 · Log Pemutakhiran

Maritime Meteorological Station Class I Merak applies security controls on this official website so maritime weather information and digital public services can be used safely. This page summarises the standards we align with and the technical controls that are actually in place — not a claim of formal certification.

Scope

  • The official Stamar Merak website (MerakWeb on this domain).
  • The related Online Services portal (/layanan) — a separate system under the same station policy, with parallel controls (security headers, admin sessions, CSRF, uploads, rate limits, and nginx scan honeypots).
  • The site administration panel (authorised staff only).

Standards We Align With

Our security practices are aligned with the frameworks below. Naming them does not mean the station is certified against every requirement of those standards.

  • OWASP Top 10 and OWASP ASVS themes — web application security (injection, authentication, XSS, CSRF, secure configuration, file uploads).
  • NIST Cybersecurity Framework — Protect and Detect functions (session/header hardening, scan-pattern detection, activity logging).
  • ISO/IEC 27001 control themes — access control, transport cryptography, logging/audit, and operational incident handling (aligned; not certified).
  • SPBE (Indonesia’s Electronic-Based Government System) — security of government applications and digital public services.
  • Law No. 27 of 2022 on Personal Data Protection — see our Privacy Policy.
  • RFC 9116 — vulnerability reporting contact via /.well-known/security.txt.
  • WCAG 2.1 — accessibility as part of inclusive service; see our Accessibility Statement.

Technical Controls in Place

Transport & browser

  • HTTPS at the edge (Cloudflare) with HSTS (includeSubDomains; preload).
  • Content-Security-Policy with a per-request nonce (no script-src 'unsafe-inline'), plus upgrade-insecure-requests.
  • Modern headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy.

Admin authentication & sessions

  • Passwords hashed with bcrypt; session ID regenerated on login.
  • Account lockout after repeated failures plus per-IP throttle against credential spraying.
  • CSRF tokens on all write requests; token rotated after login.
  • Session cookies: HttpOnly, Secure, SameSite=Lax; idle timeout.
  • RBAC: Administrator vs Editor roles (critical settings Administrator-only).
  • Admin activity log (who · what · when).

Application & data

  • File uploads: extension allow-list, random names, image/magic-byte checks; PHP execution under /uploads denied in nginx.
  • Rate limits: nginx (~20 req/s per client, ~80 req/s per peer) plus an app per-client minute cap; form-specific limits on complaints/SKM; form honeypots.
  • Vulnerability-scan honeypot (including from internal networks) — scanner patterns get a decoy, not the real application.
  • Visit statistics without tracking cookies and without storing raw IPs (daily-salted hash only).
  • PII retention: identifiers in resolved complaints are redacted after the retention period.
  • Maintenance mode (kill switch) that exempts /admin and fails open if the database cannot be read.

Vulnerability Reporting

If you find a potential security vulnerability on this site, please report it responsibly. Do not exploit it further or publish details before we have had a chance to address it.

We appreciate clear, reproducible reports submitted in good faith.