Over the past two years, major Bangladeshi banks, universities, and telecom operators have suffered catastrophic data breaches resulting in millions of leaked user records.
When these breaches are investigated, the root cause is almost always the same: poorly engineered Custom Software built by vendors who do not understand enterprise cybersecurity.
If you are building an enterprise Web Application or ERP in Dhaka, you can no longer rely on simple passwords to protect your data. Furthermore, with the upcoming Bangladesh Data Protection Act (DPA), a data breach is no longer just a PR disaster—it is a massive legal liability.
At BengalTech Solutions, we engineer systems designed to withstand sustained cyber attacks. This is our technical guide to enterprise software security in Bangladesh.
"Security is not a feature you add at the end of a project. If your core architecture is not secure by design, your software is already compromised."
Table of Contents
- The Bangladesh Data Protection Act (DPA)
- Stateless Authentication: JWT vs Sessions
- Infrastructure Security: AWS WAF and VPC
- Data Encryption: In Transit and At Rest
- Vulnerability Scanning and Penetration Testing
The Bangladesh Data Protection Act (DPA)
The government of Bangladesh is finalizing the Data Protection Act (DPA), modeled heavily on Europe's GDPR. For enterprise software owners, the DPA introduces strict legal requirements:
- Data Localization: Certain classifications of sensitive data (like financial or health records) may be required to physically reside on servers within the geographical borders of Bangladesh.
- Right to be Forgotten: Your custom software must have the architectural capability to permanently and irreversibly delete a specific user's data across all databases and backups upon request.
- Breach Notification: If your system is hacked, you are legally required to report the breach to the government authority within a strict timeframe.
Ignorance is not a defense. If your cheap ERP Software is breached because the developers left the database open to the public internet, your company faces severe financial penalties.
Stateless Authentication: JWT vs Sessions
The most common way hackers access a system is by stealing an administrator's "Session ID" cookie.
Legacy software stores sessions in the server's memory. This is slow, hard to scale, and vulnerable to Session Hijacking. BengalTech engineers implement Stateless Authentication using JSON Web Tokens (JWT).
- When an employee logs in, the server cryptographically signs a JWT using a private key and issues it to the browser.
- The JWT is stored in an
HttpOnly,Securecookie, meaning malicious JavaScript cannot steal it (preventing XSS attacks). - The Access Token expires every 15 minutes. Even if a hacker intercepts it, the token becomes useless almost immediately.
- A long-lived Refresh Token is strictly controlled and automatically rotated upon use.
Infrastructure Security: AWS WAF and VPC
Your database should never have a public IP address. Never.
BengalTech isolates your enterprise data using an AWS Virtual Private Cloud (VPC).
- Public Subnet: Only your web servers (Load Balancers) sit here, facing the internet.
- Private Subnet: Your PostgreSQL databases and core APIs sit here. They have no route to the internet. They can only be accessed by the Load Balancer.
In front of the Load Balancer, we deploy an AWS WAF (Web Application Firewall). The WAF uses machine learning to inspect every single incoming request. If it detects a SQL Injection attempt, a DDoS (Distributed Denial of Service) attack, or traffic from a known malicious IP address in a foreign country, it drops the request instantly.
Data Encryption: In Transit and At Rest
Security requires layers.
- In Transit: All data moving between the user's browser, the API, and the database must be encrypted using TLS 1.3. We strictly enforce HSTS (HTTP Strict Transport Security) so the application cannot be accessed via unencrypted HTTP.
- At Rest: Even if a hacker breaches the Private Subnet and steals the raw database files, the data is useless to them. We use AES-256 encryption at the hardware level (AWS KMS) to encrypt the hard drives. Without the decryption key (which the hacker does not have), the data is just mathematical noise.
Vulnerability Scanning and Penetration Testing
A secure architecture today might be vulnerable tomorrow if a new zero-day exploit is discovered in an NPM package or a server OS.
As part of our Maintenance SLA, BengalTech runs automated vulnerability scanners (like OWASP ZAP or Snyk) against your codebase on every deployment. Before launching major enterprise platforms, we recommend a full manual Penetration Test ("Pen Test") by certified ethical hackers to attempt to break the system.
Do not trust your enterprise data to vendors who treat security as an afterthought. Contact BengalTech Solutions to build secure, DPA-compliant enterprise software in Bangladesh.
Frequently Asked Questions
The draft Data Protection Act of Bangladesh regulates how companies collect, store, and process the personal data of Bangladeshi citizens. It mandates strict data localization (keeping certain sensitive data within BD borders), immediate breach notification, and hefty fines for companies that fail to secure user data.
Off-the-shelf software (like Shopify) has hundreds of security engineers patching it daily. Custom software built by cheap, inexperienced agencies in Bangladesh is often riddled with basic vulnerabilities like SQL Injection and Cross-Site Scripting (XSS), making it an easy target for automated botnets.
JWT is a modern, stateless authentication method. Instead of saving a user's session in the database (which can overload the server), the server cryptographically signs a small token and gives it to the user. The user sends this token with every request. If the token is tampered with, the cryptographic signature fails instantly.
A Web Application Firewall (WAF) sits between the internet and your server. It inspects every single incoming request. If a hacker in Russia tries to send malicious SQL code to your Bangladeshi server, the AWS WAF detects the pattern and blocks the IP address before the request even reaches your application.
Absolutely. Encryption at rest means that even if a hacker gains physical access to your server hard drive, the data is scrambled and unreadable without the AES-256 decryption key (which is stored in a separate, highly secure KMS vault).