User Tools

Site Tools


company_application_and_data_security

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
company_application_and_data_security [2018/08/17 09:21] – [GDPR Agreement] lucycompany_application_and_data_security [2021/09/01 15:11] (current) lucy
Line 10: Line 10:
 | Is there a comprehensive, documented information security concept including access management for your service in place? | yes | Tenant Model, Role Model and ACL in Place (Access control list) | | Is there a comprehensive, documented information security concept including access management for your service in place? | yes | Tenant Model, Role Model and ACL in Place (Access control list) |
 | Is a risk management process implemented dealing with the periodical identification, valuation of risks and the implementation of mitigation controls? | yes | It's in Management Handbook Security Policy. Each employee is encouraged to report risks. This applies in particular to IT and Cyber risks. A risk catalog is kept. At least once a year a risk assessment is carried out. The obligation is with the DPO / Chief Security and Risk Officer. | | Is a risk management process implemented dealing with the periodical identification, valuation of risks and the implementation of mitigation controls? | yes | It's in Management Handbook Security Policy. Each employee is encouraged to report risks. This applies in particular to IT and Cyber risks. A risk catalog is kept. At least once a year a risk assessment is carried out. The obligation is with the DPO / Chief Security and Risk Officer. |
-| Is a periodic assessment conducted of how well the security policies and procedures are respected within the company? | partialy | We have two roles DPO & CSRO (chief sec and risk officer). There's a regularity done by the CSRO himself. . |+| Is a periodic assessment conducted of how well the security policies and procedures are respected within the company? | partially | We have two roles DPO & CSRO (chief sec and risk officer). There's a regularity done by the CSRO himself. . | 
 + 
 + 
 + 
  
 ==== Allocation of information security responsibilities ==== ==== Allocation of information security responsibilities ====
Line 34: Line 38:
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Is physical access to buildings that house critical IT facilities restricted to authorized individuals? | yes | Access to the building is possible with fingerprint in addition to an rfid key card. Without it no access is not possible. |+| Is physical access to buildings that house critical IT facilities restricted to authorized individuals? | yes | Access to the building is possible with fingerprint in addition to an RFID key card. Without it no access is not possible. |
  
 ==== Policy for DC and IT System access ==== ==== Policy for DC and IT System access ====
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Are policies and procedures implemented to specify proper use of and access to IT systems and network components. | yes | Access to Routers / Network components is only possible through a separate VPN network. Authentication on Firewalls / Routers is only possible through SSH-Key. All Logs are stored on an separate logging device, all configuration changes are monitored, saved and alerted. Physical Access is only possible for certified network admins. |+| Are policies and procedures implemented to specify proper use of and access to IT systems and network components. | yes | Access to Routers / Network components is only possible through a separate VPN network. Authentication on Firewalls / Routers is only possible through SSH-Key. All Logs are stored on separate logging device, all configuration changes are monitored, saved and alerted. Physical Access is only possible for certified network admins. |
  
 ==== Secure disposal or re-use of IT equipment ==== ==== Secure disposal or re-use of IT equipment ====
Line 57: Line 61:
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
 | Is staff made aware of the key elements of information security and why it is needed (i.e. segregation of duties, need to know)? | yes | All staff that has any relation to the software code and our infrastructure (software engineers, QA engineers, support engineers, system admins, etc) pass internal information security courses. | | Is staff made aware of the key elements of information security and why it is needed (i.e. segregation of duties, need to know)? | yes | All staff that has any relation to the software code and our infrastructure (software engineers, QA engineers, support engineers, system admins, etc) pass internal information security courses. |
-| Are service administrators properly educated on their responsibilities with regard to security? | yes | All employees are getting internal lesson on cyber security and passing security courses that include basic vulnerabilities overview, penetration technologies, mitigation methods, etc. It is an internal training based on one-to-one introduction and a combination of Webinars / Practical Laboratory courses using Kali Linux. |+| Are service administrators properly educated on their responsibilities with regard to security? | yes | All employees are getting an internal lesson on cybersecurity and passing security courses that include basic vulnerabilities overview, penetration technologies, mitigation methods, etc. It is an internal training based on the one-to-one introduction and a combination of Webinars / Practical Laboratory courses using Kali Linux. | 
 + 
 + 
 +==== Security Policies for LUCY staff ==== 
 + 
 +LUCY employees must agree to the policy at the time they start work on the following topics: 
 + 
 +  - Responsibility in safe data handling 
 +  - Secure Traveling 
 +  - Reporting Security Incidents 
 +  - Workplace conduct 
 +  - Use of email and awareness against cyber risks 
 +  - Internet use 
 +  - Using passwords 
 +  - Data Classification 
 +  - Protection from social engineering 
 +  - Social Networking 
 +  - Virus protection 
 +  - Hardware and software measures 
 +  - Violation of protective measures and reporting obligation
  
 ===== Identity and Access Management ===== ===== Identity and Access Management =====
Line 69: Line 92:
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Is the access to the service and data restricted to authorized individuals and based on an established access control policy? | yes | Physical access is protected with fingerprint in addition to an rfid key card and the keys of the rack. "Virtual" access via SSH-Keys. No written policy for that and not mandatory for a company of this size. | +| Is the access to the service and data restricted to authorized individuals and based on an established access control policy? | yes | Physical access is protected with fingerprint in addition to an RFID key card and the keys of the rack. "Virtual" access via SSH-Keys. No written policy for that and not mandatory for a company of this size. | 
-| Do access control arrangements restrict access to only approved system capabilities? | yes | Physical access is protected with fingerprint in addition to an rfid key card and the keys of the rack. "Virtual" access via SSH-Keys. No written policy for that and not mandatory for a company of this size. |+| Do access control arrangements restrict access to only approved system capabilities? | yes | Physical access is protected with fingerprint in addition to an RFID key card and the keys of the rack. "Virtual" access via SSH-Keys. No written policy for that and not mandatory for a company of this size. |
  
 ==== Data access ==== ==== Data access ====
Line 85: Line 108:
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Will the allocation of passwords be controlled through a formal password policy process? | partialy | When chosing passwords they need to have more than 8 characters and they must be a mix of capital/lower letters, numbers and special characters. If there is a possibility for two-factor authentication (2FA), then 2FA should be applied. |+| Will the allocation of passwords be controlled through a formal password policy process? | partially | When choosing passwords they need to have more than 8 characters and they must be a mix of capital/lower letters, numbers and special characters. If there is a possibility for two-factor authentication (2FA), then 2FA should be applied. |
  
 ==== User registration & management ==== ==== User registration & management ====
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Is there a formal user registration and de-registration procedure in place for granting and revoking access to all systems and services and to tenants data? | yes | An engineer may obtain an access to a single tenants data only in case there is a need for maintenance, based on tenants request. An engineer sends a request to the systems admin or to the tenants responsible person (there is an option to grant access from the tenant's side). The permission is immediately revoked after the maintenance is finished. The permissions are granted and revoked within a few minutes. | +| Is there a formal user registration and de-registration procedure in place for granting and revoking access to all systems and services and to tenants data? | yes | An engineer may obtain access to a single tenants data only in case there is a need for maintenance, based on tenants request. An engineer sends a request to the systems admin or to the tenants responsible person (there is an option to grant access from the tenant's side). The permission is immediately revoked after the maintenance is finished. The permissions are granted and revoked within a few minutes. | 
-| Is a user management process in place (creation, revocation, provisioning and termination of rights, etc.)? | yes | After contract termination the LUCY Server Instance is safely reset. This is a built in and secure feature in LUCY Server. https://www.lucysecurity.com/PS/doc/dokuwiki/doku.php?id=factory_reset |+| Is a user management process in place (creation, revocation, provisioningand termination of rights, etc.)? | yes | After contract termination the LUCY Server Instance is safely reset. This is a built-in and secure feature in LUCY Server. https://www.lucysecurity.com/PS/doc/dokuwiki/doku.php?id=factory_reset |
  
 ==== Session time-out ==== ==== Session time-out ====
Line 103: Line 126:
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Do you have an easily way for externals to report security vulnerabilities in your systems? | yes | Write a mail to support@lucysecurity.com or dpo@lucysecurity.com . Every employee needs to react as stated in the GDPR code of contact |+| Do you have an easy way for externals to report security vulnerabilities in your systems? | yes | Write a mail to support@lucysecurity.com or dpo@lucysecurity.com . Every employee needs to react as stated in the GDPR code of contact |
  
 ==== Information about inappropriate access ==== ==== Information about inappropriate access ====
Line 114: Line 137:
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
 | Do you inform your customers about vulnerabilities in your products once you had a chance to address them, regardless of whether they were discovered internally, or reported to you? | yes | with a dedicated form and a direct mailing put in place already | | Do you inform your customers about vulnerabilities in your products once you had a chance to address them, regardless of whether they were discovered internally, or reported to you? | yes | with a dedicated form and a direct mailing put in place already |
 +
 +==== Vulnerability Rating====
 +Our vulnerabilities are rated based on CVSS standard (https://www.first.org/cvss/v3-1/cvss-v31-user-guide_r1.pdf)
  
 ===== Operations Management and Security Controls ===== ===== Operations Management and Security Controls =====
Line 130: Line 156:
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Is operating system hardening performed for all systems involved? | yes | OS is protected by internal firewall (iptables), SSH access keys are randomly generated, removed USB/firewire drivers, the app runs under a limited user account, etc. |+| Is an operating system hardening performed for all systems involved? | yes | OS is protected by internal firewall (iptables), SSH access keys are randomly generated, removed USB/firewire drivers, the app runs under a limited user account, etc. |
  
 ==== Application Server hardening ==== ==== Application Server hardening ====
Line 152: Line 178:
 | Do you regularly perform penetration tests on all systems relevant to your service? | yes | We use various web application vulnerability scanners and OS security auditing tools (Burp Suite, OpenVAS, Lynis, Nessus). Even though we've done our own human-based penetration tests in the past we do not perform human-based penetration assessment on a regular basis. | | Do you regularly perform penetration tests on all systems relevant to your service? | yes | We use various web application vulnerability scanners and OS security auditing tools (Burp Suite, OpenVAS, Lynis, Nessus). Even though we've done our own human-based penetration tests in the past we do not perform human-based penetration assessment on a regular basis. |
 | How often are penetration tests done for the above scope (on average)? | yes | LUCY software is not a classic SaaS Plattform or Software. We do not perform penetration tests on client production instances. We release new Major updates of the software every 1-2 months, the software is mostly distributed as a virtual appliance (VMWare ESXi or Amazon image) and the process of automated penetration testing is tied to the release process - we perform such testing on the final stage of the release lifecycle. The set of application versions and software configurations of the version we are going to roll out exactly corresponds to the state of all systems after they migrate to the new version. For example, we are preparing version 5.0 for release and run penetration tests against it, within a virtual appliance. After all tests passed and all vulnerabilities are closed, we release the update, which is distributed over all existing software installations on different servers. All existing installations switch their state (install all required packages, remove old ones, change configuration, etc) to the state of the new version automatically, so all vulnerabilities closed on the pre-release stage will be closed on all tenants servers automatically. We never change anything on tenants servers directly. | | How often are penetration tests done for the above scope (on average)? | yes | LUCY software is not a classic SaaS Plattform or Software. We do not perform penetration tests on client production instances. We release new Major updates of the software every 1-2 months, the software is mostly distributed as a virtual appliance (VMWare ESXi or Amazon image) and the process of automated penetration testing is tied to the release process - we perform such testing on the final stage of the release lifecycle. The set of application versions and software configurations of the version we are going to roll out exactly corresponds to the state of all systems after they migrate to the new version. For example, we are preparing version 5.0 for release and run penetration tests against it, within a virtual appliance. After all tests passed and all vulnerabilities are closed, we release the update, which is distributed over all existing software installations on different servers. All existing installations switch their state (install all required packages, remove old ones, change configuration, etc) to the state of the new version automatically, so all vulnerabilities closed on the pre-release stage will be closed on all tenants servers automatically. We never change anything on tenants servers directly. |
 +| On what standards does LUCY perform Penetration tests? | Yes| OSSTMM https://www.isecom.org/OSSTMM.3.pdf |
  
 ==== Security incident detection and correlation ==== ==== Security incident detection and correlation ====
Line 161: Line 188:
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Is tenets data held on data storage media (including magnetic tapes, disks, printed results, and stationery) protected against corruption, loss or disclosure? | yes | Tenants data is entirely stored on a disk on the server, and the only measure against data loss we perform _by default_ is a local daily database backup, which can help to prevent minor data loss. As an additional measure, we can set up RAID0 or RAID5 array, which can add an additional layer of protection against data loss or corruption. There is no access to other storage media from the server. The information in DB is encrypted using AES-256 (so it's stored int he encrypted form) and the key is built into the application, so there'minimal protection from data disclosure. |+| Is tenets data held on data storage media (including magnetic tapes, disks, printed results, and stationery) protected against corruption, loss or disclosure? | yes | Tenants data is entirely stored on a disk on the server, and the only measure against data loss we perform _by default_ is a local daily database backup, which can help to prevent minor data loss. As an additional measure, we can set up RAID0 or RAID5 array, which can add an additional layer of protection against data loss or corruption. There is no access to other storage media from the server. The information in DB is encrypted using AES-256 (so it's stored int he encrypted form) and the key is built into the application, so there's minimal protection from data disclosure. |
  
 ==== Malware/ Defacement ==== ==== Malware/ Defacement ====
Line 176: Line 203:
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Do you encrypt tenant data in storage and server side? | yes | Data is encrypted using AES-256. The application server gets data over HTTP/TLSv1.1+ connection and operates the data in cleartext form. The information is encrypted by the application before storing it into the DB, so the DB engine receives the information in an encrypted form (and therefore stores it to the storage media).The application decrypts the information from the DB before processing it.There are no other types of encryption beyond these. |+| Do you encrypt tenant data in storage and server side? | yes | Data is encrypted using AES-256. The application server gets data over HTTP/TLSv1.1+ connection and operates the data in cleartext form. The information is encrypted by the application before storing it into the DB, so the DB engine receives the information in an encrypted form (and therefore stores it to the storage media). The application decrypts the information from the DB before processing it. There are no other types of encryption beyond these. |
  
 ==== Network encryption ==== ==== Network encryption ====
Line 193: Line 220:
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Do you provide secure software development training to your engineers, that teaches them about common threats and counter measures related to the software they are writing? | yes | Software engineers are trained to avoid OWASP top 10 vulnerabilitiesl identify any existing vulnerabilities and mitigate them during the software development. |+| Do you provide secure software development training to your engineers, that teaches them about common threats and countermeasures related to the software they are writing? | yes | Software engineers are trained to avoid OWASP top 10 vulnerabilities identify any existing vulnerabilities and mitigate them during the software development. |
  
 ==== Use of productive Data for test purpose ==== ==== Use of productive Data for test purpose ====
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Will you use tenant data for testing purposes? | no | |+| Will you use tenant data for testing purposes? | no | Using of tenant data is prohibited in test and development environments |
  
 ==== Data input and output validation ==== ==== Data input and output validation ====
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Are data input and output integrity routines (i.e., reconciliation and edit checks) implemented for application interfaces and databases to prevent manual or systematic processing errors or corruption of data? | yes | Build in validations in the application |+| Are data input and output integrity routines (i.e., reconciliation and edit checks) implemented for application interfaces and databases to prevent manual or systematic processing errors or corruption of data? | yes | Built-in validations in the application |
  
 ===== Business Continuity Management ===== ===== Business Continuity Management =====
Line 210: Line 237:
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Has the provider a defined and documented method for coping with a business continuity situation? | no The software has not mission criticality for the business |+| Has the provider a defined and documented method for coping with a business continuity situation? | yes There is a Business Continuity Plan |
  
 ==== Plans and procedures ==== ==== Plans and procedures ====
  
 ^ Questions ^ Response ^ Comments ^ ^ Questions ^ Response ^ Comments ^
-| Has the provider implemented, tested and documented a set of procedures and actions for a contingency situation? | no The software has not mission criticality for the business |+| Has the provider implemented, tested and documented a set of procedures and actions for a contingency situation? | yes There are tested and documented procedures for a contingency situations |
  
 ==== Data and production recovery ==== ==== Data and production recovery ====
Line 231: Line 258:
  
 Please download our GDPR agreement {{ :gdpr_agreement.docx |here}} Please download our GDPR agreement {{ :gdpr_agreement.docx |here}}
 +
 +
 +==== Auftragsdatenverarbeitungsvertrag (German) ====
 +
 +Please download our Auftragsdatenverarbeitungsvertrag {{ ::auftragsverarbeitung.docx |here}}
  
company_application_and_data_security.1534490474.txt.gz · Last modified: 2019/07/25 12:50 (external edit)