Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
Next revisionBoth sides next revision
security [2019_06_18 16:16] – [2 Encrypted Data in Motion] jimsecurity [2020_05_28 12:03] – [2 Encrypted Data in Motion] jim
Line 1: Line 1:
  
 ====== Security ====== ====== Security ======
 +== Updated on May 27, 2020 ==
  
 SME provides a SaaS and hybrid on-premises multi-cloud content management solution called the Enterprise File Fabric.  This provides unique federation, governance and data management features. This section of the Wiki outlines the security that is inherent within the SME hosted and on-premises versions of the File Fabric. SME provides a SaaS and hybrid on-premises multi-cloud content management solution called the Enterprise File Fabric.  This provides unique federation, governance and data management features. This section of the Wiki outlines the security that is inherent within the SME hosted and on-premises versions of the File Fabric.
 +
 ===== 1 Data Center ===== ===== 1 Data Center =====
  
-For the hosted SaaS service SME uses multiple data centres in USA and Europe. All data centres are Tier IV facilities and are:\\ \\ USA: SSAE16 SOC1/2 compliant, have 24x7 armed security, facility surveillance, biometric + keycard access to the data floor, keycode access to the cage, plus our own surveillance on top of the facility surveillance.\\ \\ Europe:   The Data Centers have ISO27001:2005, ISO9001:2008 certification, plus 24x7 security, facility surveillance, biometric + keycard + mantrap access to the data floor, locking cabinets with physical key access\\ \\ UK:   This is a new facility, currently undergoing the iso 27001/9001 process and also has 24x7 security,   facility surveillance, biometric + keycard + mantrap access to the data floor, locking cabinets with keycode access+For the hosted SaaS service SME uses multiple data centres in USA and Europe. All data centres are Tier IV facilities and are: 
 + 
 +USA: SSAE16 SOC1/2 compliant, have 24x7 armed security, facility surveillance, biometric + keycard access to the data floor, keycode access to the cage, plus our own surveillance on top of the facility surveillance. 
 + 
 +Europe:   The Data Centers have ISO27001:2005, ISO9001:2008 certification, plus 24x7 security, facility surveillance, biometric + keycard + mantrap access to the data floor, locking cabinets with physical key access 
 + 
 +UK:   This is a new facility, currently undergoing the iso 27001/9001 process and also has 24x7 security,   facility surveillance, biometric + keycard + mantrap access to the data floor, locking cabinets with keycode access
  
 All data centres have 24/7 physical security, facility surveillance, biometric ,   keycard entry authentication and mantrap access to the data floor uninterruptible power and backup systems. All data centres have 24/7 physical security, facility surveillance, biometric ,   keycard entry authentication and mantrap access to the data floor uninterruptible power and backup systems.
Line 20: Line 28:
  
 [[https://www.ssllabs.com/ssltest/analyze.html?d=storagemadeeasy.com|Check out]] our online sites using [[https://www.ssllabs.com/index.html|Qualys SSL Labs site check]]. [[https://www.ssllabs.com/ssltest/analyze.html?d=storagemadeeasy.com|Check out]] our online sites using [[https://www.ssllabs.com/index.html|Qualys SSL Labs site check]].
 +
 +{{::screenshot_2020-05-28_at_13.01.52.png?600|}}
 +
 ===== 3 Encryption Algorithm ===== ===== 3 Encryption Algorithm =====
  
Line 32: Line 43:
  
 See also [[https://storagemadeeasy.com/pressrelease/FIPS-140-2-compliance/|FIPS U.S. Federal Government Validation of the Enterprise File Fabric™ Cryptographic Algorithm]]. See also [[https://storagemadeeasy.com/pressrelease/FIPS-140-2-compliance/|FIPS U.S. Federal Government Validation of the Enterprise File Fabric™ Cryptographic Algorithm]].
 +
 ===== 4 Authentication Security ===== ===== 4 Authentication Security =====
  
Line 57: Line 69:
  
 ===== 6 Access Control Security ===== ===== 6 Access Control Security =====
- 
- 
  
 {{:/security:steps:sme_6_access_control_secur.png}} {{:/security:steps:sme_6_access_control_secur.png}}
Line 64: Line 74:
 The File Fabric supports Access Control Permissions at a Role, User, or folder level for shared folders. The Permissions can be taken from Active Directory if single sign-on is being used. The File Fabric supports Access Control Permissions at a Role, User, or folder level for shared folders. The Permissions can be taken from Active Directory if single sign-on is being used.
  
 +===== 7 Restrict by IP Address =====
  
-===== 7 Audit Security =====+The File Fabric supports the ability to whitelist or blacklist IP addresses. This can be done at the Organization level (tenant) or on a per user basis.
  
 +For more information see [[geoip]].
  
 +===== 8 Audit Security =====
  
 {{:/security:steps:sme_7_audit_security.png}} {{:/security:steps:sme_7_audit_security.png}}
Line 74: Line 87:
  
  
-===== Governance Options =====+===== Governance Options =====
  
 {{ :security:steps:security-policies.png |}} {{ :security:steps:security-policies.png |}}
Line 81: Line 94:
  
  
-===== Bring your own Device security ===== +===== 10 Bring your own Device security =====
- +
  
 {{:/security:steps:sme_9_bring_your_own_devic.png}} {{:/security:steps:sme_9_bring_your_own_devic.png}}
Line 89: Line 100:
 The Cloud File Server   (CFS) Admin controls which devices and access clients that each user of the Cloud File Server can connect from. By default all devices and access clients are enabled.  \\ \\ The Admin can entirely disable a user or just choose to disable access from any of the devices/access clients from the users settings instantly disabling user access. The Cloud File Server   (CFS) Admin controls which devices and access clients that each user of the Cloud File Server can connect from. By default all devices and access clients are enabled.  \\ \\ The Admin can entirely disable a user or just choose to disable access from any of the devices/access clients from the users settings instantly disabling user access.
  
-===== 10 Compliance Report =====+===== 11 Compliance Report =====
  
 The compliance report recommends settings that could be changed to enhance security. The user can jump from the online report directly to where the setting can be changed. The compliance report recommends settings that could be changed to enhance security. The user can jump from the online report directly to where the setting can be changed.
Line 95: Line 106:
 {{ :security:steps:compliance-report.png |}} {{ :security:steps:compliance-report.png |}}
  
-===== 11 Data Security =====+===== 12 Data Security =====
  
 In addition to encryption the solution includes a number of features for data security: In addition to encryption the solution includes a number of features for data security:
Line 105: Line 116:
  * **Disaster Recovery** - The [[foreverfile|ForeverFile™ archive]] is a backup, disaster recovery and ransomware protection feature that continuously protects data, wherever it is stored. For each primary storage provider that is being protected, a separate secondary or Backup provider is configured. For maximum availability the backup cloud should be located in another data center. It could also be with different cloud vendor, storage technology or tier.  * **Disaster Recovery** - The [[foreverfile|ForeverFile™ archive]] is a backup, disaster recovery and ransomware protection feature that continuously protects data, wherever it is stored. For each primary storage provider that is being protected, a separate secondary or Backup provider is configured. For maximum availability the backup cloud should be located in another data center. It could also be with different cloud vendor, storage technology or tier.
  
-===== 12 Cyber Essentials =====+===== 13 Website Security ===== 
 + 
 +{{ :security:trustedsite_logo.png?nolink&200 |}} 
 + 
 +Our public websites is scanned regularly through [[https://www.trustedsite.com/verify?host=storagemadeeasy.com| Trusted Site]] for security issues including malware, malicious links, and phishing. 
 + 
 +We follow best practices in developing secure software, as mandated by GDPR, protecting for example against injection attacks, cross-site request forgery and session hijacking. We perform a third-party vulnerability code scan for each release. 
 + 
 +These are the formats of the cookies are used. <site> is the unqualified hostname of the web address. The unqualified hostname of %%https://files.example.com%% is files. 
 + 
 +^ Cookie ^ Type ^ What for ^ Retention ^ 
 +| PHPSESSID | Functional | Unique ID of session | Session | 
 +| %%<site>__just_logged_in%% | Functional | Start page logic (0 or 1) | 1 year | 
 +| autologin | Functional | Token for remember me feature | 14 days | 
 +| %%<site>__<various>%% | Functional | Remembers settings between sessions such as what folders and panels are collapsed, and the last sort order. e.g. %%files__mainTree_openedFoldersKeys%% | 1 year | 
 + 
 +===== 14 Cyber Essentials =====
  
 Storage Made Easy is [[https://www.cyberessentials.ncsc.gov.uk/cert-search/?query=storage%20made%20easy|Cyber Essentials Certified]].Cyber Essentials is a UK government information assurance scheme operated by [[https://www.ncsc.gov.uk|the National Cyber Security Centre]] (NCSC) that encourages organisations to adopt good practice in information security.It includes an assurance framework and a set of security controls to protect information from threats coming from the internet. Storage Made Easy is [[https://www.cyberessentials.ncsc.gov.uk/cert-search/?query=storage%20made%20easy|Cyber Essentials Certified]].Cyber Essentials is a UK government information assurance scheme operated by [[https://www.ncsc.gov.uk|the National Cyber Security Centre]] (NCSC) that encourages organisations to adopt good practice in information security.It includes an assurance framework and a set of security controls to protect information from threats coming from the internet.
Line 111: Line 138:
 It was developed in collaboration with industry partners, including the Information Security Forum (ISF), the Information Assurance for Small and Medium Enterprises Consortium (IASME) and the British Standards Institution (BSI), and is endorsed by the UK Government. It was developed in collaboration with industry partners, including the Information Security Forum (ISF), the Information Assurance for Small and Medium Enterprises Consortium (IASME) and the British Standards Institution (BSI), and is endorsed by the UK Government.
  
-===== 13 London Office of Regional CyberSecurity Advancement (LORCA) =====+===== 15 London Office of Regional CyberSecurity Advancement (LORCA) =====
  
 Storage Made Easy [[https://www.infosecurity-magazine.com/news/lorca-announces-additions-1-1/|was selected]] to be one of the CyberSecurity innovators of LORCA's third cohort. Storage Made Easy [[https://www.infosecurity-magazine.com/news/lorca-announces-additions-1-1/|was selected]] to be one of the CyberSecurity innovators of LORCA's third cohort.