Differences

This shows you the differences between two versions of the page.

--- security [2019_10_15 20:48] – [7 Restrict by IP Address] steven
+++ security [2020_05_28 12:03] – [2 Encrypted Data in Motion] jim
@@ Line 1: / Line 1: @@
 ====== Security ======
+== Updated on May 27, 2020 ==
 SME provides a SaaS and hybrid on-premises multi-cloud content management solution called the Enterprise File Fabric.  This provides unique federation, governance and data management features. This section of the Wiki outlines the security that is inherent within the SME hosted and on-premises versions of the File Fabric.
@@ Line 27: / Line 28: @@
 [[https://www.ssllabs.com/ssltest/analyze.html?d=storagemadeeasy.com|Check out]] our online sites using [[https://www.ssllabs.com/index.html|Qualys SSL Labs site check]].
+{{::screenshot_2020-05-28_at_13.01.52.png?600|}}
 ===== 3 Encryption Algorithm =====
@@ Line 39: / Line 43: @@
 See also [[https://storagemadeeasy.com/pressrelease/FIPS-140-2-compliance/|FIPS U.S. Federal Government Validation of the Enterprise File Fabric™ Cryptographic Algorithm]].
 ===== 4 Authentication Security =====
@@ Line 76: / Line 81: @@
 ===== 8 Audit Security =====
 {{:/security:steps:sme_7_audit_security.png}}
@@ Line 112: / Line 116: @@
  * **Disaster Recovery** - The [[foreverfile|ForeverFile™ archive]] is a backup, disaster recovery and ransomware protection feature that continuously protects data, wherever it is stored. For each primary storage provider that is being protected, a separate secondary or Backup provider is configured. For maximum availability the backup cloud should be located in another data center. It could also be with different cloud vendor, storage technology or tier.
-===== 13 Cyber Essentials =====
+===== 13 Website Security =====
+{{ :security:trustedsite_logo.png?nolink&200 |}}
+Our public websites is scanned regularly through [[https://www.trustedsite.com/verify?host=storagemadeeasy.com| Trusted Site]] for security issues including malware, malicious links, and phishing.
+We follow best practices in developing secure software, as mandated by GDPR, protecting for example against injection attacks, cross-site request forgery and session hijacking. We perform a third-party vulnerability code scan for each release.
+These are the formats of the cookies are used. <site> is the unqualified hostname of the web address. The unqualified hostname of %%https://files.example.com%% is files.
+^ Cookie ^ Type ^ What for ^ Retention ^
+| PHPSESSID | Functional | Unique ID of session | Session |
+| %%<site>__just_logged_in%% | Functional | Start page logic (0 or 1) | 1 year |
+| autologin | Functional | Token for remember me feature | 14 days |
+| %%<site>__<various>%% | Functional | Remembers settings between sessions such as what folders and panels are collapsed, and the last sort order. e.g. %%files__mainTree_openedFoldersKeys%% | 1 year |
+===== 14 Cyber Essentials =====
 Storage Made Easy is [[https://www.cyberessentials.ncsc.gov.uk/cert-search/?query=storage%20made%20easy|Cyber Essentials Certified]].Cyber Essentials is a UK government information assurance scheme operated by [[https://www.ncsc.gov.uk|the National Cyber Security Centre]] (NCSC) that encourages organisations to adopt good practice in information security.It includes an assurance framework and a set of security controls to protect information from threats coming from the internet.
@@ Line 118: / Line 138: @@
 It was developed in collaboration with industry partners, including the Information Security Forum (ISF), the Information Assurance for Small and Medium Enterprises Consortium (IASME) and the British Standards Institution (BSI), and is endorsed by the UK Government.
-===== 14 London Office of Regional CyberSecurity Advancement (LORCA) =====
+===== 15 London Office of Regional CyberSecurity Advancement (LORCA) =====
 Storage Made Easy [[https://www.infosecurity-magazine.com/news/lorca-announces-additions-1-1/|was selected]] to be one of the CyberSecurity innovators of LORCA's third cohort.