Security Policies, Controls & Certifications
Densify has adopted the ISO 27001 security framework for its Information Security Management System. The ISO 27001 framework is an internationally recognized management system for managing information security, governance, and risk. The standard provides a best-practice framework, ongoing governance, and good management of the system to:
- Identify risks to corporation information and minimize them
- Improve reputation and stakeholder confidence
- Increase in information security awareness
- Reduce staff-related information security breaches
- Stay up-to-date and comply with relevant legislation
- SOC 2 Type 1
- SOC 2 Type 2
Security Policies & Controls
Vulnerability Detection & Penetration Tests
Densify performs regular automated scans of servers in the production environment. All changes are peer reviewed and vulnerability and security lists are actively monitored for CVE and other vulnerability disclosures with appropriate actions taken.
A third-party penetration test is commissioned, with all findings mitigated as appropriate. As a general policy, issues that come to our attention through penetration tests, or other means, are fixed with the highest priority.
Separate and distinct production, staging, and development environments are maintained. Policies are in place to segregate and control access to each environment, following the principles of “need to know” access only.
Production data is never replicated or copied outside the production environments.
Densify uses third-party providers for DDoS protection and 24×7 monitoring of Firewall activity in addition to the tools used by the Densify operations team. This includes an IDS for the production SaaS environment with real time monitoring and alerting on abnormal behavior. Alerts are monitored 24×7 by a third-party provider.
Network zones are built to prevent unauthorized access based on “least privilege” access.
Strict firewall rules are in place limiting access to the production environment to our VPN network and authorized systems. The corporate network has no additional access to the production environment.
Anti-Virus & Anti-Malware
All Densify servers which are part of the production Densify environment run current, and active anti-virus software with real-time monitoring and are updated at least daily.
Login Security/Password Policy
When users log into their Densify instance using their email address and password, Densify requires a minimum password compliance.
- Password minimum length of 16 characters
- Containing uppercase and lowercase characters, at least 1 digit and 1 symbol
- Cannot use any of the last 16 historical passwords
- Passwords expire every 90 days
- Automatic account lock-out will occur after 3 failed login attempts
Passwords are secured using a one-way hash algorithm. Password complexity, and other settings can be customized by the customer, but only when they increase overall password security.
Multi-Factor (2 Factor) authentication and/or integration with an OpenID compatible provider are available.
Multi-Factor (2 Factor) authentication is required to access the production environment for all operations staff, and where the customer deems it necessary.
All customer data is considered highly sensitive and protected as such. Only authorized, vetted, and trained members of the Densify operations team have direct access to the systems containing user data. Those who do have direct access to these systems are only permitted to view them in aggregate for operations activities or in detail for troubleshooting purposes. All operations team members undergo background checks.
Application data is only viewed by Densify Cloud Advisors for delivery of the service, and by Operations or other Densify employees for troubleshooting purposes when consent has expressly been provided.
A list is maintained of members of the Densify team with access to the production environment.
Access attestations are reviewed at a minimum every 3 months.
Third Party Access
Customer data in very limited cases is shared only with third-party service providers acting as our agent (a user’s email address for an email delivery provider, for example) and in strict compliance with signed service agreements.
Customer data is never replicated outside of the production environment and is never replicated onto employee workstations. Because of this, Densify relies on the cloud infrastructure for physical security compliance. The virtual and physical servers are in either AWS, IBM, or Google secure data centers. Production critical data is never stored on physical media outside of the cloud provider’s production environments.
Corporate Environment & Removable Media
Strict firewall rules control access to the necessary ports for the usage of the service (e.g., 443) and to ensure limited access to the production environment, to our VPN network, and authorized systems. The corporate network has no additional access to the production environment.
Customer data is never stored on employee workstations or removable media. Employee devices are required to time out and lock after a maximum of five minutes of inactivity.
Densify uses industry standard Transport Layer Security (“TLS”) to create a secure connection using 128¬-bit Advanced Encryption Standard (“AES”) encryption. This includes all data sent between the web, Densify Connector, and the Densify servers. The Densify Connector is also able to support a variety of customer proxy configurations for sending data to Densify servers. All customer connections are made securely over HTTPS.
Densify takes the need for security seriously and understand the importance of being able to encrypt data to keep it safe, with provider managed data encrypted by default. Data drives on database servers holding customer data use full disk, industry-standard AES 256-bit encryption.
Removing/Deleting Data from Densify
Production customer data is never replicated outside of the production cloud environments and is never stored on employee workstations or removable media. On termination of a Densify Enterprise contract, or at the request of the customer, the data belonging to the customer is completely removed from the live production database within 30 days. The customer Densify database backups is also be destroyed in accordance with this policy.
Development, Patch & Configuration Management
All changes to the production system require review prior to deployment to the production environment. Hundreds of automated unit tests are run against all production code prior to deployment, as well as regularly conducted automated vulnerability scans and commissioned penetration tests. All changes are tested in a staging environment prior to deployment to production.
Patches to the Densify application are deployed on a rolling basis, usually once a month. Production servers are managed via a centralized configuration system. All system changes are peer reviewed and patches are deployed as relevant to their level of security and stability impact, with critical patches able to be deployed well within 24 hours of availability as appropriate.
Densify restricts access and maintains separate lists of relevant roles with access to source code, development, staging, and production environments. These lists are reviewed quarterly and on role change. We use source code management tools and repositories.
All production servers are running an LTS (Long Term Support) distribution of their operating system to ensure timely updates are available. CVE lists and notifications are actively monitored, and any systems can be patched in a timeline relevant to the severity of the issue. A centralized configuration system is used for the management of production servers, and when needed a patch can be deployed within 24 hours of its availability.
Data Within Densify
Upon account creation, Densify users are asked for a full name and email. Densify does not collect any other personal identifying information. Densify does not collect any customer data residing within a system being analyzed. All information used by Densify Analytics is System Configuration, Utilization (performance metrics), or Billing data, as enabled by the customer.
Raw data collected by Densify for use in each customer’s instance, is stored in a separate and secured database on a per customer basis.
Backups & Storage
A backup of the customer’s Densify’s primary database is taken once every 24 hours. All backups are encrypted and stored at offsite locations (backup data centres) to ensure that they are available in the unlikely event that a restore is necessary. All backups are immediately encrypted with 256-bit AES encryption.
Encrypted backups can only be decrypted by members of the Densify operations team who have received training and have been authorized to decrypt the backups. Only authorized members of the Densify operations team have access to the backup locations, so they can monitor the performance of the backup processes.
When planned maintenance on Densify services is necessary, the Densify Operations team will perform the work during a scheduled maintenance window. We will make reasonable efforts to announce at least 5 days prior to the event.
Planned Maintenance Windows
These windows have been selected with the goal of minimizing service downtime, slowness, or other impact to the people and businesses that rely on Densify. Additionally, due to the nature of Densify’s overnight collection and analytics processes, maintenance windows are scheduled between 9 p.m. and midnight local customer time.
We do our best to make outages as short as possible. Additionally, our maintenance schedule is evaluated frequently to ensure that we keep user impact as low as possible
From time to time, due to unforeseen events, we may have to perform emergency maintenance on Densify infrastructure or software components. This maintenance might cause some or all the Densify services to be inaccessible by our users for a period. It is our goal to do this as infrequently as possible. Any emergency maintenance will be announced by email to the identified customer contacts with as much notice as reasonably possible. As with planned maintenance, we do our best to minimize disruption caused by service outages.