en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en pt en sv fr fr en en en en en
In this article, we will answer common questions regarding FlexRule’s product and data security compliance.
However, most of the security standards are not applicable to FlexRule since FlexRule is not a SaaS provider.
Do you provide tenants with documentation describing your Information Security Management Program (ISMP)?
Do your information security and privacy policies align with these industry standards: (ISO-27001, ISO-22307, CoBIT, Information Security Regulation (ISR), ADSIC, NESA and so forth)?
Do you have documented information security baselines for every component of your infrastructure (ex. Hypervisors, operating systems, routers, DNS servers, and so on)?
Do you have a capability to continuously monitor and report the compliance of your infrastructure against your information security baselines?
Do you document how you grant and approve access to tenant data?
If users are found to have inappropriate entitlements, are all remediation and certification actions recorded?
Do your data management policies and procedures include a tamper audit or software integrity function for unauthorized access to tenant data?
Do you have a capability to allow creation of unique encryption keys per tenant?
Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, and so forth) for granular analysis and alerting?
Is your Privacy Policy aligned with industry standards?
Are controls in place to prevent unauthorized access to your application and, program or object source code, assuring it is restricted to authorized personnel only?
Yes. The users require to have a valid login to use FlexRule.
Are policies and procedures established and mechanisms implemented to protect network environment perimeter and configured to restrict unauthorized traffic?
Will you Blacklist or block any malicious user directly trying to brute force Customer through your cloud if cloud identities are used?
Do you produce audit assertions using a structured, industry accepted format that is viewable by customers?
Do you conduct network/Application/Internal/External penetration tests of your cloud service infrastructure regularly as prescribed by industry best practices and guidance?
Do you maintain liaisons and points of contact with local authorities in accordance with contracts and appropriate regulations?
Do you have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant’s data?
Do you have policies and procedures in place describing what controls you have in place to protect tenants’ intellectual property?
Do you provide tenants with documentation describing your Information Security Management Program (ISMP)?
Does your solution/platform support End-User Key Management?
Who has the ownership of the data that we might hold in your systems?
FlexRule does not hold data in the system.
If your platform is a Multi-tenant architecture describe how you can ensure that no data bleed happens between companies on your systems?
Describe the granularity of roles and the level of access each role has?
Different access levels can be defined for the users.
What is your Security model from both application access and database?
Describe your audit capability in terms of user and data activity?
Can you restrict access to certain audit and logging views to certain users/ user groups?
Different access levels can be defined for the users.
What is the retention period for audit/activity logging?
What is the retention period for collaboration data?
What is the data allowance comprised of? (i.e. audit, collaboration, data, activity, logging)
Can we select/ configure the physical data center location where our data is held? For example to meet with data and USA regulations?
Describe any support you have for Single-Sign on?
Does not support single-sign on.
Do you support native synchronized in-app user/group provisioning capabilities (through API or built in engines) or require additional customization?
Describe if the system supports two-part authentication (e.g. SAML) and supports use of RSA SecureID tokens or equivalent for access outside our company internal networks?
Users of the system will be in our company Okta single sign on, describe how you will authenticate users?
How does your software support multiple user directories or IDP’s?
Is any role-based security capability Lightweight Directory Access Protocol (LDAP) compliant to enable control and management of our company directories?
How might the system automatically suspend/remove accounts based on removal from our company directories?
How a user can be set up and assigned various access rights?
In FlexRule Server you can define access to different roles
What are your authentication approaches?
User login with credentials
How to restrict access to any private network?
How do you restrict access to certain content or functional areas to certain roles?
In FlexRule Server you can define access to different roles
What security accreditations do you hold as a cloud-based platform?
Users require username and password along with a valid license to access any product and it is an annual subscription.
What is the Quality accreditation you have?
Can we carry out periodic Penetration/Performance/Benchmark Testing?
Is your site OWASP (Open Web Application Security Project) compliant and what measures do you take against malicious attacks (Denial of Service, Cross Site Scripting and so forth)?