Item 26 - Agreement with Allied Network Solutions, Inc. for Adobe Software and Subscription

Home Browse Search

Security and Hosting Overview June 2015 In order to compromise the security of our email approval feature, a malicious user would need to hack into another user's email account, locate the SAP Fieldglass approval request email, and then submit the approval/rejection response. 1.3.10 Application Penetration Testing SAP Fieldglass uses a combination of manual and automated testing to ensure the application is secure. Various automated commercial tools are used prior to each major release of the SAP Fieldglass system (three times per year). On an annual basis, SAP Fieldglass engages a 3rd party security company to conduct pen testing services against our application. This is in addition to SAP Fieldglass' own internal penetration testing efforts. SAP Fieldglass has several test environments available for customers to conduct their own application penetration testing if requested. 1.4 Physical Security The SAP Fieldglass data center provides physical security through its secure hosted facilities. The application is hosted within a secure unmarked cage. SAP Fieldglass manages everything from the cage in. Meaning, SAP Fieldglass manages all servers, devices, and software in the cage. The hosting provider provides physical security, internet connectivity, and HVAC. 1.4.1 Internet Data Center Construction Exterior perimeter walls, doors and windows are constructed of materials that afford UL Standard #752, Level V Ballistic Protection. 1.4.2 Access Control The data center uses an Access Control System (ACS), which supports a networked card reader and alarm system. The ACS uses proximity card readers to control access into perimeter doors, shipping/receiving areas, storerooms and other areas. Biometric hand scanners are installed to control access into the network control center, telecommunications node room and customer vaults. Additional access control measures include: • Designated with signage as controlled access areas • Areas within the internet data center are designated as restricted • Access into the internet data center and restricted areas is controlled by biometric hand scanners, and is limited to authorized personnel • Card access badges or contractor/visitor badges are required to gain entry • All employees, customers, vendors, contractors and visitors must be sponsored by a facilities pre -approved sponsor to gain access • Visitors are escorted at all times within the controlled access area perimeter SAP Fieldglass Page 11 1 21