Laserfiche WebLink
Security Policies and Procedures <br />1. Access control <br />2. Authorization <br />3. Information classification <br />4. Storage controls <br />S. Backup and restoration <br />6. Confidentiality and integrity requirements <br />7. Audit logs <br />8. Privacy, export control and other such requirements <br />All product associated applications must use HTTPS to communicate with all remote <br />hosts, both Virtru hosted services and external third parties. HTTP and other <br />non -encrypted communications are not allowed under any scenario. <br />Virtru applications shall treat user credentials with the utmost sensitivity and must <br />follow security best practices for storing and transmitting user credentials. All <br />credentials which are shared with a client device must be sent over HTTPS or another <br />encrypted communication channel. All user credentials which are stored in a data <br />store, must be stored in a benign state so that leakage of information from the data <br />store does not compromise user accounts. <br />All application logs must be sent to a central logging cluster for aggregation and <br />analysis. <br />H. Configuration Management <br />Where possible, Virtru applications and infrastructure follow an immutable paradigm. <br />All changes to production infrastructure and application code is deployed on a brand <br />new Amazon Machine Image (AMI). This allows all changes which are deployed to be <br />tracked and audited. This also means that no configuration or application code will be <br />modified on a production instance. All application servers have osquery installed and <br />configured to monitor key files on the system for any change (File Integrity <br />Monitoring). Any changes to configuration are logged and sent to AWS Cloudwatch <br />Logs, where they trigger an alarm and cause an email to be sent to the Virtru DevOps <br />team for further investigation. <br />Where possible, Virtru utilizes Terraform, Ansible, and other similar tools to define <br />their infrastructure as code. This allows the production infrastructure to be versioned <br />in a git repository and easily audited for change over time. <br />I. Asset management for software <br />The ISO is responsible for maintaining an inventory of software; as such it shall employ <br />software to aid in the management of software assets. <br />Rev.2015.8.6 <br />56 <br />