Trust Center
Our Trust Center serves as a central hub for transparency and accountability, providing comprehensive information about our commitment to security, privacy and compliance.
It's designed to give our customers, partners, and stakeholders clear insights into how we protect their data, maintain the integrity of our services, and uphold the highest standards of corporate responsibility.
Through this resource, we aim to build and maintain trust by offering detailed documentation, regular updates, and open communication about our policies, procedures, and ongoing efforts to safeguard your interests.
1) DevSecOps
We apply best practice security principles to our code pipeline so every build will go through the following controls:
Code reviews: Each code build is manually reviewed by a second or senior developer to the original code author
SAST (Static Application Security Testing): All code builds go through static application security testing, which means the code, prior to being built and compiled into a functioning application is scanned for issues like hard coded credentials, insecure code methods or out of date code dependencies.
DAST (Dynamic Application Security Testing): All code builds once compiled into a functioning web application go through Dynamic security testing, which involves scanning and testing the functioning application. This will look for common web issues such as cross-site scripting (XSS) and SQL injections (SQLi) on top of configuration issues in things like API's, header issues, cryptographic issues and user related issues.
CNAPP (Cloud Native Application Protection Platform): The infrastructure on which the application sits will be scanned for infrastructure related issues such as patching and configuration issues as part of the build.
Pentesting: IBS Software is CREST accredited, and we utilize our own pentesting team to manually pentesting all major builds (typically once every 3 months) of all products. This is a snapshot of the security posture of the application at point of release and will pick up and detect issues not typically seen by automated tools, such as privilege escalation or business logic issues.
2) Perimeter Protection
All externally facing assets have the following:
DDOS protection: - All our cloud based assets are protected by Denial of service protection mechanisms to ensure our infrastructure is not impacted by DDOS attacks.
Web Application Firewall: - Our externally facing assets are protected by a Web Application Firewalls. This ensures protection against web based attacks, scraping, bots and brute forcing. This also provides protection against application based denial of service attacks. These can also detect the use of compromised credentials.
Geo-fencing - We employ geo-fencing to prevent certain countries or regions from accessing our sites. This varies depending upon the asset and the application.
IPS/IDS - We have Intrusion Prevention Systems in place to detect signature based and anomaly based protocol attacks that aren't covered by the Web Application Firewall.
Load-Balacing Gateways / CDN (Content Delivery Networks) - Our assets contain load-balancing or gateway functionality, ensuring requests are properly routed and we use Content Delivery networks to ensure cached content is delivered quickly.
Proxies - Our assets don't talk to the internet directly and go via proxies or filtering mechanisms for updates and external API calls.
3) Encryption
Encryption in Transit
Web: All data sent to and from IBS Software is encrypted in transit using TLS (Transport Layer Security) 1.2 or higher, ensuring that your data is secure and inaccessible to unauthorized parties as it travels over the internet.
E-mail: Our e-mail servers employ StartTLS to encrypt e-mails between senders and our e-mail servers.
APIs: Our APIs enforce HTTPS to encrypt and secure communications, ensuring that data transferred between your systems and ours remains private.
Encryption at Rest
Data Storage: All sensitive data stored in our systems, including personal information, payment details, and operational data, is encrypted using industry-standard encryption algorithms such as AES-256 or equivalent.
Workstations: All our workstations are encrypted using AES-256 or equivalent.
Key Management: We employ robust key management practices, including regular key rotation, to enhance security and reduce the risk of unauthorized data access.
Certificate authorities: We employ public recognized Certificate Authorities (CA) for our public facing assets.
4) Email Security and Integrity
- We have Sender Policy Framework (SPF) activated on all our e-mails.
- We have DomainKeys Identified Mail (DKIM) activated on all our e-mails.
- We have Domain-based Message Authentication, Reporting, and Conformance (DMARC) activated.
- Our e-mail servers use STARTTLS for secure transfer between e-mail servers.
- We have Data Loss Prevention (DLP) Technologies activate on all outbound e-mails.
- We have File Type restrictions active on both outbound and inbound e-mails.
- We have malware scanning and sandboxing active on both outbound and inbound e-mails.
- We have anti-spam measures in place
5) Access Control
We adhere to the principle of least privilege, where users, processes, or systems are granted only the minimum level of access necessary to perform their intended tasks, minimizing the potential risk of unauthorized access or misuse of privileges.
The two main access control methods we use are:
Role-Based Access Control (RBAC): We use this approach to access control where permissions to access systems, applications, or data are granted based on the roles or job responsibilities held by individuals within the organization, rather than directly assigning privileges to specific users.
Discretionary-based Access Control (DBAC): Used in project settings where individuals are required to have access to a specific information asset without assigning asset to an entire team or group.
Privileged Access Management (PAM): For Privileged users, such as administrators, we route all access through a PAM tool for any kind of administrative commands which among other things, records and logs administrative sessions and even prohibits certain commands from being run.
Conditional Access Control: All IBS employees are filtered through Conditional Access Control. This means access to each application is filtered through various checks such as:
- Type and nature of device
- Geo-location of the end user
- Status of the device
- Velocity of the user
- Behaviour of the user
Multi-factor authentication (MFA):
We employ MFA as part of conditional access control and as part of our Saas applications. We employ various factors for MFA such as:
- Physical FIDO tokens
- Biometrics
- Soft tokens
- Push notifications
Single Sign-on (SSO): The large majority of our applications support Single sign-on and Federated identity via IDP (Identity providers). We also employ SSO internally for access to most applications.
User Behaviour Analytics (UBA): We employ User behaviour analytics on user accounts to detect anomalous behaviour.
Access Control Audits: We conduct regular audits to ensure access control policies, procedures, and mechanisms are properly implemented and maintained.
6) User Awareness Programs
User Awareness: Regularly scheduled initiatives aimed at improving users' understanding of security risks, policies, and procedures through training, communications, and interactive sessions.
Monthly User Awareness: Recurring activities to reinforce security awareness, share updates, and provide ongoing education about current threats, controls, and user roles in maintaining a secure organization.
Annual User Awareness: Comprehensive, organization-wide campaigns to highlight key security topics, reinforce best practices, and ensure all users receive regular training and reminders about their responsibilities in protecting information assets.
7) Audits/Scans
Regular automated vulnerability scans are conducted on:
- External internet facing assets
- Internal infrastructure
- Web applications
- Workstations
Other audit activities that are also done either monthly or quarterly:
- Access Control audits
- Risk management reviews
- Firewall configuration reviews
- Privileged Access Management reviews
- Incident response simulations
- Security Exception audits
Annual or ad-hoc activities include:
- Internal pentesting
- Red teaming / Purple teaming assessments
- External pentesting
8) Security Operations
- Our Security Operations Center (SOC) operates with a multi-tier structure to ensure comprehensive monitoring (24/7), analysis, and response to cybersecurity incidents.
- All security logs for applications, infrastructure and access control assets are centralized, normalized, aggregated and correlated.
- Playbooks are used to triage, resolve and measure incidents.
- Incident Response simulations are conducted on a regular basis
- Purple teaming and red teaming assessments are conducted on a regular basis
- We perform threat intelligence and have a threat intelligence platform to track active threats against our business, infrastructure and our customers
- We have an external incident response retainer for incident response overflow and forensics support
- We maintain a leaked credentials monitoring service as part of our threat intelligence capability
- All security logs are kept for 12 months
Vulnerability Management:
We run vulnerability assessments and scans on the following assets:
- Cloud based assets - Daily
- On-premise assets - Weekly
- Workstations - Daily
- Web Application assets - Weekly
- Extermal domains and externally facing assets - Daily
We perform regular patching, using the Common Vulnerability Scoring System (CVSS) as our vulnerability scoring mechanism.
Our typical patching schedule (incidents excluded) is as follows:
- Critical - 14 days
- High - 30 days
- Medium and Low - 90 days
- We employ change management processes including regression testing for all patching, updates and upgrades
Compliance:
Our Commitment to Security and Compliance:
At IBS, we take information security and risk management seriously. Our compliance practices are designed to meet the highest standards set by regulatory bodies and industry leaders. This helps us safeguard your information, reduce business risks, and ensure the ongoing reliability of our technology.
Demonstrating Our Commitment:
We maintain individual compliance attestations and self-assessments for a variety of rigorous standards. These attestations are independent validations that we meet the requirements of these programs.
Some of the standards we adhere to include:
SOC 1 (Service Organization Controls 1)
SOC 2 (Service Organization Controls 2)
SOC 3 (Service and Organization Controls 3 report )
Similar to SOC 2, the Service and Organization Controls (SOC) 3 report is issued under the Auditing Standards Board of the American Institute of Certified Public Accountants (AICPA) SSAE 18, assessing a service organization’s controls related to the Trust Services Criteria for security, availability, processing integrity, confidentiality, or privacy. The SOC 3 is a publicly available report and covers the same scope as the corresponding SOC 2 report.
PCI DSS (Payment Card Industry Data Security Standard)
ISO 27001 (Information Security Management)
ISO 27701 (Privacy Information Management)
ISO 9001 (Quality Management Systems)
CSA Star (Security, Trust, Assurance, and Risk (STAR) Registry)
This is an internationally recognized certification that distinguishes cloud service providers who adhere to stringent security standards. As a Level 2 certified organization, we have demonstrated our unwavering commitment to maintaining the highest level of security measures within our cloud offerings. This certification serves as a testament to our dedication to ensuring the safety, trustworthiness, and accountability of our cloud services, instilling confidence in our clients and partners worldwide.
CREST (Council of Registered Security Testers)
Our CREST Security Operations Centre certification independently proves that our Security Operations are aligned with industry best practices and have achieved the equivalent level of a managed security service provider. In addition, our CREST Penetration Testing certification independently validates that our testing capabilities meet the rigorous standards and globally recognised best practices expected of a CREST-accredited security testing provider.