Seguridad
Certificación ISO 27001
¿Qué es la certificación ISO 27001?
ISO 27001 es una norma reconocida internacionalmente que ayuda a las organizaciones a gestionar la seguridad de la información para que sus activos de información sean más seguros.
Para obtener la certificación, una organización debe desarrollar y aplicar un estricto programa de seguridad, evaluar periódicamente los riesgos, amenazas y vulnerabilidades de la seguridad de la información, y establecer que sus programas de seguridad se ajustan a las mejores prácticas del sector.
Tras superar con éxito una auditoría realizada por un tercero independiente, la organización puede ser certificada por un registrador acreditado.
Security has always been and always will be at the core of our product. The fact that more and more Fortune 500 companies are choosing our solution is proof of our product’s quality and security.
– Patrick Grégoire, Presidente, Borealis
Seguridad del centro de datos
Funcionalidades de seguridad del producto
Aplicación de niveles de seguridad
Copia de seguridad (Backup)
WCAG
Seguridad de la red
Monitoreo y Gestión de Vulnerabilidad
Borealis trabaja con especialistas de seguridad externos y emplea soluciones de seguridad de clase empresarial para detectar y corregir las vulnerabilidades en la infraestructura de TI y en la aplicación web.
Borealis utiliza sistemas de gestión de vulnerabilidades para proteger continuamente la infraestructura TI contra las últimas amenazas de Internet. A través de una aplicación web de rastreo monitoreamos nuestra solución TI para identificar los 10 más altos riesgos de la OWASP incluyendo la inyección SQL, el filtro de scripts de sitios (XSS), la falsificación de petición en sitios cruzados (CSRF pour sus siglas en inglés) y la redirección URL.
Todas las aplicaciones web, redes y hardware son supervisados constantemente tanto por Borealis como por los proveedores de coubicación gestionada.
Acceso a la administración del sistema y Soporte global
Seguridad de almacenamiento
Todos los datos almacenados en los servidores de Borealis se cifran en reposo mediante un protocolo SSL de alta calidad que utiliza AES-XTS, un protocolo acriptográfico diseñado para garantizar la seguridad del almacenamiento de datos en reposo. Las claves de cifrado se almacenan de forma segura.
Transmisión y Seguridad de la sesión
Recuperación en caso de desastre
Q&A How Borealis
Manages data security
Authentication
The Borealis application enables users to authenticate through single sign-on (SSO) using SAML 2.0. Our solution supports integration with all identity federation providers such as Okta and Microsoft ADFS.
We enforce the use of strong passwords for all users through our password policy. Strong passwords must consist of at least fifthteen characters, a combination of upper and lowercase letters, and include numbers.
All privileged accounts to the organization’s production platform are enforced with Multi-Factor Authentication and a password of minimum 14 characters.
Customer data
Borealis confirms that data from production is never copied or utilized in non-production environments. Additionally, customer data is never employed outside of the production network.
Client data
Our production and development environments are fully isolated, ensuring that access to production data is only granted to authorized personnel.
We use a SIEM tool called Graylog that only a few authorized users can access through a two-factor VPN connection. Graylog records all actions taken by users and our web application. This access is read-only to prevent tampering with the logs.
Multi-Factor Authentication
The Borealis application supports 2FA and can be configured by users directly in the Borealis web interface.
Cloud computing
Our servers are in Amazon Web Services datacenters in Canada (Montreal), Europe (France) and Australia (Sydney).
Data backup and restoration
Our backup policy entails keeping the five most recent backups in addition to retaining the most recent backup from the last seven days, four weeks, twelve months, and one year. We also conduct restoration tests at least twice a year.
We have two different methods for recovering data in the event of an outage:
- Recovering from a hot standby server, which has a Recovery Point Objective (RPO) of less than one minute, and a Recovery Time Objective (RTO) of less than one hour.
- Recovering from a backup, which has an RPO of less than 24 hours, and an RTO of less than one hour.
These procedures ensure that our systems are up and running as quickly as possible in the event of an unexpected interruption.
Availability
Borealis must maintain a 99.5% Online Service availability rate, calculated monthly using (Total – Downtime) / Total * 100 ≥ Availability Target. «Total» refers to calendar month minutes minus excluded downtime, while «Downtime» refers to non-excluded duration, including planned and uncontrollable events.
You can access more details regarding the service availability in our MSA’s «Availability» section: https://www.boreal-is.com/data/cdn/media/Borealis-Master-Subscription-Agreement.pdf
Vulnerability Management
Every year, we conduct a penetration test through an external firm.
Additionally, we conduct an automated vulnerability scan and a Web Application Scan every week using the Qualys platform.
We utilize Eslint to check the code and also perform a vulnerability check of our external libraries with yarn audit. Additionally, each line of code modified in our repositories undergoes verification by a second senior developer.
Critical updates are installed as soon as possible, usually on the same day they become available. To identify when patches are required, we use our Microsoft Defender Vulnerability Management dashboard in conjunction with CheckMK (which is based on Nagios).
Our organization has installed Microsoft Defender antivirus, which includes the Microsoft Intune endpoint protection feature, on all servers and workstations. In the event of any suspicious activity, our sysadmin team receives an alert.
Information Access
Access to information assets in our organization is reviewed annually and when changes in employee status occur, such as joining, relocating, or leaving. Physical and logical access is granted only to authorized personnel, and access is promptly removed upon an employee’s departure.
Access to both our production systems and internal systems is protected by two-factor authentication via the VPN.
Server Monitoring and Management
We utilize CheckMk (Nagios) and Amazon CloudWatch to monitor the performance of all our servers in real-time, with over a hundred checks performed per server on CheckMk.
Information Security Governance and Compliance
We utilize OneTrust to maintain compliance by updating and obtaining approval for our information security policies. These updates are carried out at a minimum of once a year as required by TugBoat Logic.
All of our employees sign confidentiality agreements, which are legally binding contracts that prevent them from disclosing any sensitive information about the company or its clients.
Information Security Training
Borealis mandates regular security training for all its employees, consultants, and contractors through the Terranova platform. Users must take interactive courses every 4 months to improve their understanding of security responsibilities. Moreover, we conduct 1-2 phishing simulation campaigns per year.
Employee Screening and Background Checks
When hiring new employees, our human resources team conducts a background check. Additionally, they also conduct another check every three years for all existing employees.
Incidents
To date, Borealis has not encountered any security breaches or incidents of stolen or compromised credentials associated with our platform. The safety and security of our customers’ data remains a top priority for us.
Encryption
Data in transit is secured through the utilization of encryption with TLS 1.2 or higher.