Snapshot 19115
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Trust Center Our Trust Center serves as a central hub for transparency and accountability, providing comprehensive information about our commitment to security, privacy and compliance. It's designed to give our customers, partners, and stakeholders clear insights into how we protect their data, maintain the integrity of our services, and uphold the highest standards of corporate responsibility. Through this resource, we aim to build and maintain trust by offering detailed documentation, regular updates, and open communication about our policies, procedures, and ongoing efforts to safeguard your interests. 1) DevSecOps We apply best practice security principles to our code pipeline so every build will go through the following controls: Code reviews: Each code build is manually reviewed by a second or senior developer to the original code author SAST (Static Application Security Testing): All code builds go through static application security testing, which means the code, prior to being built and compiled into a functioning application is scanned for issues like hard coded credentials, insecure code methods or out of date code dependencies. DAST (Dynamic Application Security Testing): All code builds once compiled into a functioning web application go through Dynamic security testing, which involves scanning and testing the functioning application. This will look for common web issues such as cross-site scripting (XSS) and SQL injections (SQLi) on top of configuration issues in things like API's, header issues, cryptographic issues and user related issues. CNAPP (Cloud Native Application Protection Platform): The infrastructure on which the application sits will be scanned for infrastructure related issues such as patching and configuration issues as part of the build. Pentesting: IBS Software is CREST accredited, and we utilize our own pentesting team to manually pentesting all major builds (typically once every 3 months) of all products. This is a snapshot of the security posture of the application at point of release and will pick up and detect issues not typically seen by automated tools, such as privilege escalation or business logic issues. 2) Perimeter Protection All externally facing assets have the following: DDOS protection: - All our cloud based assets are protected by Denial of service protection mechanisms to ensure our infrastructure is not impacted by DDOS attacks. Web Application Firewall: - Our externally facing assets are protected by a Web Application Firewalls. This ensures protection against web based attacks, scraping, bots and brute forcing. This also provides protection against application based denial of service attacks. These can also detect the use of compromised credentials. Geo-fencing - We employ geo-fencing to prevent certain countries or regions from accessing our sites. This varies depending upon the asset and the application. IPS/IDS - We have Intrusion Prevention Systems in place to detect signature based and anomaly based protocol attacks that aren't covered by the Web Application Firewall. Load-Balacing Gateways / CDN (Content Delivery Networks) - Our assets contain load-balancing or gateway functionality, ensuring requests are properly routed and we use Content Delivery networks to ensure cached content is delivered quickly. Proxies - Our assets don't talk to the internet directly and go via proxies or filtering mechanisms for updates and external API calls. 3) Encryption Encryption in Transit Web: All data sent to and from IBS Software is encrypted in transit using TLS (Transport Layer Security) 1.2 or higher, ensuring that your data is secure and inaccessible to unauthorized parties as it travels over the internet. E-mail: Our e-mail servers employ StartTLS to encrypt e-mails between senders and our e-mail servers. APIs: Our APIs enforce HTTPS to encrypt and secure communications, ensuring that data transferred between your systems and ours remains private. Encryption at Rest Data Storage: All sensitive data stored in our systems, including personal information, payment details, and operational data, is encrypted using industry-standard encryption algorithms such as AES-256 or equivalent. Workstations: All our workstations are encrypted using AES-256 or equivalent. Key Management: We employ robust key management practices, including regular key rotation, to enhance security and reduce the risk of unauthorized data access. Certificate authorities: We employ public recognized Certificate Authorities (CA) for our public facing assets. 4) Email Security and Integrity We have Sender Policy Framework (SPF) activated on all our e-mails. We have DomainKeys Identified Mail (DKIM) activated on all our e-mails. We have Domain-based Message Authentication, Reporting, and Conformance (DMARC) activated. Our e-mail servers use STARTTLS for secure transfer between e-mail servers. We have Data Loss Prevention (DLP) Technologies activate on all outbound e-mails. We have File Type restrictions active on both outbound and inbound e-mails. We have malware scanning and sandboxing active on both outbound and inbound e-mails. We have anti-spam measures in place 5) Access Control We adhere to the principle of least privilege, where users, processes, or systems are granted only the minimum level of access necessary to perform their intended tasks, minimizing the potential risk of unauthorized access or misuse of privileges. The two main access control methods we use are: Role-Based Access Control (RBAC): We use this approach to access control where permissions to access systems, applications, or data are granted based on the roles or job responsibilities held by individuals within the organization, rather than directly assigning privileges to specific users. Discretionary-based Access Control (DBAC): Used in project settings where individuals are required to have access to a specific information asset without assigning asset to an entire team or group. Privileged Access Management (PAM): For Privileged users, such as administrators, we route all access through a PAM tool for any kind of administrative commands which among other things, records and logs administrative sessions and even prohibits certain commands from being run. Conditional Access Control: All IBS employees are filtered through Conditional Access Control. This means access to each application is filtered through various checks such as: Type and nature of device Geo-location of the end user Status of the device Velocity of the user Behaviour of the user Multi-factor authentication (MFA): We employ MFA as part of conditional access control and as part of our Saas applications. We employ various factors for MFA such as: Physical FIDO tokens Biometrics Soft tokens Push notifications Single Sign-on (SSO): The large majority of our applications support Single sign-on and Federated identity via IDP (Identity providers). We also employ SSO internally for access to most applications. User Behaviour Analytics (UBA): We employ User behaviour analytics on user accounts to detect anomalous behaviour. Access Control Audits: We conduct regular audits to ensure access control policies, procedures, and mechanisms are properly implemented and maintained. 6) User Awareness Programs User Awareness: Regularly scheduled initiatives aimed at improving users' understanding of security risks, policies, and procedures through training, communications, and interactive sessions. Monthly User Awareness: Recurring activities to reinforce security awareness, share updates, and provide ongoing education about current threats, controls, and user roles in maintaining a secure organization. Annual User Awareness: Comprehensive, organization-wide campaigns to highlight key security topics, reinforce best practices, and ensure all users receive regular training and reminders about their responsibilities in protecting information assets. 7) Audits/Scans Regular automated vulnerability scans are conducted on: External internet facing assets Internal infrastructure Web applications Workstations Other audit activities that are also done either monthly or quarterly: Access Control audits Risk management reviews Firewall configuration reviews Privileged Access Management reviews Incident response simulations Security Exception audits Annual or ad-hoc activities include: Internal pentesting Red teaming / Purple teaming assessments External pentesting 8) Security Operations Our Security Operations Center (SOC) operates with a multi-tier structure to ensure comprehensive monitoring (24/7), analysis, and response to cybersecurity incidents. All security logs for applications, infrastructure and access control assets are centralized, normalized, aggregated and correlated. Playbooks are used to triage, resolve and measure incidents. Incident Response simulations are conducted on a regular basis Purple teaming and red teaming assessments are conducted on a regular basis We perform threat intelligence and have a threat intelligence platform to track active threats against our business, infrastructure and our customers We have an external incident response retainer for incident response overflow and forensics support We maintain a leaked credentials monitoring service as part of our threat intelligence capability All security logs are kept for 12 months Vulnerability Management: We run vulnerability assessments and scans on the following assets: Cloud based assets - Daily On-premise assets - Weekly Workstations - Daily Web Application assets - Weekly Extermal domains and externally facing assets - Daily We perform regular patching, using the Common Vulnerability Scoring System (CVSS) as our vulnerability scoring mechanism. Our typical patching schedule (incidents excluded) is as follows: Critical - 14 days High - 30 days Medium and Low - 90 days We employ change management processes including regression testing for all patching, updates and upgrades Compliance: Our Commitment to Security and Compliance: At IBS, we take information security and risk management seriously. Our compliance practices are designed to meet the highest standards set by regulatory bodies and industry leaders. This helps us safeguard your information, reduce business risks, and ensure the ongoing reliability of our technology. Demonstrating Our Commitment: We maintain individual compliance attestations and self-assessments for a variety of rigorous standards. These attestations are independent validations that we meet the requirements of these programs. Some of the standards we adhere to include: SOC 1 (Service Organization Controls 1) This verifies the existence and effectiveness of enterprise-wide internal controls over financial reporting, demonstrating the organization's commitment to maintaining accurate and reliable financial information across all its operations and systems SOC 2 (Service Organization Controls 2) IBS Software maintains enterprise-wide SOC 2 compliance, encompassing all five trust service criteria (TSC): security, availability, processing integrity, confidentiality, and privacy. SOC 3 (Service and Organization Controls 3 report ) Similar to SOC 2, the Service and Organization Controls (SOC) 3 report is issued under the Auditing Standards Board of the American Institute of Certified Public Accountants (AICPA) SSAE 18, assessing a service organization’s controls related to the Trust Services Criteria for security, availability, processing integrity, confidentiality, or privacy. The SOC 3 is a publicly available report and covers the same scope as the corresponding SOC 2 report. PCI DSS (Payment Card Industry Data Security Standard) Ensures we meet the highest standards for protecting cardholder data. ISO 27001 (Information Security Management) Provides a framework for managing information security risks. ISO 27701 (Privacy Information Management) Specifies requirements for protecting individuals' privacy information. ISO 9001 (Quality Management Systems) Helps us deliver consistent, high-quality products and services. CSA Star (Security, Trust, Assurance, and Risk (STAR) Registry) This is an internationally recognized certification that distinguishes cloud service providers who adhere to stringent security standards. As a Level 2 certified organization, we have demonstrated our unwavering commitment to maintaining the highest level of security measures within our cloud offerings. This certification serves as a testament to our dedication to ensuring the safety, trustworthiness, and accountability of our cloud services, instilling confidence in our clients and partners worldwide. STAR Registry | CSA (cloudsecurityalliance.org) CREST (Council of Registered Security Testers) Our CREST Security Operations Centre certification independently proves that our Security Operations are aligned with industry best practices and have achieved the equivalent level of a managed security service provider. In addition, our CREST Penetration Testing certification independently validates that our testing capabilities meet the rigorous standards and globally recognised best practices expected of a CREST-accredited security testing provider. Data Privacy Compliance in IBS SaaS This page outlines the approach to ensuring Data Privacy compliance of IBS SaaS services. In this section, ‘Customer’ refers to the organization that has subscribed to IBS SaaS services. Please refer to Official Journal of the European Union for definitions of roles and expectations of GDPR. Roles Customer will be the Data Controller, and IBS will be the Data Processor. Responsibilities to Address Rights of Data Subjects Consent – Customer shall capture and maintain consent from Data Subjects. It will be assumed that Customer has obtained consent from Data Subjects for all personal data transferred to IBS for processing, including past data already shared with IBS. Rectification – Customer shall rectify inaccurate/incomplete personal data. For those SaaS services where a user profile is also provided, Customer shall rectify the profile using ‘update’ functionality of the SaaS service. Erasure – Personal data which are processed in business transactions, such as PNR, will be retained till the completion of retention period agreed with Customer. IBS shall be ready with technical measure to delete personal data and provide a certificate of deletion to the Customer upon request. Restrict Processing – Customer shall validate requests from Data Subjects to stop processing his/her personal data. If IBS receives any request directly from Data Subject, it will be forwarded to Customer for validation and required action. Data Portability – Not applicable for current SaaS Access – Customer shall authenticate Data Subjects who request access to personal data. On authentication of the Data Subject, IBS will provide information on personal data held in its systems and the location. Approach to manage privacy 1) Inventory of Personal Data Customer and IBS shall agree on an inventory of personal data that will be transferred to IBS for processing. This inventory shall indicate: Description of data element Classification - whether the personal data is sensitive Purpose for processing Duration of processing 2) Transfer of Personal Data outside of country Customer and IBS shall agree on hosting locations for primary and DR sites, location from where the environment will be accessed for providing support and use of any sub-processors and their respective locations. 3) Handling data in Production/DR site Personal data shall be stored encrypted in production/DR environment. Personal data that is classified as ‘sensitive’ will be stored in a form that will be agreed with the Customer. 4) Transfer of data to Staging/Training environments All personal data shall be suitably masked before being transferred to non-production environments. Specific details of the data transfer are agreed between Customer and IBS using the Standard Contracting Clauses (SCC). 5) Access by Support Personnel Access to personal data in production environment shall be limited to named employees of IBS or its sub-processors who will be responsible for maintenance of the production environment. 6) Training on Data Privacy All employees of IBS who process personal data shall be provided with adequate awareness trainings on their obligations related to Data Privacy. 7) Data Protection Office IBS has put in place a Data Protection Office that will be responsible for managing the DP Compliance. Contact details shall be published on the corporate website and provided in agreements. 8) Compliance Access to personal data in production environment shall be limited to named employees of IBS or its sub-processors who will be responsible for maintenance of the production environment. Data Processing Agreement Customer and IBS shall sign Data Processing Agreement to contractually capture the above. Click here to download the agreement. If you cannot find answer to your question in our sections, you can always contact us. We wil answer to you shortly! Reporting a security vulnerability? Please refer to our Vulnerability Disclosure Program (VDP) and use the designated security reporting channel. Solutions Airline Retailing Cargo & Logistics Air Cargo Ocean Cargo Energy & Resources Logistics Loyalty Management Airline Operations Airport Management Airline Passenger Services Reservation Loyalty Staff & Corporate Travel Hospitality Solutions Tour & Cruise Consulting & Digital Transformation About Overview Leadership Customers Associations News & Events Offices Contact Resources Case Studies White Papers eBooks Blog Product Sheets Webcasts Careers Life @IBS Current Openings LCA Follow Us On Solutions Airline Retailing Airline Operations Hospitality Solutions Cargo & Logistics Air Cargo Ocean Cargo Energy & Resources Logistics Airport Management Tour & Cruise Loyalty Management Airline Passenger Services Reservation Loyalty Staff & Corporate Travel Consulting & Digital Transformation About Corporate Overview Leadership Customers Associations News & Events Careers Resources Case Studies White Papers eBooks Blog Product Sheets Contact Business Enquiry Media Enquiry Offices Navigation