Snapshot 3551
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Governance, Risk & Compliance Legal Governance, Risk & Compliance Trust Center Enterprise Customer Terms of Service End User License Agreement Data Processing Addendum Privacy Policy Cookie Policy SpyCloud Site Terms of Use Patents SpyCloud aligns ourselves with industry-best security practices. Here, you can find information about our technical and organizational security measures. If you don’t see the information you’re looking for, please email us at grc-info@spycloud.com. Trust Center Visit our Trust Center HERE Physical Security SpyCloud hosts all production data within a secure industry leading hosting services provider, Amazon Web Services. This provider is compliant with multiple frameworks, such as SOC2 and ISO27001. The hosting provider is responsible for all physical access security for the datacenter. Audit Logging All traffic coming into and leaving the production network is logged within our firewall. SpyCloud implements firewalls that restrict known malicious traffic. These logs are secured and limited to a subset of employees with read-only access. Logs are important for investigation-related materials such as forensics. High targets, such as environment connection points to the production environment, have further logs installed on them. These logs are setup in accordance with common security standards such as read-only format to ensure that logs are remain secure. Patching & Hardening All products assets are deployed using hardened images which consist of the most stable version of updates currently available. These images are maintained using terraform. In the event a high or critical CVSS scored vulnerability occurs, we will triage this in accordance with our security incident response policy. SpyCloud implements a four tier grouping for vulnerabilities: Low, Medium, High, and Critical. Each category is accompanied with their own resolution times. Anti-Virus & Anti-Malware Within the production environment, all machines are monitored using anti-virus and anti-malware protection methods. We utilize industry-leading, centrally-managed tools. Our security operations team continuously monitors these tools, and all alerts, such as vulnerability or malicious findings, are triaged in accordance with our Security Incident Response Plan. Backups In order to maintain a stable and reliable environment, SpyCloud implements backups on a regular basis. All backups are encrypted with AES256. Encryption The production environment is secured with encryption at-rest and in-transit. Traffic is restricted to TLS 1.2 and above only. Encryption-at-rest occurs using modern and secure technologies, such as AES256. Secure Access & Authentication All SpyCloud-owned assets and systems require secure access and authentication. SpyCloud implements authentication security in a variety of forms. Laptops require that all users provide a strong password or their fingerprint in order to be open. All connections to the data center require a username, password, and a form of multi-factor authentication. Accounts are regularly reviewed as part of the continuous monitoring process. During this review, we ensure that only accounts with need-to-know responsibility have access. We perform this to align with the principles of separation of duties and least privilege. Security Monitoring SpyCloud uses a combination of industry leading tools in order to maintain a secure production environment. These tools create a baseline behavior which alerts the Engineering team when deviations from normal behaviors occur. Change Control Management In order to maintain a stable and secure environment, SpyCloud follows strong change management practices. All changes are tracked in a ticketing system which provides SpyCloud with crucial information regarding all changes. Prior to a change being implemented within the production environment, a series of testing occurs, including code review, quality assurance, and code scanning. All changes require multiple levels of review and approval to ensure that any production-related changes have been safely tested and approved. Transforming recaptured data to protect your business. Contact Us NEW RESEARCH: Over 2/3 of orgs had an identity event last year – NHIs were the top cause. Read on →