Ochrona sygnalistów, spraw i firm

The publicly accessible part of the Ethicontrol system - Ethicontrol intake and web-feedback application are separated from the Ethicontrol incident & case management application which is for client internal use only.

The data assembled during investigations is isolated in such a way that there is no possibility of receiving access to investigation data once the intake system is compromised.

In case of DDOS or other attacks against the Ethicontrol intake application, the case management application will remain fully operational and protected by more conservative tools and methods which cannot be used for public portals & applications.

All cloud assets must have a defined owner, security classification, and purpose.

To better protect the data in our care, Ethicontrol classifies data into different levels and species the labeling and handling requirements for each of those classes.

Customer data is classified at the highest level. Data classifications are maintained as part of the asset management process. Ethicontrol inventories hardware, software, and data assets at least annually to maintain correct data classification.

Every action within the system is logged.
Ethicontrol offers the possibility to get a report with up-to-date account activity information, including authentication events, changes in the authorization and access controls, sharing folders and tasks, and other security activities.

At the level of the operating system, the Ethicontrol's web server is behind a firewall where all ports are closed with the exception of those which are used for system purposes. Technical access to the server is carried out exclusively through Ethicontrol subnets.

Authentication data sent by a client machine can be encrypted using JavaScript and
and RSA key. Additionally, OTP (one-time password) technology can be engaged in
conjunction with an eToken.

Proactive Web Application Firewall, which categorically blocks the vast majority of
attacks on web applications.

Ethicontrol hosts its servers in locked cages within data centers located in the U.S and
EU: Trusted Data Center in the U.S is compliant with SSAE 16 Type II and ISO 27001
standard, and is located in San Jose, California.

Ethicontrol's European Data Center is hosted in Frankfurt, Germany, and is also
compliant with ISO 27001 and ISAE 3402 standards (equivalent to SSAE 16). This
data center is isolated and retains customer and sensitive data within the EU only.

Ethicontrol is running real-time database replication, to ensure that customer data is
both backed up and available on redundant and geographically dispersed servers,
physically separated from the primary Ethicontrol application servers, aiming to
ensure fault tolerance.

All backups are encrypted in transit and at rest using strong encryption. Backup files
are stored redundantly across multiple availability zones and are encrypted.

Do you maintain a quality management system (QMS) approved by management? In lieu of a formal and static QMS, Ethicontrol has a dynamic and responsive approach to quality management. Does your quality management system (QMS) include coverage for software application security principles?
YES

Is quality management system (QMS) content published and communicated to all relevant employees?
YES.

Is quality management system (QMS) content reviewed and updated (if appropriate) at least once per year?
It is considered a constant Work In Progress; and updated almost daily in small increments.

Is there defined management oversight who is responsible for application quality and security reporting & signoff?
YES.

Is access to and maintenance of applications, systems, network components (including routers, databases, firewalls, voice communications servers, voice recording servers, etc), operating systems, virtualization components, hypervisors, or other information objects restricted to authorized personnel only?
YES

Is access to and maintenance of applications, systems, network components (including routers, firewalls, voice communications servers, voice recording servers, voice response units (VRU), etc), operating systems, virtualization components, hypervisors, or other information objects granted based upon need-to-know job function?
YES

For all IT systems including but not limited to servers, routers, switches, firewalls, databases, and external social spaces, is management approval required prior to creating all user and privileged accounts (e.g., system or security administrator)?
YES

For all IT systems including but not limited to servers, routers, switches, firewalls, and databases are privileged accounts (e.g., system or security administrator) logged at all times and reviewed on at least a quarterly basis?
YES

Are all user accounts (including, but not limited to, standard user, system administrator, security administrator, internal social spaces, etc) assigned to an individual employee and not shared?
YES

Are all user accounts disabled after no more than ten unsuccessful login attempts?
YES

For all IT systems (including but not limited to servers, routers, databases, switches, firewalls, and external social spaces), are inactive users and privileged accounts (e.g., system administrator or security administrator) disabled after 90 days or more?
YES

Is a user's identity verified before communicating an initial/temporary password or initiating a password reset by an automated or manual process?
YES

Do application, system, and device passwords (including routers, firewalls, databases, and external social spaces) require passwords to have the following characteristics:

1. minimum length of 8 characters,
2. choose from any acceptable character sets available on the target system,
3. includes at least one alphabetic and one numeric character.

Is Internal company training available & performed commensurate with personnel roles and responsibilities?
YES; peer-to-peer training is commonplace.

Does the training include security awareness?
YES; as applicable for the role.

Does the training include education on policies, standards, procedures, and updates when needed?
YES; as applicable.

Are personnel training plans and records kept for internal company compliance purposes?
Tasks and training completed during onboarding are recorded.

Are results from the execution of test plans reported and used to track and justify release readiness?
YES. We require all automated tests to pass before any official release (monthly and patch versions), and perform manual QA testing for each monthly release.

Does the quality assurance organization have the authority to delay the shipment of releases due to non-conformance reasons?
YES.

Is some form of static code scanning performed as part of the release acceptance? What tools are used?
YES. For example, brakeman and bundler-audit are part of our test suite to be alerted to any security issues in our dependent Ruby libraries.

Is some form of dynamic code scanning performed as part of the release acceptance? What tools are used?
YES. We use Circle CI for this purpose.