1. Introduction
This document establishes the security policy framework for the Microsoft Azure-based E-Cloud Service provided by E-Tabs Ltd. It is designed to ensure the confidentiality, integrity, and availability of data and resources hosted on the Microsoft Azure platform. This policy applies to all personnel, systems, and data within the Microsoft Azure environment.
2. Access Control
2.1. Identity and Access Management (IAM)
- Access to Microsoft Azure resources is granted based on the principle of least privilege, ensuring that users have only the permissions necessary to perform their job functions.
- Users are authenticated using Microsoft Entra ID (MEI), which provides centralized identity management and authentication services.
- Multi-Factor Authentication (MFA) is enforced for all privileged accounts, adding an extra layer of security to the authentication process.
- Role-Based Access Control (RBAC) is utilized to assign granular permissions to users, groups, and applications, enabling fine-grained access control.
- Regular access reviews are conducted to ensure that access rights are up-to-date and aligned with organizational policies.
- Virtual Networks (VNets) are used to isolate resources logically and control traffic flow within the Microsoft Azure environment.
- Network Security Groups (NSGs) are employed to enforce network security policies by filtering inbound and outbound traffic to and from Microsoft Azure resources based on specified rules.
- Microsoft Azure Firewall is utilized to provide an additional layer of network security, allowing for the creation of application and network-level rules to protect against unauthorized access and threats.
- Microsoft Azure DDoS Protection Standard is implemented to mitigate distributed denial-of-service (DDoS) attacks and ensure the availability of Microsoft Azure services.
3. Data Protection
- Data at rest is encrypted using Microsoft Azure Disk Encryption for virtual machines, which uses industry-standard encryption algorithms to protect data stored on Microsoft Azure managed disks.
- Microsoft Azure Storage Service Encryption is enabled to automatically encrypt data stored in Microsoft Azure Blob Storage, Microsoft Azure Files, and Microsoft Azure Queue Storage, ensuring the confidentiality and integrity of data.
- Data in transit is protected using Transport Layer Security (TLS) protocols, which encrypt data transmitted between Microsoft Azure services and client applications over the network.
- Microsoft Azure Key Vault is used to securely manage cryptographic keys and secrets, providing centralized key management and access control for encryption keys used to protect sensitive data.
- Data classification and labelling are enforced to classify sensitive data based on its sensitivity level and apply appropriate protection measures.
4. Threat Detection and Response
- Microsoft Azure Security Centre is utilized for continuous monitoring of security posture and threat detection across Microsoft Azure resources.
- Security alerts generated by Microsoft Azure Security Centre are monitored and investigated to identify potential security incidents or anomalies.
- Microsoft Azure Monitor and Microsoft Azure Sentinel are used for centralized logging, analysis, and alerting, enabling proactive threat detection and response across the Microsoft Azure environment.
- Incident response procedures are established to provide guidance on how to respond to security incidents effectively and minimize their impact.
- An incident response team is designated, consisting of personnel with defined roles and responsibilities for incident detection, analysis, containment, eradication, and recovery.
- Post-incident reviews are conducted to analyze the root cause of security incidents, identify lessons learned, and implement corrective actions to prevent recurrence.
5. Compliance and Governance
- E-Cloud is hosted in Microsoft Azure which adheres to industry-standard compliance certifications including ISO 27001, SOC 2, HIPAA, GDPR.
- Regular audits and assessments are conducted to evaluate compliance with regulatory requirements, industry standards, and internal policies, ensuring that Microsoft Azure services meet the necessary security and privacy requirements.
- Microsoft Azure Policy is used to enforce compliance with organizational standards and regulatory requirements by defining and enforcing policies that govern resource configuration and behaviour within the Microsoft Azure environment.
- Continuous compliance monitoring and reporting are performed to assess compliance with organizational policies and standards, identify compliance gaps, and remediate non-compliant resources or configurations.
6. Security Best Practices
- Regular security training and awareness programs are provided to personnel to promote security awareness and educate them about security best practices, threats, and vulnerabilities.
- Vulnerability-management processes are implemented to identify and remediate security vulnerabilities promptly, including regular vulnerability scanning and patch management.
- Secure coding practices are followed for the development and deployment of applications hosted on Microsoft Azure, incorporating security controls and best practices into the software development lifecycle to mitigate security risks.
7. Segregation and Geographic Distribution of Client Data
In E-Tabs E-Cloud, we prioritize the security and confidentiality of client data by implementing rigorous segregation and geographic distribution practices. Our approach ensures that client data is carefully segmented and maintained across multiple geo-locations, enhancing resilience and mitigating risks associated with data loss or unauthorized access.
- Client data is segmented based on its sensitivity and access requirements.
- We employ robust access controls and encryption mechanisms to enforce strict separation between different datasets, preventing unauthorized access or leakage of sensitive information.
- Clients can, if desired, specify preferred geo-locations within which to store and process their data. The granularity for this is at a E-Cloud project (i.e. data and outputs) level.
- Within each geo-location there is data redundancy ensuring optimal performance and disaster recovery due to localized events such as natural disasters or infrastructure failures.
- Redundant storage and replication mechanisms are employed to maintain multiple copies of client data within geo-locations, enabling rapid recovery and continuity of operations in the event of a failure or outage.
7.4 Data Sovereignty and Compliance
- We adhere to data sovereignty requirements by storing client data in geo-locations that comply with relevant regulations and legal frameworks.
- Compliance with international data protection laws, such as GDPR and HIPAA, is ensured by maintaining data within designated regions that meet the respective regulatory standards.
8. Data retention policies
In addition to rigorously segmenting data, E-Tabs E-Cloud gives users control over data retention policy. Each client account (company) has a default duration (currently 28 days) for data retention after a project run. This can be overridden if needed on a project level and even for each individual project run. Data will include all source data and all output data.
9. User policies
E-Tabs E-Cloud uses a username and password transmitted encrypted to authorise on a session-less basis. E-Cloud also offers session-based OAuth authentication for increased security, currently implementing Microsoft and Google as authenticating authorities.
E-Cloud offers users a role-based security model to ensure data privacy:
- API-only Runners are the most restricted role being able only to queue projects for running. They cannot call any other functions in the API and cannot login to the E-Cloud Manager. This type of user is designed for situations where the user details are public (for example in the Javascript of a dashboard that needs to run projects).
- Runners can login to the E-Cloud Manager and call the API to see and change their own user details. They can run projects but cannot create or edit them. They can only view their own user details and only view projects that are assigned to them.
- Designers have the Runner capabilities but can, in addition, work on projects, checking them in and out. They can only view their own user details and only view projects that are assigned to them.
- Account Administrators can perform all functions within their account. They can see all license, project, and user details. In addition to Designer capabilities, they can create and delete users, create new projects, assign users to projects and switch projects between their licenses.
10. Conclusion
This security policy establishes the framework for securing the E-Cloud service provided by E-Tabs Ltd. By implementing robust access controls, data protection measures, threat detection and response capabilities, and compliance and governance practices, we aim to ensure the confidentiality, integrity, and availability of data and resources hosted on the Microsoft Azure platform. We use continuous monitoring, review, and improvement of security controls to maintain the effectiveness of our security posture and protect against evolving threats and vulnerabilities.