AlgoSec SaaS Services Security Practices

This topic provides the information needed to assess the impact of AlgoSec SaaS Services on the overall Data Management and Security posture, by detailing how data may be captured, processed, and stored by and within the SaaS products used.

AlgoSec SaaS Service Security Considerations

Any customer data stored on or processed by AlgoSec is secured with state-of-the-art technologies. We operate ongoing rigorous technical and organizational security controls on all the services listed in this document, focusing on monitoring, change management, security updates and closing gaps from yearly penetration tests.

AlgoSec holds multiple certifications, demonstrating our firm commitment to top-tier security. We strive to comply with and maintain high-quality standards in line with globally recognized frameworks. AlgoSec is certified for the ISO/IEC 27001:2013 & ISO/IEC 27017:2015 standards which outlines the best practices for information security management systems. As well, AlgoSec has been certified following a SOC 2 Type II audit conducted by an independent service auditor. This audit evaluates the design, implementation, and effectiveness of the controls we have in place for our products.

Tenant and user management

Tenant and user management data is stored securely as follows:

• Isolation of data between tenants
• Role Based Access Control (RBAC)
• User management and authentication

Isolation of data between tenants

AlgoSec SaaS does the following to isolate data between tenants:

• AlgoSec SaaS uses stateless services. AlgoSec SaaS services do not store data of any kind in memory that may leak between actions of different tenants.

• AlgoSec SaaS isolates data at rest. We deploy dedicated tenant infrastructure and separate databases for each customer. Each designated database requires access credentials. The access credentials are available only to AlgoSec services and applications and not directly to the user. These credentials are held in AWS KMS service and are accessible only by users of that tenant. Refer to the diagram above.

User management and authentication

AlgoSec SaaS uses the Cognito AWS service to manage users and create unique identities for users and federate them with identity providers (AAD). AlgoSec SaaS allocates a designated user pool for each tenant, which is isolated from other tenants. Users of one tenant cannot access other tenants, even if usernames are identical.

AlgoSec SaaS runs OAuth 2.0 authentication against these designated user pools, where each user must specify their tenant ID. The tenant ID indicates which Cognito user pool AlgoSec SaaS should redirect to.

AlgoSec SaaS provides the option of setting Multiple Factor Authentication (MFA) enforcement for each user in the system with secure MFA device setup and routine authentication powered by the AWS Cognito service.

AlgoSec SaaS service allows Single Sign-On (SSO) using external identity providers (IdP) such as Microsoft Azure Active Directory via SAML 2.0 Authentication method.

Data handling

AlgoSec SaaS stores sensitive data, such as passwords and tokens, encrypted using the AWS KMS service. For more details, see https://aws.amazon.com/kms/features/.

Encryption

Data is encrypted both at rest as well as in transit.

• Data Encryption at Rest: All data at rest (in RDS instances etc.) is encrypted using the AES-256 algorithm.

• Data Encryption in Transit: All data in transit is encrypted using the TLS 1.2

Protocol Internal communication

Each AlgoSec SaaS service communicates with others using a REST API or message queues.

• REST calls run over HTTPS, using server-side authentication.

• Queue messages are handled by AWS SQS and are accessible only for some of the services. Queue messages are not exposed to external calls. Messages to and from the queue are done via HTTPS.

Data not exposed to AlgoSec SaaS

AlgoSec does not access, store, or manage any highly sensitive, US regulated PII data across its SaaS solutions. Specific data contained by each AlgoSec SaaS solution is as follows:

• CloudFlow: CloudFlow contains cloud asset inventory, cloud-native firewall, and security policy data.

• ObjectFlow: ObjectFlow contains object name, content, and their relationships (Object group members).

• AppViz: AppViz contains application connectivity specifications, risk, and vulnerability data. AppViz is out of band and does not process or observe application traffic.

You may choose to connect your AlgoSec SaaS tenant to your on-premises ASMS system*. Even if you do so, your AlgoSaaS tenant is not exposed to the credentials that are used to access the security devices managed by ASMS.

*Benefits to doing this include, for example: for CloudFlow, connectivity check, for ObjectFlow, object sync, FireFlow change requests and more, and for AppViz (SaaS), object sync, FireFlow change requests, Application Discovery data, connectivity checks, ASMS application-level risks, scanner information sharing and more.

Privacy Regulations

Data gathered by AlgoSec SaaS services is almost entirely free of personally identifying information (PII). The only sensitive data that may be found in the data is names, business email addresses, and IP addresses of customer employees. AlgoSec is committed to protecting personal data processed by AlgoSec SaaS . We will not access the content of the information in a way that would allow the service to acquire meaningful information about natural persons, other than in exceptional cases where it is necessary for identifying security threats or investigating suspicious behavior indicative of attack.

Any information stored on or processed by AlgoSec SaaS are secured with state-of-the-art technologies, and AlgoSec operates rigorous technical and organizational security controls.

ASMS-AlgoSec SaaS* trust and communication

Protocols

AlgoSec SaaS uses the following communication protocols:

HTTPS	Used for the following types of REST calls: Between services, and with externally available API calls Port: 443
Kafka	Encrypted messaging protocol. (no specific network configuration is required)
HTTP tunneling	Encrypted TLS over HTTP tunnel. Used in Kafka proxy. Port: 8082

Regions

AlgoSec SaaS deployment locations are hosted in Amazon Web Services (AWS^®).

AlgoSec deployment locations are hosted in several AWS regions and the default assignment of tenants to AWS regions is based on the customer’s country of origin.

The following AWS regions are offered:

Region	AWS Deployment location	CloudFlow	ObjectFlow	AppViz
North America	N. Virginia (US-East-1) region	✔	✔	✔
EMEA	Frankfurt (EU-Central-1) region	✔	✔	✔
APAC (ANZ)	Sydney (AP-southeast-2) region	✔	✔	✔

Session timeout

To protect your data, user sessions are automatically logged out after 60 minutes of inactivity.

Log back in to continue where you left off.

Changes to on-premises devices

Some AlgoSec SaaS services have the capability to trigger changes to the security policies and network object definitions within on-premises devices. All such changes like creating or editing network objects or filtering rules are executed by creating change requests in the on-premises AlgoSec FireFlow. The objects and policies are pushed into the on-premises devices by FireFlow which introduces additional controls (like approvers and reviewers) and is audited with the name of the user who initiated the request, approved, and executed it.

Availability

AlgoSec uses commercially reasonable efforts to make AlgoSec SaaS services available with a Monthly Uptime Percentage of at least 99.9%.

Scanning for misconfigurations

We use advanced CSPM and cloud security monitoring tools, plus AlgoSec AppViz (SaaS), to scan across the entire AlgoSec SaaS environment. Detected misconfigurations are handled according to severity.

 

â See also:

• ASMS integration to SaaS services