Spring, 2016
Adeptia has engaged with 3rd party Application Security vendor to perform a security scan on the Adeptia Connect Web Application. The Adeptia Connect application security is also independently tested and verified by following companies:
- Cigital Inc.
- Intuit Inc.
- Salesforce Inc.
- Amazon AWS
- SAP
Adeptia Connect is a cloud-based business application that allows you to access and exchange data with your partners (customers, vendors, or external organizations), and other cloud-based applications used within the company. It allows you to exchange information in the simplest possible way. It is designed for business users to self-manage their data connectivity while providing control to IT staff.
Adeptia Connect features a simple user interface to manage all external connections and data interfaces for your company , and reduces your effort and cost drastically. It is a single place to manage all your business data exchanges, where you publish your company profile just once and Adeptia Connect takes care of the rest.
Objective
The objective of this assessment is to assess the overall security posture of the application from a black-box perspective. This includes determining the application's ability to resist common attack patterns and identifying vulnerable areas in the internal or external interfaces that may be exploited by a malicious user.
...
- Application Security
- Data Security
- Infrastructure and Hosting Security
Scope
The scope of this engagement is limited to components and interfaces specific to Adeptia Connect Web Application. The following URLs are considered in scope:
...
The severity assigned to each vulnerability was calculated using the NIST 800-30 r1 standard. This standard determines the risk posed by the application based on the likelihood an attacker exploits the vulnerability and the impact that it have has on the business.
Likelihood
...
The impact the vulnerability would have on the organization , if it is exploited successfully , is rated with the following values:
...
Adeptia takes security very seriously and has gone to great lengths to insure ensure the integrity of customer data. The architecture of Adeptia Connectcarefully keeps your security in mind. Because the connections reside in the secure Adeptia AWS Cloud, it is important that there are extensive security measures in place in order to prevent any compromise during the configuration and run-time execution of a connection. Adeptia Connect has been designed not to save a local copy of the customer data and if the data does not exist, it cannot be compromised.
Application Communication Security
Access to Source and Target Applications is through secure SSL connections and access to Adeptia Connect is through a Web Application Firewall (WAF) that prevents attacks such as SQL injection, cross-site scripting, denial of service and many others. To ensure the security of data in transit, Adeptia Connect makes use of the latest and most stringent data communication security standards. All communications to and from Adeptia Connect is done using SSL encryption (SHA-256 with RSA Encryption).
Encryption Security
Adeptia uses AES 256 Encryption for encrypting user passwords. AES 256 is the strongest encryption available for password protection. For data at rest, Adeptia uses AES 256 to encrypt and store the connection metadata in the Adeptia AWS NFS volume.
Certificates
Certain Adeptia Connect Connectors use certificates in order to ensure security when transmitting data across a communication protocol. Connectors such as FTPS, SFTP, HTTPS, and many others requires require the use of certificates in order to encrypt data and channels and to verify the digital signature of the application sending the data. The Certificate Component can use an existing key obtained from a certificate authority such as VeriSign or a key generated by Adeptia.
Protection against attacks
...
- Web Application Vulnerabilities
- Operator-sided Data Leakage
- Insufficient Data Breach Response
- Insufficient Deletion of personal data
- Non-transparent Policies, terms and Conditions
- Collection of data not required for the primary purpose
- Sharing of data with the third party
- Outdated personal data
- Missing or insufficient session expiration
- Insecure Data Transfer
...
- Admin users approve other users
- User Management console available
- Password policies
- Strong password enforced
- Password retries are limited
- Password expiry option available
- Users can be deactivatedeactivated/paused before deleting
- Separate environments for separate departments to segment users
Role-Based Security
Adeptia Connect follows these guidelines to provide Role-Based Security.
- Admin – IT Users
- Manage access
- Monitor User activity
- User Control
- Governance
- Admin give access to business users
- Admin controls what connectors are available
- Audit Trail
- Track who did what and when
- Object Locking
- Prevent changes to approved objects
...
- Access to Shared Connections is only allowed to authorized customers or partners
- Systems tracks track all those who are authorized
- Admin has the ability to revoke access
...
Findings | Description | Verified |
File Upload Restrictions | Adeptia prevent users from uploading files without proper validation. | √ |
Account Lockout Policy | Adeptia enforces an account lockout policy by suspending a user account after a certain number of failed authentication attempts. | √ |
Server-side validation | Adeptia uses server-side validation for any client-side input to prevent attackers from accessing the application via proxy. | √ |
Query String Parameter in SSL Request | Adeptia does not allow sensitive data to be passed between the client and server in the URL query string. Parameters are passed via POST operation. | √ |
Password Policy | Adeptia follows a strong password complexity policy. This policy combines rules to prevent easily guessable password from being used while also ensuring that passwords contain sufficient entropy. | √ |
Secure Cookie Attribute | Adeptia sets 'Secure' attribute on all cookies that contain sensitive values such as Session IDs. | √ |
NPI Data Security | Adeptia masks or obfuscates Non-public personal information (NPI) when this data is entered into the application and when it is displayed back to the user. | √ |
Cacheable SSP Pages | Adeptia uses Cache-Control directives to set the cache behavior on all pages. | √ |
Verbose Server Banner | Adeptia does not provide verbose server information from all HTTP responses | √ |
OWASP Top 10 Privacy Risk Test | Adeptia complies with OWASP Top 10 security risks and supports countermeasures to mitigate these risks. | √ |
Data Security
It is important to note that at no point during the Connection configuration or run-time process does Adeptia Connect store the data. Adeptia Connect is engineered to optimize interoperability of applications and facilitate your integration processes without saving your data in our data center, unless specifically configured to do so.
On-Premise Data – Data that processes through an 'On Premise' Adeptia Secure Engine will never actually flow through cloud data center. The data is stored behind the firewall on a customer server where the Connection is executed and is transported directly to the Secure Engine configured behind your company's firewall. Later in this section, we will describe the benefits of Secure Bridge and Secure Engine.
Hosted Metadata – For Connections deployed in our data center, you will have all the security that our data center infrastructure provides in order to ensure that your metadata resides in a system that will keep it secure. These data centers provide the highest level of SaaS security available. This will ensure that all your metadata for your hosted Connections is fully secure and only accessible by your account.
Adeptia's Secure Bridge and Engine help you maintain confidentiality and privacy of your data by allowing you connect your internal applications securely. It also helps moving processing to your own premises, if required.
Secure Bridge
Secure Bridge helps you to securely connect your private databases, JMS instances, and files from your own secured premises to Adeptia Connect. Using Secure Bridge, you can connect your entities to Connect as a source or target application, securely and easily.
Benefits of Secure Bridge
- Securely connects on-premise applications to the cloud applications
- Connects on-premise applications running at different locations
- Allows to securely share on-premise applications data to other companies
Secure Engine
Secure Engine helps you to process all your data within your own premise. It also helps you to use your own private servers while using Secure Bridge.
Benefits of Secure Engine
- Secure Engines provides you with the flexibility of iPass while you still want your data to process in your secure data center or on-premise.
- Secure Engine also has Secure Bridge capability and you get Secure Bridge with Secure Engine.
Findings
Findings | Description | Verified |
Only Metadata stored in the cloud and no business data. | Adeptia Connect only stores the metadata related to Connection configuration in the cloud. Business data is never stored in the cloud. | √ |
Runtime data flows through Secure Engine and never in the cloud | Adeptia enforces the runtime data transit through Secure Engine. | √ |
User authentication information | Adeptia encrypts and stores user authentication. Passwords are protected with cryptographic hash algorithms. | √ |
Encryption at rest | Adeptia uses AES 256-bit encryption for metadata storage. | √ |
Multi-tenant system | Adeptia follows multi-layer and multi-tier security provisioning; segregating customer configurations and metadata from other customers. | √ |
Metadata backup and storage | Adeptia backups all the metadata and uses secondary storage nodes for redundancy and availability. Backup policies and procedures are the key aspect aspects of ensuring continued service. | √ |
Customer data stored in desktops storedindesktops or laptops | Adeptia does not store any customer data in laptops or desktops. | √ |
Access to modifying Connection configuration | Adeptia allows access to Connection configurations based on user and object permissions. | √ |
Encryption of Data in transit | Adeptia follows SSL based HTTPS. All communications to and from Adeptia Connect is done using SSL encryption (SHA-256 with RSA Encryption). | √ |
Hosting and Infrastructure Security
Amazon AWS Certified Partner
Adeptia is a certified partner of Amazon AWS and its iPaaS application "Adeptia Connect" is hosted on the Amazon AWS infrastructure.
Amazon Web Services Compliance enables customers to understand the robust controls in place at AWS to maintain security and data protection in the cloud. As systems are built on top of the AWS cloud infrastructure, both customers and Amazon AWS share compliance responsibilities.
By tying together governance-focused, audit-friendly service features with applicable compliance or audit standards, AWS Compliance enablers build on traditional programs; helping customers to establish and operate in an AWS security control environment.
The IT infrastructure that AWS provides to its customers is designed and managed in alignment with security best practices and a variety of IT security standards, including:
- SOC1/SSAE16/ISAE3402 (formerly SAS70)
- SOC2
- SOC3
- FISMA
- Fed RAMP
- DODSRG Levels 2 and 4
- PCIDSS Level1
- EU Model Clauses
- ISO9001 /ISO27001 / ISO 27017 / ISO 27018
- ITAR
- IRAP
- FIPS 140-2
- MLPS Level 3
- MTCS
For more information on the Amazon AWS Security, refer to following resources:
- https://d0.awsstatic.com/whitepapers/Security/AWS_Security_Whitepaper.pdf
- https://aws.amazon.com/compliance/resources/
Findings
Findings | Description | Verified |
Amazon Elastic Compute Security | With Amazon EC2, Adeptia Connect provides resizable computing capacity that can scale based on volume and usage. | √ |
Multiple Levels of Security | With Amazon EC2, Adeptia Connect supports security at multiple levels; OS of the host platform, firewall and signed API calls. | √ |
Instance Isolation | Different running nodes are isolated from each other along with encrypted file system. | √ |
Elastic Load Balancing Security | With Amazon's Elastic Load Balancing, Adeptia Connect manages traffic on a fleet of Amazon EC2 instances, distributing traffic to instances across all availability zones within a region. | √ |
Amazon Simple Storage Service (S3) Security | Access to data in Amazon S3 is restricted; only object owners have access to Adeptia S3 resources they create. | √ |
Data Durability and Reliability | Adeptia uses use Amazon S3 that is designed to provide high durability and availability of objects on demand. Objects are redundantly stored in on multiple devices across multiple facilities in the Amazon S3 region. | √ |
Encryption | Adeptia encrypts the connection between Adeptia Connect application and its databases using SSL. RDS creates SSL certificate and deploys the certificate on the DB instance when the instance is provisioned. | √ |
Automated Backups and DB Snapshots | Adeptia uses Amazon RDS that provides two different methods for backups and restoring DB Instance; automated backups and database snapshots. | √ |
Event Notifications and Reporting | Adeptia has setup robust dashboards and notification controls on getting alerts whenever important events occur on the AWS nodes. | √ |
Summary
Adeptia takes security very seriously and has gone to great lengths to insure integrity of customer data. Some of the important findings in the SecurityUsing Encryption and Decryption
Encryption is the process of encoding the data in such a way that it can be read only by the authorized users. The purpose of encryption is to prevent third parties from recovering the original data.
In an encryption process, the data (referred to as plaintext) is encrypted using an encryption algorithm, turning it into an unreadable ciphertext. This is usually done with the use of an encryption key, which specifies how the data is to be encoded. An authorized party, however, is able to decode the ciphertext using a decryption algorithm which usually requires a secret decryption key. For more information, click here.
Summary
Adeptia takes security very seriously and has gone to great lengths to ensure the integrity of customer data. Some of the important findings in the Security Assessment Report are:
- Application The application is architected to not to save a local copy of the customer data. If data does not exist, it cannot be compromised
- Customers may select to utilize dedicated servers for processing of their data, this ensures their data is at no time in the multi-tenant environment
- All web access to Adeptia Connect is thru secure HTTPS connections
- All access to sources and targets is thru secure SSL connections
- Adeptia Connect is architected to prevent attacks such as SQL injection, cross-site scripting, OWASP Top 10 risks and many others.
- Adeptia utilizes a third party, independent company to do regular penetration and security vulnerability assessment tests.
...