Adeptia Connect - Security Overview

Adeptia Connect provides a secure end-to-end encrypted environment for all data that is transferred and exchanged between the companies and its partners. Adeptia has multiple features that are implemented right from implementation until a transaction is complete. This ensures that all the user data transacted through adept is secured and does not move out. Following is the list of security features of Adeptia Connect. 

On-Premise Installation in DMZ Environment

Certificates

Certain Adeptia Connect Connectors use certificates in order to ensure security when transmitting data across a communication protocol. Connectors such as FTPS, SFTP, HTTPS, and many others require the use of certificates in order to encrypt data and channels and to verify the digital signature of the application sending the data. The Certificate Component can use an existing key obtained from a certificate authority such as VeriSign or a key generated by Adeptia.

Data Encryption

Encryption is the process of encoding the data in such a way that it can be read only by the authorized users. The purpose of encryption is to prevent third parties from recovering the original data. In an encryption process, the data (referred to as plaintext) is encrypted using an encryption algorithm, turning it into an unreadable ciphertext. This is usually done with the use of an encryption key, which specifies how the data is to be encoded. An adversary may be able to see the ciphertext but should not be able to decode the original data. An authorized party, however, is able to decode the ciphertext using a decryption algorithm which usually requires a secret decryption key. The adversaries do not have access to this key. An encryption process usually needs a key-generation algorithm to randomly produce keys.

Adeptia enables you to apply encryption and decryption to the source and target files being transported via Adeptia Server. This enhances the security of the file being transported. To use encryption and decryption in Adeptia Suite, a new feature Data Security has been added in Adeptia Suite. You can now encrypt the source file to be sent and in a similar way, you can decrypt an encrypted file received via Adeptia Server.

During the assessment, following tests are conducted on Adeptia Connect:

• Application Security
• Data Security
• Infrastructure and Hosting Security

In an encryption process, the data (referred to as plaintext) is encrypted using an encryption algorithm, turning it into an unreadable ciphertext. This is usually done with the use of an encryption key, which specifies how the data is to be encoded.  An authorized party, however, is able to decode the ciphertext using a decryption algorithm which usually requires a secret decryption key. For more information, click here.

Protection against attacks

Adeptia has implemented the following techniques to prevent attackers to exploit the vulnerabilities in the Adeptia Connect application.

• OWASP Top 10 vulnerabilities

1. 1. Web Application Vulnerabilities
   2. Operator-sided Data Leakage
   3. Insufficient Data Breach Response
   4. Insufficient Deletion of personal data
   5. Non-transparent Policies, terms and Conditions
   6. Collection of data not required for the primary purpose
   7. Sharing of data with the third party
   8. Outdated personal data
   9. Missing or insufficient session expiration
   10. Insecure Data Transfer

• Follows SOC2 SSAE 16 security compliance guidelines
• Distributed Denial of Service (DDoS) Mitigation

Logical separation of Objects

Adeptia Connect follows these guidelines to logically separate objects.

• One company's objects cannot be accessed by any other company
• Every object tagged with Company ID (Tenant ID)
  • Data store schema design
• Code/logic enforces access by Company ID
• Encrypted Databases and Storage

User Authentication

Adeptia Connect follows these guidelines to provide secure authentication for user access.

• Admin users approve other users
• User Management console available
• Password policies
  • Strong password enforced
  • Password retries are limited
  • Password expiry option available
• Users can be deactivated/paused before deleting
• Separate environments for separate departments to segment users

Role-Based Security

Adeptia Connect follows these guidelines to provide Role-Based Security.

• Admin – IT Users
  • Manage access
  • Monitor User activity
  • User Control
  • Governance
• Admin give access to business users
• Admin controls what connectors are available
• Audit Trail
  • Track who did what and when
• Object Locking
  • Prevent changes to approved objects

User Authorization

Adeptia Connect follows these guidelines for User Authorization.

• Access to Shared Connections is only allowed to authorized customers or partners
• Systems track all those who are authorized
• Admin has the ability to revoke access

Data Security