twilio cloud communications SECURITY ARCHITECTURE

Transcription

1 twilio cloud communications SECURITY ARCHITECTURE July 2014 twilio.com

2 Security is a lingering concern for many businesses that want to take advantage of the flexibility and ease of cloud services. Businesses have found that previously employed security measures for on-premise equipment and traffic have to be adjusted as communications applications move out to the cloud. Equally, businesses need to be able to trust that their cloud services are secure by getting a clear view into their provider s security practices and operations. Twilio strives to build customer trust by keeping customer data both private and secure. The core of the Twilio security program are internal security mechanisms, processes and configurable features that protect the Twilio cloud platform and connected customer applications. In the spirit of transparency, this document details all of these platform security mechanisms and processes. Additionally, this document covers best practices we have gleaned from customer implementations to achieve regulatory compliance. It is important to note that new security capabilities are frequently added as we encounter changes in the security landscape and new Twilio use-cases emerge. 1. Security in layers to protect physical, network and application components of the Twilio platform, where: Physical security mechanisms that apply across distributed compute and storage; Network security mechanisms that apply across global carrier interconnects; and Application security mechanisms that apply to customers apps, which connect via the Twilio API. 2. Customer-accessible details on the internally implemented security policies, internal audits, systems and operations. 3. Best practices that help businesses address various regulatory compliance requirements.

3 SECURE YOUR TWILIO-POWERED APPLICATIONS Application security mechanisms and features for customer apps include: multi-tenant communications platform. Multi-tenancy is an integral component of Twilio s architecture, and it also applies to the AWS infrastructure, the Twilio platform and customer applications. For example, Twilio maintains per-tenant isolation for resources, such as queues, databases, bandwidth and the API, which makes customers applications highly secure, because each customer s workflows occur in isolation from every other customer s workflows. ssl. Twilio uses SSL 3.0 to encrypt bidirectional web session traffic between the customer application and Twilio. Twilio updates and renews the encryption methods when they expire. http digest authentication. Twilio supports HTTP Basic and Digest Authentication, which allows customers to password protect their TwiML URLs (which contain usernames and passwords) on their web server so that only they and Twilio can access these URLs. signature validation. Twilio cryptographically signs its HTTP requests with X- Twilio-Signature HTTP headers for outbound requests to customers applications. This signature can be used to validate the authenticity of requests originating from Twilio to their application and protects against spoofing attacks. The request to the customer s web application, which includes any POST fields

4 and the final URL, is signed with the AuthToken as a key and HMAC-SHA1 to ensure the integrity of the capability tokens. role-based access. Twilio has documented policies, procedures and controls to appropriately limit access to customers data to mitigate the risk of insider threats. Access is granted on a least-privilege basis and all requests require management approval prior to access. Twilio access controls are also based on job roles and on a need-to-know basis. Only select Twilio employees, such as staff from Customer Support, Development and Security, have access to customer data. customer data backups. Twilio performs regular backups of Twilio account information, call records, call recordings and other critical data using Amazon S3 cloud storage. All backups are encrypted in transit and at rest using strong industry encryption techniques. Hot data backups ensure that no data is lost in the handoff process and the archival backup process ensures full recovery in the unlikely event that data centers are lost. Backup files are stored redundantly across multiple availability zones and are encrypted by Amazon using AES-256 encryption. Amazon S3 encrypts each object with a unique key, and as an additional safeguard, it encrypts the key itself with a master key that it rotates regularly. Amazon S3 Server Side Encryption uses one of the strongest block ciphers available 256-bit Advanced Encryption Standard (AES-256) to encrypt customer data. A new master key is issued at least monthly. Encrypted data, encryption keys and master keys are stored and secured on separate hosts for multiple layers of protection. secure apps on twilio. Designing an application that works with the Twilio API is no different from designing any other application. Twilio recommends following all standard practices for developing secure web apps, including: Users should access their applications via the Twilio Account Portal using twofactor authentication. More information on enabling two-factor authentication is available here. Apply all relevant security patches to keep software up to date. Twilio highly recommends the use of helper libraries to do signature validation. All official Twilio Helper Libraries ship with a Utilities class, which facilitates request validation. More information can be found here. All AuthToken should be kept secure.

5 Secure Authentication and input validation must be enabled. Twilio offers many resources to assist in the building of efficient and secure apps, including QuickStart Guides, HowTo s and Helper Libraries. Read the blog post: Best Practices For Securing Your Twilio App for more information. NETWORK SECURITY ACROSS GLOBAL CARRIER INTERCONNECTS Twilio implements best practices for protecting the network perimeter between the Twilio Cloud and more than 1,800 carrier connections across the globe. These measures include: network firewalls. Twilio adheres to industry standard practices for securing and maintaining call routers, media gateways and other voice infrastructure, including the use of secure authentication and IP authentication for all VoIP communications. Additional protection is afforded by a Layer 3/4 firewall between all ingress and egress VoIP ports and Twilio telecommunications providers. VoIP traffic is isolated from other types of traffic, including web and HTTP API traffic. denial-of-service (dos) prevention. Twilio implements best practices for preventing DoS attacks, including maintaining redundant DNS servers and following DoS prevention and mitigation practices. As an example, Twilio DoS security controls protect against a runaway account or malicious user who swamps the Twilio API with traffic. As a result, no one customer's bad application code can take down the Twilio API. DoS protection is also part of the Twilio sbc-public deployment. The main action is to block a rogue IP using iptables. By default, an IP address will be blocked for 10 minutes before it is unblocked automatically and s will be sent out. distributed denial-of-service (ddos) prevention. Twilio data centers are hosted at AWS, and AWS uses a variety of proprietary DDoS mitigation techniques to mitigate the risk of attacks. In addition, AWS s networks are multi-homed across a number of providers to achieve Internet access diversity and to ensure network availability. posture assessment. Twilio has a formal antivirus and antimalware policy to guide efforts around mitigating malware and security attacks, which can affect workstations, servers and mobile devices. Antivirus and host-based intrusion

6 detection systems are used to protect all production servers. The resulting reports are regularly monitored and alerts are addressed promptly. PHYSICAL SECURITY ACROSS DISTRIBUTED COMPUTE AND STORAGE Twilio's cloud communications platform is hosted at Amazon Web Services (AWS) data centers, which are highly scalable, secure and reliable. AWS complies with leading security policies and frameworks, including SSAE 16, SOC framework, ISO and PCI DSS Level 1. SSAE 16, or more formally, Statement on Standards for Attestation Engagements No. 16, Reporting on Controls at a Service Organization, replaces SAS 70. It is key guidance for reporting on internal controls for service organizations. SSAE 16 is used for reporting on the Service Organization Control (SOC) framework, which consists of SOC 1, SOC 2 and SOC 3. SOC 1 is focused toward an organization s internal controls over financial reporting, while SOC 2 and SOC 3 cover reporting for the security, availability, processing integrity, confidentiality and privacy for service organizations, including cloud and data center providers. AWS is certified to ISO 27001, which describes a systematic approach to managing sensitive information so that it remains secure. ISO covers a risk management process that encompasses people, processes and IT systems. AWS is also Level 1 compliant under the Payment Card Industry (PCI) Data Security Standard (DSS), enabling customers to run applications on AWS s PCI-compliant infrastructure for storing, processing and transmitting credit card information in the cloud. In addition, AWS physical security measures include: 24x7 surveillance. At each AWS hosting site, the Twilio servers are secured 24x7 by trained security guards, and access is authorized strictly on a least privileged basis. The data centers use state-of-the art electronic surveillance to monitor any suspicious activity. security logs. AWS CloudTrail provides logs of all user activity to the Twilio servers. Twilio employees can monitor and track what actions were performed on each of the Twilio resources and by whom.

7 multi-factor authentication. AWS provides built-in support for multi-factor authentication (MFA) to access Twilio servers. This requires the user to input his or her credentials, a password and a two-factor PIN to protect against unauthorized use of the account. multiple redundancy zones. AWS spans multiple geographic regions and Availability Zones, which allow Twilio servers to remain resilient in the event of most failure modes, including natural disasters or system failures. Environmental systems are designed to minimize the impact of disruptions to customer operations. In addition, each AWS data center has independent power grids, as well as redundant power, HVAC and fire suppression systems. The AWS data centers use state-of-the-art practices for fault tolerance at each level of the system infrastructure, including Internet connectivity, power and cooling. Further details on Amazon Web Services security practices are available here: aws.amazon.com/security/. TRANSPARENT SECURITY OPERATIONS At Twilio, we believe that security practices should be completely transparent to customers, and these measures are outlined below. Twilio has well-defined policies for audit, incident response and privacy. In addition, various internal tests and documented policies can be shared with customers to provide with more visibility into Twilio s security practices. audit policy. Twilio performs third-party penetration tests every six months and regularly scans our systems for security vulnerabilities. All access to production clusters is logged and audited regularly. The production cluster is accessible only to Twilio operational staff and engineers, whose primary responsibility is the construction and maintenance of the Twilio API and services. incident response policy. Twilio maintains an incident reporting policy that defines conditions under which security incidents will be responded to and reported, including levels of severity and risk for various types of vulnerabilities. The Twilio Security Incident Response Team monitors alerts from upstream vendors and is staffed 24x7. The team assesses the threat of all relevant

8 vulnerabilities and establishes remediation actions and timelines for all events. For Severity-1 incidents, Twilio s internal response service-level agreements are less than 5 minutes and customers are sent notifications within 15 minutes. An external-facing, real-time incidence reporting portal is available at status.twilio.com/. privacy policy. Twilio has a formal process for reporting and responding to privacy complaints or privacy incidents. All Twilio employees receive information on these policies during new-hire training and via company-wide distribution after any update is made. The privacy policy is published on the Twilio privacy page as well. Twilio has implemented role-based access such that only support escalation engineers can access customer data and only upon manager approval. COMPLIANCE Twilio complies with key government and industry regulations and policies, including US-EU Safe Harbor and PCI DSS as a merchant. Twilio also supports a variety of use cases employed by companies engaged in HIPAA-covered activities. Safe Harbor Compliance Twilio abides by the US-EU Safe Harbor Framework and the US-Swiss Safe Harbor Framework, as provided by the US Department of Commerce regarding the collection, use and retention of personal information received from European Union member countries and Switzerland. Twilio has certified that it adheres to the Safe Harbor Privacy Principles of notice, choice, onward transfer, security, data integrity, access and enforcement. By complying with Safe Harbor privacy principles, Twilio assures businesses operating in Europe that it takes concrete measures to protect customer data and privacy within the frameworks of local privacy laws, including the EU. Safe Harbor stipulations require that: companies collecting personal data must inform people that the data is being gathered, and tell them what will be done with it; they must obtain permission to pass on the information to a third party; they must allow people access to the data gathered; data integrity and security must be assured; and a means of enforcing compliance must be guaranteed.

9 Without Safe Harbor compliance, all vendors must obtain separate authorization from each EU country when handling consumer data. This process is cumbersome and can lead to significant delays in deploying Twilio solutions in these countries. PCI DSS Compliance Twilio is a PCI DSS 3.0-compliant merchant and can securely accept credit card payments for its services. However, apps built with Twilio are not covered under Twilio's compliant status. Twilio recommends that customers familiarize themselves with the PCI DSS requirements and security assessment procedures. Use of a PCI-DSS-compliant application by itself does not make an entity PCI-DSS-compliant, because the application must be implemented in conformity with the overall Payment Application Data Security Standard (PA-DSS) Implementation Guide. Many businesses have architected their applications in a PCI-compliant manner, while still using Twilio for part(s) of their workflow. The key is to avoid processing, storing and transmitting cardholder data on Twilio. Some techniques that customers have used are as follows: Verifying a customer s account using only the last few digits of the PAN via voice, SMS (short messaging service) or DTMF (dual tone multi-frequency) dialing. Ensuring that the customer application never transmits entire cardholder data over unencrypted channels, including voice, SMS or DTMF. If this is necessary, an online solution or landline implementation should be developed. The PCI rules for VoIP are the same as mentioned above for DTMF. When collecting DTMF via VoIP, the signaling and media transmission must both occur over secured networks (TLS/IPSec and SRTP). Not retaining sensitive authentication data after authorization. For telephone operations, sensitive authentication data means the CAV2/CVC2/CVV2/CID and/or PIN values that may be taken during a telephone call. To read more about Twilio and PCI compliance, check out this FAQ.

10 HIPAA Compliance By law, the HIPAA Privacy Rule applies only to covered entities health plans, healthcare clearinghouses, and certain health care providers. Twilio is not a covered entity, and does not consider itself a business associate. A business associate is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity. At Twilio, many businesses have architected their applications in a manner to be compliant with the HIPAA Privacy and Security Rules, while still using Twilio for part(s) of their workflow. One way to be compliant is to not process, store or transmit individual protected health information (PHI) data on Twilio. Some techniques that customers have used are as follows: Request Inspector should be Disabled. This will disable logging, which may make it difficult to develop applications on Twilio. A workaround is to have a separate development account to debug new code and turn the Request Inspector on for debugging, but at the same time not log any PHI to Twilio. HTTP Auth on Media URLs should be Enabled. This means customers will have to authenticate themselves to get to their recordings. This will send a username and password with every HTTP request to be able to access recordings. However, this may also require updating the source code. Two-factor authentication can be turned on, which will send a text message or make a phone call with a code to enter every time a customer has to log into the account portal, or once every 30 days. Ensure that the customer application never transmits PHI over unencrypted channels, including voice, SMS or DTMF. If this is necessary, an online solution or landline implementation should be developed. The HIPAA rules for VOIP are the same as mentioned above for DTMF. When collecting DTMF via VOIP, the signaling and media transmission must both occur over secured networks (TLS/IPSec and SRTP). For more information, please visit the Twilio website:

11 Twilio recommends that customers familiarize themselves with the HIPAA requirements and security assessment procedures. Please note that the list above is not meant to be comprehensive or replace the official HIPAA standards and guidelines. Customers will need to ensure that their applications meet those guidelines. As always, Twilio recommends that customers seek guidance from their legal counsel if they have any compliance questions concerning their applications. To read more about Twilio and HIPAA compliance, check out this FAQ. SUMMARY Twilio cloud communications enable businesses to deliver superior customer experiences by easily incorporating voice, messaging and other communications into their customer-facing applications. Security mechanisms to protect physical, network and application components of the platform, coupled with transparency about security practices and compliance best practices, give customers the confidence they need to move communications to the cloud. For further details and steps to secure your Twilio-powered application, check out the Docs section on Twilio s website. Copyright 2014 Twilio. All rights reserved. Patends Pending. Twilio, TwiML, and OpenVBX are tradmarks of Twilio, Inc.