Hosted Exchange. Security Overview. Learn More: Call us at

Transcription

1 Security Overview Learn More: Call us at

2 Secure and Reliable Hosted Exchange Our Hosted Exchange service is delivered across an advanced network infrastructure, built on best-in-class hardware and software housed in data centers that are Tier IV, SSAE 16 SOC 1 Type II certified, geographically dispersed, and interconnected to ensure the highest level of availability and reliability. Clustering and redundancy across data centers guarantee data protection. In this document, we outline the security policies and procedures for our service by topic: - General Security - Network and Integration - Data Backup and Restoration/Disaster Recovery - Risk Management Security Overview: Hosted Exchange 2

3 General Security Data center physical security controls Our Hosted Exchange environment is housed in third-party Tier IV, SSAE 16 SOC 1 Type II certified, geographically dispersed, and interconnected data centers. Physical access is limited only to authorized personnel. There are biometric and physical controls (locks) in place as well as physical security 24/7/365. Administrative security controls Network access is restricted to authorized personnel with server administrative privileges only. Public-facing access is limited to the network ports/protocols that are required for the services they are responsible for only, controlled and managed by the firewall tier that sits between them and the internet. Each network level (i.e., corporate, production, development) is segmented from others and requires permissions and individual credentials for those employees. Password length, expiration and other related security access policies are in place and enforced following industry standard best practices. Security auditing All security policies and procedures are reviewed annually by a Security Review Board to ensure that they are up to date with current industry best practices and regulations. Standard operating procedures for the creation and administration of user accounts Requests for system administrative access are submitted by a member of management (at least manager level position) and reviewed by Operations management for approval. The request must clearly state the employment status, position, and reason for the request to be fulfilled before the request is reviewed. Standard operating procedure for security regarding new hires and termination of employees New hires are issued building access cards and if applicable access cards or credentials for data centers. New hires sign documents acknowledging their acceptance of the building access cards and understanding of usage. When an employee terminates, the building access card is disabled along with any data center/external access cards and each employee is physically escorted from the premises. Standard operating procedure for allowing authorized customer representatives and/ or agents access to the data center facility Customer representatives or agents wishing to tour the data center facilities must coordinate their visit with a member of Operations management at least 48 hours in advance so that proper security clearance can be arranged. Upon management approval, arrangements will be made for temporary access. The representative(s) will meet an authorized employee at the time and place agreed upon and will be escorted into the facility (and will be escorted personally for the remainder of the visit). Security Overview: Hosted Exchange 3

4 Standard operating procedure for allowing authorized customer representatives and/ or agents remote access to the computing facilities Remote network access is only granted via a secure VPN solution upon request and subject to approval by Operations management and the Network Security team. This access is limited to dedicated equipment for the customer and only on network ports previously defined and agreed upon for the services purchased. Controls and procedures that restrict the transportation of media and/or assets into or out of data center facilities Any data that is replicated or backed up to tape is stored offsite in a secure, accredited facility for purposes of disaster recovery. The media is handled only by an employee or that of the aforementioned vendor. Standard operating procedure for incident response, notification, and escalation process for outages caused by operational or malicious activity An Incident Response policy document details how communications relating to incidents and outages are shared internally and externally to customers and which departments are responsible for each. In short, a post mortem analysis is performed by the Operations staff. Once root cause, mitigation, and next steps (to prevent a recurrence of the incident) have been determined, reviewed, and recorded, the information is passed to (at least) the Customer Support organization for review and communication to the customer(s) impacted. Standard operating procedure regarding notification of inappropriate access If inappropriate access has occurred, the customer will be notified and will be provided with any report required. Controls to prevent unauthorized access to tenant applications, programs, or object source code Network access is restricted to authorized personnel with server administrative privileges only. Public facing access is limited to the network ports/protocols that are required for the services they are responsible for only, controlled and managed by the firewall tier that sits between them and the internet. Each network level (i.e., corporate, production, development) is segmented from others and each requires permissions and individual credentials for employees that require access. Password length, expiration and other related security access policies are established and enforced based on industry standard best practices Security standard compliance Safe Harbor certified, SSAE 16 SOC 1 Type II certified, and HIPAA compliant. Employee background verification Pursuant to local laws, regulations, ethics, and contractual constraints, all prospective candidates are required to complete a background screening administered through a third party. Audit reporting The results of internal and external audits are available to customers by request. Security Overview: Hosted Exchange 4

5 Network and Integration Active Directory integration and management For customers that have subscribed to our Active Directory (AD) Management service, MegaPath allows for a one-way, secure synchronization from the local AD to the hosted AD. This utility synchronizes users, groups, contacts, and passwords. Customer security risk mitigation Numerous security and access control systems are used to protect customer data and services. These systems include network access and controls, as well as data encryption, authentication, and directory-level control. We follow Microsoft best practices to implement hotfixes and service packs to ensure security. Spam, virus, and malware protection All hosted mailboxes include Anti-Virus/Anti-Spam and Content Control. This solution scans all to prevent spam and virus messages from being sent to/from customer personnel. Mail that is suspected spam is saved in a quarantine file, and a spam notification is ed to the users nightly. Content control features protect sensitive data from leaving the customer s network by filtering and blocking messages based on rules configured by the customer Administrator. Encryption capabilities including the support of transport layer security All mail is sent via Opportunistic TLS, but Enforced TLS can be configured as needed. We offer full encryption services whether directly from the client (Outlook plugin) or via an encryption gateway that filters all mail from the organization against self-configured rules. Should the message meet the filter, the mail will be sent encrypted. Secure data storage Mail encrypted via the Outlook plugin is encrypted from the client and is stored on the servers encrypted. Secure data segregation We follow Microsoft best practices for secure multi-tenant data segregation within Exchange using ABP. Security Overview: Hosted Exchange 5

6 Data Backup and Restoration/Disaster Recovery Data backup and disaster recovery Current backups and data protection are accomplished with Microsoft Exchange native DAG replication and dumpster/item recovery. Data is fully replicated within our primary data center and in real-time to a secondary data center, which is accessible via hot standby for continuity and disaster recovery. Data is maintained for a 30-day period. We have an established and practiced Disaster Recovery procedure, in accordance with SOC2 compliance. restoration Single items are recovered either from the dumpster or a mailbox in the 30- day window using documented procedures. All user files that are accidentally deleted can be obtained in the deleted items folder for a period of 14 days. If the item is older than 14 days, for an additional fee, we can provide the deleted by accessing the 30- day rotating disc backup at the data center. For an additional fee, we can restore a full mailbox, several folders, etc., from these backups. In addition, mailboxes are kept for 30 days post deletion. Backup and recovery frequency Backups occur weekly as customer demand dictates. Recovery/failover procedures are executed quarterly as we failover Exchange databases for non-disruptive system maintenance. Off-site storage Offsite storage is a function of the disk-to-disk replication from our primary data center to our secondary facility. Standard operating procedure for destruction of defective backup media Any media used for backup purposes that is identified as corrupt or defective is disposed of (wiped, degaussed, and destroyed) by an accredited thirdparty vendor. Standard operating procedure for notification of the status of backup and/or recovery processes The process comprises application monitoring and event notification/ response by NOC staff which is backed by Systems Administrators as needed. Risk Management Security Overview: Hosted Exchange 6

7 Standard operating procedure regarding risk mitigation We take the reduction of risk very seriously and are confident in our risk mitigation strategies as well as our ability to safeguard our customers investment. Our Hosted Exchange service is delivered across an advanced network infrastructure, built upon best-in-class hardware and software housed in Tier IV, SSAE 16 SOC 1 Type II certified, geographically dispersed, and interconnected data centers to ensure the highest level of availability and reliability regardless of climatic or geographic incidents. Clustering and redundancy across data centers guarantees data protection. Ability to meet geographic/legal requirements Our data centers are located and customers data is stored in the U.S., allowing customers to meet HIPAA and FSMA requirements provided the client institutes proper security and confidentiality standards in their normal course of business. Security Overview: Hosted Exchange 7