Tämä dokumentti toimitetaan vain englanninkielisenä.
Security Overview
CRM-service Oy recognizes that the confidentiality, availability and integrity of our customers’ information are vital to their business operations. We use a multi-level security approach to protect key information, constantly monitoring and improving our application, systems and processes to meet the growing demands and challenges of security. This document outlines some of the mechanisms and processes we have implemented to help ensure, that your data is protected. Our security practices are grouped in five different areas: Physical Security, Network Security, People Processes, Software Security and Redundancy and Business Continuity.
Secure data centers
Our services are located in top-tier data centers in Finland (see the Data Center Overview document).
All of CRM-service products are hosted in our own server and network infrastructure. The infrastructure for databases and application servers is managed and maintained only by CRM-service employees.
Physical Security
- Concrete walled data center premises.
- Computing equipment in access controlled steel cages.
- Video surveillance throughout the facility and perimeter.
- Automatic anti-burglary alarm systems.
- Data centers engineered for local seismic, storm, and flood risks.
- 24.7.365 security, including foot patrols and perimeter inspections.
- Access control system with triple electrical door access.
People Processes
Designing and running the data center infrastructure includes the latest technology, policies about escalation, management, knowledge sharing, risks, as well as the day-to-day operations. The CRM-service’s security team has years of experience in designing and operating data centers and continually improves our processes over time.
- Selected Employees. Only employees with the highest clearance have access to our data center data. The employee access is logged and the passwords are strictly regulated. We limit the access to customer data to only a selected few of these employees, who need such access to provide support and troubleshooting on our customers’ behalf.
- Audits. Audits are regularly performed and the whole process is monitored by management.
- As-Needed Basis. Accessing data center information as well as the customer data is done only an as-needed basis, and only when approved by the customer (e.g. as part of a support incident) or by senior security management to provide support and maintenance.
Identity and Access Management (IAM)
The CRM-service IAM enables that the right individuals can access the right resources at the right time. For security reasons, CRM-service restricts SSO and Application Access only to a few known external apps like Microsoft Exchange, Microsoft Outlook, Microsoft AD and Google Calendar.
- Access to CRM data. In CRM-service system the user permissions to CRM-service data content is defined through user profiles and roles. The profiles and roles can define entity-level read/write access to CRM-service data (read more here). All CRM-service user actions are stored to audit trail logs and these can be examined afterwards by the CRM-service admin users.
- CRM-service AD Identity Connect synchronizes users and their attributes from Active Directory (AD) to CRM-service. When a user is created in AD, that same user account can also be created automatically to CRM-service. When a user is deleted from AD, the user account in CRM-service is deactivated at the same time.
- Integration between CRM-service and a third-party application is done using the CRM-service web service layers. Secure access is handled by using secure API keys and API key level permissions to different web service methods. API keys and permissions are managed by the CRM-service admin users.
- CRM-service as an Identity Provider. CRM-service web service layer can provide contact access permissions to a third-party application. Contact access can be managed in the CRM-service admin user settings and also different user profiles can be created. This can be used in e.g. external portals, like a self-service portal of the end customer, to enable the access to wanted data content and features in CRM.
- IP Permission control. Access to CRM-service can be restricted to defined IP addresses, IP address range or IP subnet. Restrictions can be created for selected user types: Normal, Normal+Admin and Webservice. Restrictions can also have a start and end dates.
Redundancy and Business Continuity
- Environmental control redundancy. Data center premises are equipped with humidity and temperature control systems. The cooling systems are redundant (N+1).
- Power redundancy. CRM-service configures its servers for power redundancy – from power supply to power delivery. We use underground utility power feed and redundant (N+1) UPS systems. The power distribution units and diesel generators (N+1) are also redundant.
- Internet redundancy. High-speed connections to the outside world have a key role in a server room devices. We ensure the data connections by using several operator independent networks.
- Redundant network devices. We use redundant internal networks with redundant network devices. The networks are built based on cross-connected 10Gbps switches.
- Fire detection and suppression. Data centers are equipped with duplicated fire alarms and automatic fire gas extinguishing systems. All structures are fire resistant.
- Data protection and backups. All data is backed up daily to another data center premise and kept safe for 30 days. The data is transmitted across encrypted links.
Secure system usage and sessions
- Connection to the CRM-service environment happens via TSL cryptographic protocols.
- Individual user sessions are identified and re-verified with each transaction, using a unique token.
- Brute force protection features can be enabled on administrator settings. An IP address can be banned after recurring failed login attempts.
- Password Expiration period (1-6 months) and minimum password length can be enabled on administrator settings.
- Session time out time (minutes) can be enabled on administrator settings.
Network Security
- Perimeter firewalls block unused protocols.
- Internal firewalls segregate traffic between the application and the database tiers.
- Intrusion detection detects and alerts on security events.
- A third-party service provider continuously scans the network externally and alerts on changes.
Cloud Service production
- All servers and networks run on redundant environments.
- Services are on VMware based server.
- Enterprise level SAN SSD disk systems.
Software Security
- Our security persons monitor notifications from various sources and alerts from internal systems to identify and manage threats.
- We follow OWASP (www.owasp.org) recommendations.
- The system is protected against unauthorized access.