12.1 Operational procedures and responsibilities
Objective : To ensure correct and secure operations of information processing facilities
12.1.1 Documented operating procedures
The Service is SaaS service.
No kind of operating procedure is to be performed by the Client.
365Talents combines two approaches regarding operating procedures :
- Whenever it is possible, operations are automatized through the use of different tools ("DevOps" methodology). In particular, 365Talents uses an Infrastructure-as-Code approach to automatize the installation and configuration of systems supporting the Service; there is no manual installation or configuration of the systems. In this case, procedures are formalized as code in these tools.
- Otherwise, 365Talents formalizes manual operating procedures in an internal tool.
Automated procedures include, but not limited to, :
- Installation and configuration of systems in development, pre-production or production environments
- Deployment of new releases of the Service in development, pre-production or production environments
- Scheduled Backups creation
- Backup restoration
- Synchronization of a tenant
Manual procedures include, but not limited to, :
- Manual creation of a backup
- Generation of API Keys for External DNS
- ...
In the case of migration to new technologies (e.g. a new mySQL version, from VM to K8S, ...) dedicated procedures are formalized for manual tasks and formalized as code for automated tasks.
Interdependencies between systems are managed through an orchestrator that schedules different jobs accordingly to defined interdependencies.
All job executions (installation/configuration of systems, deployments of new releases of the Service, backups, ...) are monitored through a dedicated monitoring platform and an alert feed that are reviewed several times per day.
12.1.2 Change management
*The Service is SaaS service.
Deployment are performed without any service interruption and without additional cost. No update procedure is to be performed by the Client.
In case of planned maintenance that would require to stop (part of) the Service for significant changes on the infrastructure underlying the Service (e.g. "migrating to a whole new database engine"), they are performed outside working hours and working days (See our SLA for more information).
Change management is managed internally as follows :
- Significant changes are identified and recorded as "Architecture decision records" in an internal tool.
- All changes are discussed and agreed during daily "StandUp" held by each team responsible for the change (either changes of the Service by itself by development teams or changes in the Infrastructure underlying the service by DevOps team)
- All changes are planned and tested in pre-prod environment before being deployed in prod environment.
- Changes to the Service are automatically deployed each week, first in pre-production for test purposes, then a few days later in production environment. All deployments (pre-prod and prod) are monitored through an automated event system providing full traceability of actions and status.
- Breaking changes to the infrastructure underlying the Service are deployed outside working hours to avoid impacting the users.
- When applicable, customized infrastructure configurations for each Client of the Service are centralized in a versioning management system and used by automated deployment tools and procedures. Application settings are not part of this versioning management system, changes to these settings are traced through audit logs.
- Change details are communicated to all relevant persons through internal communication channels.
- Emergency change process is covered by the Incident management process
12.1.3 Capacity Management
The hosting Provider provides performance monitoring tools of the used infrastructure underlying the Service.
365Talents monitors health and performance of the Service through software probes.
365Talents monitors scheduled backups of the Service : completion of the backup and replication process.
365Talents has deployed an automated alerts service. In case of detected problems on the Service, technical team of 365Talents automatically receives notifications through e-mail and instant messages.
365Talents manage capacity planning based on the number of user licenses sold to the Client.
12.1.4 Separation of development, testing and operational environments
365Talents have deployed 4 separated environments :
- A development environment. Each developper has its own environment.
- Pre-production environments, dedicated to each Client of the Service
- A production environment, dedicated to each Client of the Service
- An administration environment, dedicated to infrastructure and service administration functions.
Rules for the transfer of data between environment are defined :
- Data is automatically anonymized when transferred from production environment to any other environment
- Changes in code are peer-reviewed before being commit to be pushed to pre-prod environment.
- Changes are tested in pre-production environment before being pushed to production environment.
Development tools are not accessible from production operational systems.
12.2 Protection from malware
Objective : To ensure that information and information processing facilities are protected against malware
12.2.1 Controls against malware
The internet-facing Application Gateway implements an anti-malware solution that scans all files uploaded in the Service by the Users or Administrators of the Clients before being accepted and treated.
Servers are monitored by real-time threat and abnormal behavior detection software. In addition, deployed images are regularly scanned for malware.
All laptops used by 365Talents have an automatically updated anti-malware solution, native to the MacOS operating system, which automatically scans all accessed files. It cannot be deactivated by users.
Users must install operating system security updates whenever they become available.
A security watch is carried out to gather information on new malware and inform 365Talents employees and subcontractors.
12.3 Backup
Objective : To protect against loss of data
12.3.1 Information Backup
Backup of all data hosted in the pre-production and production environment are performed.
The backups are performed as follow :
- Frequency : every 4hours
- Retention duration : 600 simultaneous backups (100 days)
- Content : full database and the associated resources (as pictures or additional files)
- Monitoring of the proper execution of the backups procedures, automatic alerting of the technical team of 365Talents in case of error.
Backup are stored as follow :
- On a virtual disk, replicated three times by the hosting Provider
- On a remote storage system managed by the hosting Provider (Blob Storage), replicated three times and isolated from the production infrastructure.
Backups are encrypted as described in this page. Broken link
Restoration tests are performed annually during the BCP/DRP test. Backup of the tenants are tested regularly as they are used to synchronize tenants.
12.4 Logging and monitoring
Objective : To record events and generate evidence
12.4.1 Event logging
Events on the Service are logged :
- All the actions performed by the Users or Administrators of the Service are logged.
Events on the Infrastructure of the Service :
- All the actions performed on the infrastructures underlying the Service are logged without condition or duration limitation.
- Logs of the connections on the infrastructure of 365Talents underlying the Service are kept for 1 year.
- All bans following repeated failed SSH login attempts on the servers of the Service are logged with a timestamp and source IP address.
- All the requests blocked by the Web Application Firewall (WAF) are recorded. Information recorded include : timestamp, unique ID, full content of the request, source IP address, destination IP address, reject rule triggered. Requests blocked by our WAF generate alerts which are reviewed daily by the CISO, who then analyzes the traces to qualify the alert.
- Logs generated on our Kubernetes clusters are automatically analyzed by a dedicated IDS tool, which issues alerts in case of suspicious events. These alerts are reviewed at least once a day by the CISO.
- API accesses to the service and authentication failures are logged. API behavior is monitored.
- Other traces are reviewed ad hoc when necessary.
Logged events are centralized in a log management system that allow automated monitoring to generate reports and alerts, including on security-related matters.
To date, 365Talents has no mechanisms for standardized and/or automatic transmission of traces to its customers.
12.4.2 Protection of log information
Logs information of the Service cannot be altered by the Users or the Administrators of the Clients of the Service.
Log files of the Service cannot be edited or deleted by the Users or the Administrators of the Clients of the Service.
Log files of the Service can only be accessed by authorized members of the technical team of 365Talents.
Audit logs are activated on all employee workstations, cannot be deactivated, and can only be read and modified by administrators.
12.4.3 Administrator and operator logs
Logs information of the Service cannot be altered by the Administrators of the Clients of the Service.
Log files of the Service cannot be edited or deleted by the Administrators of the Clients of the Service.
12.4.4 Clock synchronisation
Logs information of the Service are timestamped based on a synchronized clock.
12.5 Control of operational software
Objective : To ensure integrity of operational systems
12.5.1 Installation of software on operational systems
The updating of the operational software, applications and program librairies is exclusively performed by automated procedures managed by the administrators of the infrastructure and/or manually by the administrators of the infrastructure.
Operational systems only hold approved executable code. Compilers are not used on operational systems.
Applications and operating system software are implemented only after successful testing. Tests performed on non-production environments.
A configuration control system with versioning is used to keep control of all implemented softwares and used to support automated procedures of deployment and updates.
Software patches are applied when they can help to remove or reduce information security weakness (see 12.6 Technical vulnerability management).
12.6 Technical vulnerability management
Objective : To prevent exploitation of technical vulnerabilities
12.6.1 Management of technical vulnerabilities
An inventory of assets is in place and maintained up-to-date to support technical vulnerability management and includes, when applicable, software vendor, version numbers and the person(s) within 365Talents responsible of the software.
365Talents has defined and established roles and responsibilities associated with vulnerability management including vulnerability monitoring, vulnerability risk assessment and patching.
A timeline is defined to react to notifications of potentially relevant technical vulnerabilities impacting the Service (see below). For other vulnerabilities, a timeline is agreed after security impact assessment by Security team and operational assessment by Operational team.
Actions to be taken are defined after impact assessment by Security team and operational assessment by Operational team. In case of immediate risk, the actions to be taken can be carried out by following the information security incident response procedures.
Whenever possible, patches are tested before they are installed.
When patch aren't available or cannot be installed, workaround or mitigation measures are evaluated and implemented, depending of the nature of the vulnerability, to reduce the impact and/or the likelihood of the exploitation of the vulnerability.
365Talents subscribe to different sources of information regarding IT security, including but not limited to, the CERT-FR, the vendors of the software used by the Service as well as renowned IT security professionals. These information feeds are automatically aggregated and fed into an internal communication tools. 365Talents technical team review these aggregated information at least once a day.
In addition, 365Talents performs regular scans of deployed images/containers to check for vulnerable components.
An external scan based on the service URL is also performed quarterly.
In the case of security vulnerabilities identified and qualified as applicable by 365Talents in the application components used (e.g. libraries/dependencies, OS), deployment times for corrected versions are as follows:
- 7 working days for a critical vulnerability (CVSS >9)
- 20 working days for a High vulnerability (CVSS > 7)
- 60 working days for a Medium vulnerability (CVSS >4)
- 120 working days for a Low vulnerability (CVSS <4)
12.6.2 Restrictions on software installation
Employees of 365Talents are made aware of their responsibilities and good security practices when installing software to their laptops.
12.7 Information systems audit considerations
Objective : To minimize the impact of audit activities on operational systems
12.7.1 Information systems audit controls
365Talents is regularly subject to technical audits or penetration tests (later simply referred to as "Audit" in this chapter) required by its Clients. These audits are planned and performed in agreed conditions (see below) to minimize disruptions to business processes.
In the same way, when 365Talents performs (internally or through a third party) an audit of (part of) its information system, these audits are planned and performed in the same agreed conditions to minimize disruptions to business processes.
Audits can be performed at any moment, in the conditions specified in the agreement between the Client and 365Talents, as long as the agreement remains valid.
A protocol defining the condition of the Audit should be agreed beforehand between the Client, the provider chosen by the Client to perform the Audit if any, and 365Talents. The protocol should at least, but not limited to, contains :
- the exhaustive list of the auditors,
- the scope, the period and the duration of the audit
- the source IP addresses from which the auditors will perform the audit if relevant,
- the limitations on the actions that the auditors are allowed to perform (e.g. not backdoor installation, no DoS, no loss of availability or integrity of the systems,...)
A 20 days notice period before an Audit is required in order to notice the hosting Provider of 365Talents that such Audit will be performed on their infrastructure.
The following elements will be provided by 365Talents to the auditors :
- an isolated audit environment, iso-production
- a test data set
- test user accounts on the service with varied access rights and roles (standard user, manager, Human resources, ...).