13.1 Network security management
Objective : To ensure the protection of information in networks and its supporting information processing facilities
13.1.1 Network controls
All data transfers between the browser of a Client's User and the Service are performed over the Internet network and relies on HTTPs security mechanisms (see 10 - Cryptography). When entering 365Talents' infrastructure, all HTTP requests are filtered by a Web Application Firewall (WAF) in front of the all the web applications and based on following criteria (non-exhaustive list) :
- no violation of HTTP protocol
- HTTP Flooding and Slow HTTP DoS attacks (anti-DDoS HTTP)
- reject access to robots, trojan and scanners,
- reject of attacks Cross-Site Scripting (XSS)
- reject attacks by SQL injection
- reject of attacks Directory Transversal
- reject potential leakage of technical information
The infrastructure underlying the Service are protected by a Firewall operated the infrastructure Provider. Connection to the infrastructure are restricted via the mandatory use of a encrypted VPN connection. VPN connection is restricted to authorize people.
The Service is protected by a Firewall that only authorizes inbound connection on ports 80 (HTTP), 443 (HTTPs), all other inbound connections are rejected. Filtering rules are configured on whitelist mode with a "Deny-All" rule systematically enforced at the bottom of the list.
Databases and search engines reject all connections originating from outside the infrastructure of 365Talents.
13.1.2 Security of network services
Security of the network services in the infrastructure underlying the Service is guaranteed by the infrastructure Provider for the part it is responsible of, notably via an access restriction enforced by the infrastructure Provider's firewall.
The security of network services is included in network services agreement with the infrastructure provider :
- Availability of the network
- Security of the network filtering equipment and VPN termination point
In addition, network segregation and filtering inside the infrastructure is implemented and managed by 365Talents.
Access to these networks by 365Talents' employees require the use of a VPN, no direct access is allowed. Technical parameters required for secured connection with VPN termination point are managed by 365Talents, including access restriction.
13.1.3 Segregation in networks
Development, pre-production and production environment networks are segregated between them and with the LAN network used by 365Talents' employees.
The network in the infrastructure is divided in several subnets. The perimeter of each subnet is well defined and is based on the environment (production, preproduction, development) and the purpose (Gateway, AKS, administration, Data base, ..).
13.2 Information transfer
Objective : To maintain the security of information transferred within an organization and with external entity
13.2.1 Information transfer policies and procedures
All the information transfers between the Users of the Clients and the Service are performed through secured means.
For the usage of the Service, HTTPs is systematically enforced. Data transferred are protected by encryption (see 10-Cryptography for more details on HTTPs usage and encryption).
All data transfers to feed the Service (Users base, Skills base, ... of the Clients) are performed through access controlled and encrypted means (See 10 - Cryptography) :
- Dedicated sFTP by Client
- API transfer over HTTPs
Data of different Clients are never mixed in the same channel.
Files transferred through the Service (e.g. resume) are analyzed by an anti-malware solution before any treatment (See 12.2).
Employees and contractors of 365Talents are advised about the appropriate precautions to take when transferring confidential data, in particular personal data, from or to the Clients. Same precautions are expected in case of data transfer with third-parties. A secure file-sharing solution is deployed to fill that purpose.
13.2.2 Agreements on information transfer
365Talents doesn't host or copy data of the Service related to the Clients off-site.
Information transfer related to the Service (such as Users information, Skills referential, ...) between the Clients and 365Talents are always performed accordingly to agreed means, notably sFTP and/or API transfer over HTTPs (See 10 - Cryptography). 365Talents never performs transfer of such information by E-mail or other insecure mean.
365Talents has contractual agreements with its providers and partners (e.g. Mailjet) that address the secure transfer of information and responsibilities and liabilities in the event of information security incidents, such as data loss or leakage. Information transfers with third-parties are always performed with encryption mechanisms compliant with 365Talents policy. Access control is performed before any information transfer to third-parties through usage of public/private keys or API Key. More detail can be found here on providers, here on data treatment by providers (chapter Engagements des sous-traitants) and here on data connectors.
13.2.3 Electronic messaging
All the e-mails sent by and for the Service have an originating domain in @365talents.com except if instructed otherwise by and for a specific Client.
The mail domain @365talents.com is protected against impersonation by SPF+DKIM+DMARC.
It is forbidden to share data of the Service (such as User base, Skills referential, ...) through e-mail, instant messaging & social networks either internally of 365Talents or externally.
More information on how e-mails are sent can be found here.
13.2.4 Confidentiality or non-disclosure agreements
365Talents have a confidentiality or non-disclosure agreement, through application of general terms and conditions, with :
- Its infrastructure provider (Version of January 2023 available here)
- Its e-mailing provider (available here)
Dedicated information regarding confidentiality agreements can be found here.