Advanced SaaS Security Measures

(1)

White Paper

Advanced

SaaS

Security

Measures

Overview

of

BlueTie

Security

(2)

Rochester, NY 14623 USA (800) BLUE TIE www.bluetie.com

Abstract

The unique ability for SaaS companies to deliver more data, to more places via more

access methods has had a profound impact on the ability for businesses to

communicate, collaborate, and achieve tasks. Businesses can now access data that once

resided solely behind the corporate firewall and required users to be physically at the

office or accessing systems through complex VPN systems. As the computing landscape

evolves, companies are leveraging this evolution to expose more access methods to

data and are entrusting the services of SaaS providers to provide this gateway.

Companies are demanding access to data in ways never before imagined, while enlisting

providers to maintain the highest of security measures to protect their sensitive data.

SaaS companies are tasked with the responsibility of not only protecting data as it

moves into and out of various web‐based accessible systems, but are also charged with

protecting that data throughout its life in the cloud. Security threats today range from

simplistic credential breaches, to more sophisticated application, profiling, abuse,

hacking and denial‐of‐service attacks.

This paper focuses on the security measures that allow BlueTie to provide secure

environment for your confidential data. BlueTie’s multi‐layered and multi‐faceted

approach to security is designed to not only protect your data in transit, but to protect it

while at rest in the cloud.

Background:

BlueTie

Business

Email

BlueTie is an industry leading SaaS based Business Email service which provides web‐

based services to thousands of businesses and millions of users worldwide. Our

infrastructure processes several billion email messages per month, systematically

monitoring for, detecting and managing email based security threats for our end users.

Our products and services are designed to eliminate the hassles, cost and management

overhead associated with internal IT Departments by leveraging BlueTie’s expertise in

the communication and collaboration industry. Our team consists of highly skilled

messaging experts working in conjunction with several of the world’s leading providers

(4)

The

Problem

The compromise of data could mean the loss of trust and reputation for your business

by your current and future customers. It could mean the loss of trade secrets, identity

theft, or even worse, the downfall of an entire business. Security threats have moved

from what were primarily network based attacks to sophisticated website and

application vulnerability profiling and eventual exploitation of those vulnerabilities.

Worse yet underground communities and massive botnets are being utilized to launch

large scale denial‐of‐service attacks against providers, crippling infrastructure for hours

and even weeks, leaving customers unable to access data.

No single solution exists today to identify, prevent or mitigate these security issues.

Instead providers of cloud based services must rely on a multi‐faceted approach to

security for both the physical and logical architectures of the solution provided to end

users. Technology can assist in the prevention of these attacks, however, the rigidity of

policies and procedures are often the most critical pieces to security.

The

BlueTie

Cloud

BlueTie’s cloud is operated out of several facilities in the United States. Here a high

performance network infrastructure connects BlueTie to the Internet and its end users.

These facilities provide the framework for BlueTie’s physical security which is considered

equally if not more important than network and system security policies.

Physical Security

Physical security consists of the measures in place to protect direct, physical access to

the power, HVAC, network and server infrastructure that operate web based

applications. Each facility selected to operate a portion of BlueTie’s cloud must undergo

stringent analysis for the presence, implementation and ongoing administration of

physical security infrastructure. BlueTie only operates its cloud infrastructure in

facilities which have been audited by industry leading firms for SAS70‐Type II

compliance. As such, each facility has demonstrated control and accounting measures

in place for physical security and maintains strict security policies and practices.

(5)

The physical location and design of these facilities assist in the prevention and

mitigation of both natural and man‐made assaults. Facilities have been selected based

on natural disaster scenario risk assessment, as well as flood plain screening and

evaluation. To further enhance the security of the infrastructure, no identifiable

markings, or signage is visible from the exterior. All power and cooling systems are

secured behind gated fences and are limited to authorized personnel. Each facility is

equipped with solid‐block exterior perimeters and ramming bollards to mitigate

potential damage to the infrastructure from exterior sources.

Security personnel control access to and from, including the monitoring of individuals

within the facilities. Access to our facilities is limited to specific individuals for the

purposes of maintaining and managing the infrastructure. Under no circumstances are

unauthorized individuals granted privileges to enter.

Portions of BlueTie’s data centers utilize state‐of‐the‐art biometric scanning equipment

for access to highly sensitive and restricted areas. These systems permit only authorized

individuals into these areas, and log and report all access for historical reference and

review purposes. BlueTie’s facilities operate high‐resolution, continuous surveillance

security cameras which monitor the movement of individuals throughout the facilities.

These cameras are monitored by security personnel and also record all feeds to DVR

systems which are maintained for historical reference and review purposes. BlueTie’s

physical infrastructure equipment is always segregated from the collocation population

with security cages. These cages require physical key access which is only provided to

individuals authorized to access these areas. Inside each caged area, several

surveillance cameras monitor the activity and actions within.

Network Security

Network security consists of the measures in place to protect network based access

including unauthorized access to network or system infrastructure, abuse of resources

and or denial‐of‐service attacks. The nature of the web has pushed network security

further from just the perimeter of the infrastructure physically running and storing data.

Network security now starts at the DNS layer. DNS serves as the telephone directory of

the internet. This directory is the first place a client browser looks when accessing a

site. As such, this infrastructure must be heavily protected and extremely robust in

order to service browser requests. Denial‐of‐service attacks at the DNS layer are

(6)

BlueTie has partnered with an industry leading DNS provider to handle the processing of

these requests and the security surrounding this infrastructure.

The DNS platform is currently deployed on top of a global IP network, consisting of 12

facilities and connectivity from a variety of Tier‐1 Internet Service Providers. The DNS

platform operates on two diverse Anycast constellations which provide active‐active

failover between constellations and global traffic distribution between data centers.

This global distribution and massively scalable connectivity to the DNS infrastructure

guards against denial‐of‐service attacks.

BlueTie’s perimeter is secured utilizing industry‐leading firewall technology from Juniper

Networks. To protect against network‐level attacks, these systems analyze all incoming

and outgoing transmissions using a dynamic packet filtering method known as stateful

inspection. Various information is collected from incoming transmissions and analyzed

against the responding transmissions to ensure the communication streams match. This

analysis is done under the context of a connection and not as a collection of various

packets, which provides security at the packet level rather than the connection level.

Unmatched transmissions are considered malicious and are dropped. The firewall

systems continuously monitor and report these security incidents to our NOC. In

addition to alerts, for which BlueTie may take action, all security history is logged for

historical tracking and reference purposes.

BlueTie’s internal network infrastructure is segmented into VLANs. Each VLAN limits the

access and communication between systems through a series of ACLs (Access Control

Lists) allowing granular control of the communication between VLANs. Sensitive

systems are placed into VLANs in which only authorized systems may communicate with

them, further enhancing the security of BlueTie’s network.

Customers are also permitted to access BlueTie’s web‐based, mobile and desktop client

solutions via standard security protocols including 2048‐Bit SSL and TLS. An optional

parameter set by the user, or enforced by the administrator of the Customer’s account

ensures all communication transmitted to and from BlueTie remains secure at all times.

In accordance with BlueTie’s Security Policies, BlueTie employs granular access controls

for administration which provide separation of duties with regards to system

(7)

System Security

BlueTie operates primarily on the Linux® Operating System. Each system deployed for

use in our production facilities is imaged to contain only the necessary software

required to operate the BlueTie platform. This practice, known as host‐hardening,

reduces the likelihood of host‐exploits by limiting the software, processes and open

ports enabled on each system. Periodically, these systems undergo an evaluation of

software, patches and recommended updates to ensure proper function and to patch

any security threats.

Access to these processing systems a limited by BlueTie’s Security Policies and is granted

only to those which require it for purposes of administration and maintenance of the

system.

Data Storage

User data is stored in a finite number of systems within the BlueTie cloud. User email

data is organized in a hierarchal fashion which tiers and separates data into logical

partitions across an array of storage systems. Other information, such as contacts,

calendar and tasks data are stored in a similar format inside enterprise class databases.

To ensure the utmost security as it relates to customer account and credit card

information, data is stored in enterprise‐grade databases utilizing an encryption

algorithm that stores card data. This data can only be unencrypted by BlueTie’s billing

systems which are not located in any publically accessible facilities and do not have

access to the internet.

Access to these storage systems is limited by BlueTie’s Security Policies and is granted

only to those which required it for purposes of administration and maintenance of the

system. BlueTie’s finance and billing department maintains sole control of decryption

keys for customer credit card data. These keys are not accessible to any other staff

within BlueTie.

Availability

and

Disaster

Recovery

Availability and disaster recovery are an important consideration when selecting a SaaS

provider. Extended outages, downtime, or data loss can be costly and damaging for a

(8)

Each layer of BlueTie’s network infrastructure operates on active/active or

active/passive equipment, meaning the failure of a component within any piece of this

equipment, or the failure of an entire system should not disrupt service for end users.

Latent capacity built into the infrastructure allows for full failover to redundant systems

in the event of a network failure.

BlueTie’s stateless processing systems are grouped into clusters of systems which are

managed by intelligent load balancers. These load balancers monitor the state and

health of each processing system. Systems that fail or are not performing well are

automatically removed, while seamlessly transferring connections to another processing

system. This process reduces the chance for customer impact in the event of a system

issue or outage.

BlueTie’s databases contain specific account information such as contacts, calendars,

tasks and other data stored by BlueTie for its end users. Each database is replicated to a

standby unit which will assume responsibility if the primary unit should fail. Databases

are monitored at all times for integrity, synchronization, and responsiveness by our NOC

(Network Operations Center). Daily encrypted snapshots of these databases are stored

locally to the facility and are also transported off‐site to an alternate facility for disaster

recovery purposes.

Email is maintained in mail storage systems consisting of clusters of stateless accessor

systems which access mail from redundant storage devices. These devices are

constantly monitored for performance and utilization by our NOC. Storage systems are

protected by RAID level disk redundancy, as well as daily snapshots. Email data can be

restored to the last known snapshot in the event of a storage system failure or

accidental deletion by a user.

Security

Policy

BlueTie has developed internal security policies specifically designed to address physical,

network, system, and data security. These policies include, but are not limited too:

 Access Control (Physical, System, Network and Hardcopy)

 Centralized Desktop and Laptop Antivirus & Malware Protection

(9)

o Software Installation and Usage

o Network Accessibility

o Periodic Password Resets

o Credential Failure Lockout

o Idle Screen Locking

 Separation of Responsibilities (IT and Network Security)

 Employee Background Checks and Drug Screening

 Employee “Customer Data Confidentiality Agreements”

Conclusion

As businesses move sensitive data to the Cloud, SaaS providers are faced with the

growing challenges associated with keeping this data safe. Data breach, network

intrusion, or denial‐of‐service threats are constantly evolving and require experienced

security professionals. BlueTie’s multi‐faceted approach to security, backed by stringent

security policies, industry‐leading threat protection, and mitigation solution

deployments help keep your data private and safe.

names referenced in this document are trademarks or registered trademarks of their respective owners.

Advanced SaaS Security Measures

Advanced

SaaS

Security

Measures

Overview

of

BlueTie

Security

TABLE OF CONTENTS

Abstract

Background:

BlueTie

Business

Email

The

Problem

The

BlueTie

Cloud

Physical Security

Network Security

System Security

Data Storage

Availability

and

Disaster

Recovery

Security

Policy

Conclusion