Securing the Flow of Information - Software as a Service und Datensicherheit

white paper Securing the Flow of Information Software as a Service and Your Confidential Data www.esker.com ESKER ON DEMAND white paper Summary Executive Summary .................................................................................................................................................................. 3 Current State of Information Security ............................................................................................................................... 4 Placing Confidence in Software as a Service (SaaS) .................................................................................................... 4 § Data Privacy ........................................................................................................................................................ 4 § Access Control..................................................................................................................................................... 5 Business Continuity ............................................................................................................................................................ 4 § Reliability ............................................................................................................................................................... 6 § High Availability.................................................................................................................................................... 7 § Disaster Recovery ................................................................................................................................................ 7 § Scalability ............................................................................................................................................................. 7 § Data Centres........................................................................................................................................................ 8 Leveraging First-Class Security ........................................................................................................................................... 9 Conclusion................................................................................................................................................................................. 10 About Esker ............................................................................................................................................................................... 10 2 ESKER ON DEMAND white paper Executive Summary As corporate organisational structures continue to evolve, businesses are rapidly expanding toward Software as a Service (SaaS) to help achieve and maintain competitive advantages. Today, almost all business functions can be outsourced — from mail and fax services to complete enterprise CRM. While this growth has proved to be a boom for those companies providing these services, it has also added a large burden of implementing best-in-class security systems to protect information. This paper outlines key aspects of information security companies should look for in SaaS solutions to protect information and ensure business success, focusing on three essential elements instrumental to achieving this goal: data privacy, access control and business continuity. Each of these elements is discussed in greater detail below, followed by an overview of Esker strength and commitment to data confidentiality. 3 ESKER ON DEMAND white paper Current State of Information Security Over the last decade the world has become more connected. Today companies can automate and externalise just about any process they can imagine using Software as a Service (SaaS) solutions to effectively eliminate the need for costly in-house networks and physical infrastructure. These new automation capabilities allow both small and large businesses to compete on the same global scale. However, this equalising effect depends heavily on the ability to protect internal and external connections between networks and, in particular, to secure the flow of information. One of the biggest fears of companies thinking about adopting SaaS solutions has been and still is the vulnerability of corporate business information. Their apprehension is well-founded, as sources of both internal and external threats become more sophisticated every day. With the increased value of digital information, coupled with more stringent government regulations, industry recommendations, and intellectual property protection, SaaS solution providers are working hard to alleviate customer worries through better protection of sensitive information and compliance with privacy regulations. Placing Confidence in Software as a Service (SaaS) Choosing an external company to manage business critical processes is a major step that can offer significant economical advantages and help guarantee business continuity without the addition of in-house infrastructure. There are several key elements of information protection to consider prior to selecting a SaaS solution to help manage business critical processes. These elements — including data privacy, access control, and business continuity — must align with desired expectations and goals. Data Privacy To increase the productivity of its workforce, a company must make information easier to share and transfer among employees (e.g., sales managers, R&D, and engineers), and between employees and external partners (e.g., suppliers and vendors). However, the resulting productivity gains shouldn’t be obtained to the detriment of security. There are several factors that can lead to information leakage — protecting those bases with effective management and review of privileged user rights and using up-to-date encryption technologies and procedures can minimise intentional and unintentional information leakage. If left unmanaged, privileged users can be a significant hole in information safeguards. One prime example is end users who have more database privileges than necessary. Although it may seem difficult and/or time consuming to give each person the exact permissions needed, there is really no excuse for giving broad-range privileges to someone who doesn’t need them. Restricting and reviewing privileges on a regular basis greatly helps lower risk. Equally important is the need to protect data being transferred across networks, either at rest in a database or on tapes and backup storage. Protecting personally identifiable information has become more and more difficult over the past decade. Encrypting sensitive portions of a data set, such as a database column containing credit card numbers, ensures minimal performance and storage overhead typically associated with data encryption. Classifying data based on sensitivity and controlling access is also a highly effective approach to ensuring data privacy. Finally, government regulatory requirements are rapidly changing to provide more stringent control over sensitive company information. Failing to comply with regulations such as the Sarbanes-Oxley Act and HIPAA can have a seriously detrimental impact on company success. Global organisations not only have to satisfy their in-country requirements but also those of the countries in which they do business. To achieve sustainable compliance cost- effectively is an ongoing goal for most organisations. While implementing an effective solution that meets today’s standards is important, implementing a solution that is flexible enough to adapt to tomorrow’s standards is even more valuable. Comprehensive SaaS solutions should include identity auditing and reporting, audit consolidation and risk & compliance process management. 4 ESKER ON DEMAND white paper Access Control Access control components are a necessary and crucial design element of application security. A web application should protect front-end and back-end data and system resources by placing access control restrictions on what users can do, which resources they have access to, and what functions they are allowed to perform on the data. A centralised framework for managing these rights is extremely important and can ensure these policies remain consistent and are applied to all web-based, client/server and legacy system applications. § Authentication determines if a user or entity is who he/she/it claims to be. Authentication can range from simple password protection to stronger validations such as biometrics. Authentication offers the first line of security as a user attempts to access information. § Authorisation following the act of authentication grants certain permissions to a specific user. These permissions will allow the user to perform certain tasks and access certain applications, and is intended to prevent malicious acts. Authorisation policies that are centralised provide a higher level of security.