Security measures of the cloud platform

CIERTO's cloud uses Microsoft Azure, which makes it possible to run on a secure environment with various authentication methods, and regulatory features

• ISO/IEC 27001

  ISO/IEC27001 is an international standard regarding information security management systems(ISMS). This defines the structure of the organization in order to optimize information, by managing the confidentiality, information integrity, and availability of data.

• ISO/IEC 27017

  ISO/IEC27017 is a guideline for cloud services regarding information security measurements. The measurements defined in ISO/IEC 27017, enhances the general information security measurements defined in ISO/IEC27001 enabling the implementation of a security management structure compatible for cloud services.

• ISMAP (Information system Security Management and Assessment Program)

  ISMAP is a program that is purposed to streamline the installment of cloud services for government organizations. By registering/evaluating cloud services in advance that meet the security requirements of the government, a security standard for procuring cloud services can be defined for government organizations.

• SOC Type 1,2,3 (Service Organization Control)

  The assurance of the integrity for "Financial statements". SOC1 reports indicate a broad range of internal controls such as security, availability, process integrity, and confidentiality. SOC2/SOC3 targets fields other than "Financial statements".

System reference: Microsoft Azure security compliance list(https://learn.microsoft.com/ja-jp/compliance/)

Software security measurements

The latest security measurements are applied to CIERTO cloud as the development environments are scheduled/planned to be updated upon major software updates.

• OWASP（ Open Web Application Security Project）security check

  OWASP is an open source software community that is active in various fields, such as hosting events, developing penetration testing tools, or creating guidelines regarding security for software/web applications. CIERTO performs software security checks according to the software/web application guidelines defined by OWASP upon software releases.

• Penetration testing from a third party organization

  Vulnerability analysis on the web application can be conducted by a third party organization according to customer needs, making it possible to apply measurements that meet the security standards of customers.

Security measurements during service production

CIERTO's cloud has various security features which makes it possible to run on an environment according to the customers security policy.

• ACL feature

  Secure access can be achieved by limiting the sender IP address and user.

• Encryption measurements using SSL connection

  Decreasing the risk of information leaks is achieved by using SSL encrypted transmission.

• Access control according to connecting IP address

  Access points can be managed by limiting the accessible IP addresses to specific locations, or offices

• 2 factor authentication

  Enhancement of security by identifying individuals using authentication from a mobile device in addition to ID/ password login.

• Management of asset access and operation history

  The operation log, or access log can be managed, and exported as a CSV file.