Camms Security & Hosting

Introduction

At Camms our top priority is keeping our customers’ data secure. We employ rigorous security measures at organisational, architectural, and operational levels to continually ensure that your data, application, and infrastructure remain safe.

At Camms our top priority is keeping our customers’ data secure. We employ rigorous security measures at organisational, architectural, and operational levels to continually ensure that your data, application, and infrastructure remain safe.

Camms Information Security Management System

An Information Security Management System (ISMS) is built to establish a holistic and structured approach to manageing information. This system provides the framework for the policies, procedures, and guidelines that we at Camms have adopted to implement an ISMS. This implementation is based on the generally accepted ISO/IEC 27001:2013 management system and standard.

Resources have been specifically committed to effectively manage the ISMS, including the appointment of a Head of Information Security and Compliance, who takes on the roles of Chief Information Security Officer (CISO) and the Data Protection Officer (DPO), and is responsible for the overall security and data
privacy programmes. The Information Security Steering Committee (ISSC) provides ongoing support and advisory to the ISMS. The Leadership of Camms is committed to a range of security activities conducted throughout the year, including regular risk assessments, security assessments, and any subsequent steps to maintain the highest security credentials across our organisation.

Information Security Audit Cycle

Product and Architectural Security

Data Processing Relationship

Our customers serve as the data controllers and administrators, while Camms acts as the data processor. This means that you have full control of the data entered into the application, as well as all setups and configurations. As you control your data and Camms acts as the processor, you will not have to rely on
us to perform day-to-day tasks such as:

• Assigning security authorisation and manipulating roles
• Creating new reports and dashboards
• Configuring business process flows, alerts, rules etc.
• Changing or creating new organisational structures
• Monitoring all business transactions
• Looking at all historical data and configuration changes

Infrastructure Security

Camms solution infrastructure is hosted and managed on Microsoft Azure and runs in Datacentres managed and operated by Microsoft. These Datacentres comply with key industry standards, such as ISO/IEC 27001:2013 and NIST SP 800-53, for security and reliability. Backups are stored in a secondary Datacentre by Microsoft at a separate site to avoid the risk of a single infrastructure site failure.

Data Encryption

Camms encrypts all end-to-end communication. This is a fundamental design characteristic of the Camms technology.

The transport layer of the TCP IP stack is protected with Transport Layer Security protocol (TLS 1.2) to provide end-to-end security in communication between processes. This further helps secure network traffic from passive eavesdropping, active tampering, or message forgery. Web server authenticity is verified
using a SHA2 256 hash function and encrypted using RSA 2048 bits, with certificates issued by RapidSSL, ensuring all web data packets from the server to the client are received to and from authorised parties. All Camms solutions enforce web access via a secure HTTPS protocol. Encryption using AES 256 at rest is enabled by default for both Azure VM instances and backup services.

For more details on Azure at rest encryption by Microsoft Azure for managed disks and backup services, please visit: https://docs.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest.

File-based integrations are secured using a Secure File Transfer Protocol (SFTP).

Environment (Logical) Security

Camms solutions are deployed in both multi-tenant environments and single-tenant environments based on client requirements.

Multi-tenant environments are referred to as public cloud environments for solution deployments, and single tenant environments are referred to as private cloud or self-hosted environments for solution deployment.

The key difference between private and public cloud environments with solution deployment is that private cloud clients will be the only tenants within the hosting environment. In contrast, multiple clients will exist in a single hosting environment in public cloud environments.

In a multi-tenancy environment, customer data is logically separated through strict coding standards and segregated access to organisations’ data is stored in a separate database for each client. Each record of data in the solution includes a unique customer identifier. Users are authenticated to their respective
databases.

Camms solutions has the ability to segregate access to data through the application by using role-based permissions.

We support LDAP delegated authentication and SAML for single sign-on authentication for both user and web services integrations.

Single Sign-on:

Security Assertion Markup Language (SAML) allows for a seamless, single sign-on experience between the customer’s internal web portal and Camms. A customer log into their company’s internal web portal using their enterprise username and password and are then presented with a link to Camms, which automatically gives customers access without having to log in once again.

Camms Native Login:

For customers who wish to use our native/standalone login, Camms will only store the passwords in the form of a secure hash as opposed to the password itself. Unsuccessful login attempts are logged as well as successful login/logout activity for audit purposes. Inactive user sessions are automatically timed out after a specified time period, which is configurable by Camms.

Authentication

Camms caters to various client requirements by having several options for authentication to our solutions, including:

Self-Hosted Environments:

• Form authentication
• Windows authentication with SSO
• Windows authentication without SSO

Cloud Hosted Environments (Private and Public Cloud):

• Form authentication
• SAML authentication with SSO
• SAML authentication without SSO

Camms offers a Single Sign-On (SSO) functionality using SAML 2.0 compliant identity provider support.
Some of the identity providers we have worked with include ADFS, Okta, Azure AD, Google, Facebook, and many more.

Role-based Access

Camms solutions are developed to have a groups and permissions system. This allows you to restrict content for selected users with permission to view or edit based on the roles assigned. All user roles and permissions are managed in the staff management section of the application.

Solution Security Testing

Internal:

Camms follows secure development guidelines aligned with OWASP top 10 and CWE/SANS top 25 elements taken into consideration. During a development lifecycle, Camms utilises a Static Application Security Testing (SAST) tool, which scans the codebase based on OWASP top 10 and CWE/SANS top 25 standards.

External:

Camms uses an industry-leading third party to perform quarterly scheduled vulnerability assessments using Dynamic Application Security Testing (DAST). The Burp Suite and Nessus detect vulnerabilities such as cross-site scripting (XSS), SQL injection, Cross-site request forgery, and all known vulnerabilities related
to web applications. Further, another third party is contracted to perform manual penetration tests annually to ensure no malicious code or other vulnerabilities are present in all our solutions. The outputs of these assessments are reviewed by our Architecture Review Board, Quality Assurance, and information security
teams to develop any required remediation plans.

Privacy

Camms value the importance of protecting our customers data and does not pass on personal information to third parties. Camms solutions seeks to minimise personal data collection to identify/authenticate users that use our solutions and administer new users to our products. The following personal information that
the customer can manage within the staff section of our solution are:

• Name (First Name, Last Name)
• Location
• Email
• Phone

Software Development Lifecycle

Software development staff perform source code reviews and security, functional, and performance testing on all significant application changes prior to the deployment to the live environment. Camms quality assurance staff perform these tests independently of the original developer. Development and testing activities are carried out in a logically separate environment from the live environments to ensure any changes made to the testing environment have no impact on the live environment.

Operational Security

Security begins on day one here at Camms. All employees receive security, privacy and compliance training the moment they start work. Though the extent of this may vary according to their role in the organisation, security is everyone’s responsibility at Camms.

Physical Security

Camms applications are hosted in state-of-the-art data centres designed to protect mission-critical systems with fully redundant subsystems and compartmentalized security zones. Our data centres adhere to the strict physical security measures including, but not limited to the following:

• Multiple layers of authentication for server area access
• Two-factor biometric authentication for critical areas
• Camera surveillance systems at key internal and external entry points
• 24/7 monitoring by security personnel
• 100% redundant UPS dual power
• Dedicated high redundant firewall protection

All physical access to the data centres is highly restricted and stringently regulated.

Network Security

Camms has established detailed operating policies, procedures, and processes designed to help manage the overall quality and integrity of the Camms environment. Further we have also implemented proactive security procedures, such as perimetre defence (Azure Firewall and Sophos Antivirus protection) for
added protection.

Application Security

Camms has implemented an enterprise Secure Software Development Policy (SSDP) to help ensure the continued security of Camms applications. This programme includes an in-depth security risk assessment and review of Camms features. In addition, both static and dynamic source code analysis are performed to
help integrate enterprise security into the development lifecycle. The development process is further enhanced by application security training for developers and penetration testing of the application.

Live Environment Infrastructure Access

In order to gain access to the live environment infrastructure, an administrative user must authenticate the jump server on the respective network via a remote desktop protocol using SSL/TLS, and an authentication request must originate from a known whitelisted IP address. The whitelisted IP address is
restricted to an authenticated virtual private network, to which the administrator must connect if working remotely prior to being able to communicate with the jump server. The user accounts used to access the live environment needs to be unique.

Live Environment Application Access

Camms employees do not have application-level access to customer instances unless customers explicitly provide Camms with permission to perform tasks like implementation, support, or services.

Access Reviews

Access reviews to the in-scope systems are performed on a quarterly basis to ensure that administrative access to product systems is limited and based on appropriate roles and responsibilities. The Information Security Analyst completes reviews, and the Head of Information Security approves the results.

Organisational Security

Following organisational security checks are conducted:

• Confidentiality Agreements
• Employee Background Checks
• Employee Workstation Automatically Locked
• Employee Workstation Encrypted
• Limited Employee Access (Principle of Least Privilege)
• Personnel Screening
• Physical Access Control
• Training and Awareness

All employees at Camms receive information security and data privacy awareness training as part of their onboarding process and ongoing training (as a refresher). As a global organisation, we have opted for our own solution, Camms.College, to deliver the training required for all our employees. Our training
includes questionnaires to help reinforce understanding and the practical applications of the topics that are covered as part of the training, including:

Information Security:

• General Information Security Overview
• Acceptable Usage Policy
• Email, Internet, Mobile and computer, BYOD, Remote access, Password usage and management, Social
  media usage
• Information Security Threats
• Security Incident Management
• Confidentiality Requirements
• Data classification, Clear desk and clear screen policy, Client data confidentiality
• Camms Defences

Data Privacy:

• Essentials of Cyber Security and Data Protection
• What is GDPR?
• Data Subject Rights and Data Protection Principles
• Data Protection Model for GDPR
• Preparing for GDPR

Change Management Procedures

Camms has a formal Change Management Policy and Procedures that mitigates unauthorised changes occurring in production systems. These policies and procedures address the production infrastructure and software development lifecycle, including change requests, approvals, and standard change implementation procedures to guide employees through implementing commonly applied changes.

Acceptable Usage Policy

Camms employees are required to sign an acknowledgement form on joining the company stating that they have been given access to and have reviewed our Acceptable Usage Policy document, which includes an agreement with Camms to abide by the policy when using various Camms owned information assets.

Information Security Incident Management

Monitoring:

A Host-based Intrusion Detection System (HIDS) is in place to monitor and analyse the in-scope systems for any possible or actual security breaches and send real-time notifications to support personnel upon detection of a potential threat to the network. If a severe incident affects customer data, we will
notify customers immediately. Information Security related incidents can be reported to our support line, where responsible officers will be assigned to investigate and confirm the incident.

Corrective and Preventive Action:

As part of the incident response plan of action, the incident will be reported through an appropriate channel where the incident would be logged for investigation, and corrective and preventive action would be taken. Corrective action is the immediate fix to mitigate the threat, while preventive action will
involve a long-term solution to fix the identified issue and prevent its recurrence.

Threat Management

Camms contracts several third-party expert firms to conduct independent internal and external network, system, and application vulnerability assessments.

Application / Solution Security Testing

Camms has a vulnerability management plan, which mandates the completion of vulnerability assessments and annual penetration testing. Camms runs regular vulnerability assessment and penetration testing (VAPT) on Camms web application that audits web applications by checking for vulnerabilities like SQL
Injection, Cross-site scripting, XSS, XXE, SSRF, Host Header Injection, and other exploitable vulnerabilities. The scanning approach is a combination of black box and white box.

Vulnerability Scanning:

Camms follows secure development guidelines aligned with OWASP top 10 and CWE/SANS top 25 elements taken into consideration. During a development lifecycle, Camms utilises a Static Application Security Testing (SAST) tool, which scans the codebase based on OWASP top 10 and CWE/SANS top 25 standards.

Penetration Testing:

Camms uses an industry-leading third party to perform quarterly scheduled vulnerability assessments using Dynamic Application Security Testing (DAST). The Burp Suite and Nessus detect vulnerabilities such as cross-site scripting (XSS), SQL injection, Cross-site request forgery, and all known vulnerabilities
related to web applications. Further, another third party is contracted to perform manual penetration tests annually to ensure no malicious code or other vulnerabilities are present in all our solutions.
The outputs of these assessments are reviewed by our Architecture Review Board, Quality Assurance, and information security teams to develop any required remediation plans.

Network

External vulnerability assessments scan all internet-facing assets, including firewalls, routers, and web servers for potential weaknesses that could allow unauthorised access to the network. In addition, an authenticated internal vulnerability network and system assessment is performed to identify potential
weaknesses and inconsistencies with general system security policies.