Information about our security infrastructure and practices
Information Security Policy
Onsharp maintains a written Information Security policy that defines each employee’s responsibilities and acceptable use of information system resources. We require signed acknowledgement from our employees indicating that they have read, understand, and agree to abide by the rules of behavior, before providing authorized access to our information systems. This policy is periodically reviewed and updated as necessary.
Our security policies cover a wide array of security related topics ranging from general standards with which every employee must comply, such as account, data, and physical security, to more specialized security standards covering internal applications and information systems.
Information security roles and responsibilities are defined within the organization. The security team focuses on information security, security auditing and compliance, as well as defining the security controls for protection of Onsharp’s hardware infrastructure. The security team receives information system security notifications on a regular basis and distributes security alert and advisory information to the organization on a routine basis after assessing the risk and impact as appropriate.
Onsharp follows the NIST Cybersecurity Framework with layered security controls to help identify, prevent, detect, and respond to security incidents. The Information Security Manager is responsible for tracking incidents, vulnerability assessments, threat mitigation, and risk management.
Onsharp’s data and information system assets are comprised of both customer and corporate assets. These asset types are managed under our security policies and procedures. Onsharp authorized personnel who handle these assets are required to comply with the procedures and guidelines defined by Onsharp security policies.
Onsharp employees are required to conduct themselves in a manner consistent with the company’s guidelines, including those regarding confidentiality, business ethics, appropriate usage, and professional standards. All newly hired employees are required to sign confidentiality agreements and to acknowledge the Onsharp code of conduct policy. The code outlines the company’s expectation that every employee will conduct business lawfully, ethically, with integrity, and with respect for each other and the company’s users, partners, and competitors. Processes and procedures are in place to address employees who are on-boarded and off-boarded from the company.
Employees are provided with security training as part of new hire orientation. In addition, each Onsharp employee is required to read and understand the company’s code of conduct.
Physical & Environmental Security
Onsharp has policies, procedures, and infrastructure to handle the physical security of its office locations.
Our information systems and infrastructure are hosted in world-class data centers that are geographically dispersed to provide high availability and redundancy to Onsharp and its customers. The standard physical security controls implemented at each data center include electronic card access control systems, fire alarm and suppression systems, interior and exterior cameras, and security guards. Physical access is centrally managed and strictly controlled by data center personnel. All visitors and contractors are required to present identification, are required to log in, and be escorted by authorized staff through the data center.
Access to areas where systems, or system components, are installed or stored are segregated from general office and public areas. Data centers have backup power supplies and can draw power from diesel generators and backup batteries. These data centers have completed both a Service Organization Controls (SOC) 2 Type II audit as well as PCI-DSS.
Onsharp ensure that all changes made to production environments are applied in a deliberate manner. Changes to information systems, network devices, and other system components, are monitored and controlled through a change control process. Changes are reviewed, approved, tested and monitored post-implementation to ensure that the expected changes are operating as intended.
Supplier & Vendor Relationships
Onsharp likes to partner with suppliers and vendors that operate with the same or similar values around lawfulness, ethics, and integrity that Onsharp does. As part of its review process, we screen our suppliers and vendors to ensure they implement appropriate confidentiality and security obligations, especially if they manage customer data.
Our procurement department may perform audits from time to time on Onsharp suppliers and vendors in an effort to ensure the confidentiality, integrity, and availability of data that our third-party suppliers or vendors may handle.
Auditing & Logging
We maintain audit logs on systems. These logs provide an account of which personnel have accessed which systems. Access to our auditing and logging tool is controlled by limiting access to authorized individuals. Security events are logged, monitored, and addressed by trained security team members. Network components, workstations, applications and any monitoring tools are enabled to monitor user activity.
Organizational responsibilities for responding to events are defined. Security events that record critical system configuration changes and administrators are alerted at the time of change. Retention schedules for the various logs are defined in our security control guidelines.
Antivirus & Malware Protection
Antivirus and malicious code protection are centrally managed and configured to retrieve the updated signatures and definitions available. Malicious code protection policies automatically apply updates to these protection mechanisms. Anti-virus tools are configured to run scans, virus detection, real-time file write activity and signature file updates. Laptop and remote users are covered under virus protection.
Onsharp has backup standards and guidelines and associated procedures for performing backup and restoration of data in a scheduled and timely manner. Controls are established to help safeguard backed up data (onsite and off-site). We also work to ensure that customer data is securely transferred or transported to and from backup locations. Periodic tests are conducted to test whether data can be safely recovered from backup devices.
Our infrastructure servers reside behind high-availability firewalls and are monitored for the detection and prevention of various network security threats. Firewalls are utilized to help restrict access to systems from external networks and between systems internally. By default, all access is denied and only explicitly allowed ports and protocols are allowed based on business need.
Onsharp maintains separation between development and production environments. Firewalls provide adequate network segmentation through the establishment of security zones that control the flow of network traffic. These traffic flows are defined by strict firewall security policies.
Onsharp continually works to develop products that support the latest recommended secure cipher suites and protocols to encrypt traffic while in transit. We monitor the changing cryptographic landscape closely and work to upgrade our products to respond to new cryptographic weaknesses as they are discovered and implement best practices as they evolve. For encryption in transit, we do this while also balancing the need for compatibility for older clients.
Routine security assessments are done to identify vulnerabilities and to determine the effectiveness of the patch management program. Each vulnerability is reviewed to determine if it is applicable, ranked based on risk, and assigned to the appropriate team for remediation.
Onsharp strives to apply the latest security patches and updates to operating systems, applications, and network infrastructure to mitigate exposure to vulnerabilities. Patch management processes are in place to implement security patch updates as they are released by vendors. When deemed necessary, patches are tested prior to being deployed into production.
Secure Network Connections
HTTPS encryption is configured for customer web application access. This helps to ensure that user data in transit is safe, secure, and available only to intended recipients. The level of encryption is negotiated to either SSL or TLS encryption and is dependent on what the web browser can support.
Role Based Access
Role based access controls are implemented for access to information systems. Processes and procedures are in place to address employees who are voluntarily or involuntarily terminated. Access controls to sensitive data in our databases, systems, and environments are set on a need-to-know / least privilege necessary basis. Access control lists define the behavior of any user within our information systems, and security policies limit them to authorized behaviors.
Authentication & Authorization
We require that authorized users be provisioned with unique account IDs. Our password policy covers all applicable information systems, applications, and databases. Our password policies enforce the use of complex passwords, which are deployed to protect against unauthorized use of passwords.
Onsharp employees are granted a limited set of default permissions to access company resources, such as their email. Employees are granted access to certain additional resources based on their specific job function. Requests for additional access follow a formal process that involves a request and an approval from their manager, as defined by our security guidelines.
Software Development Lifecycle
We follow a defined methodology for developing secure software that is designed to increase the resiliency and trustworthiness of our products and services. We deploy updates on an iterative, rapid release development lifecycle. Security and security testing are implemented throughout the entire software development methodology. Quality Assurance (QA) is involved at each phase of the lifecycle and security best practices are implemented in all development activities.
Our secure development lifecycle follows standard security practices including vulnerability testing, regression testing, and ongoing security assessments. The Onsharp team reviews our development methodology regularly to incorporate evolving security awareness, industry practices and to measure its effectiveness.
Onsharp has an Incident Response Plan in place in case of an information security incident. The Incident Response Plan defines the responsibilities of key personnel and identifies processes and procedures for notification. Incident response personnel are trained, and execution of the incident response plan is tested periodically.
An incident response team is responsible for providing an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery.
Business Continuity & Disaster Recovery
To minimize service interruption due to hardware failure, natural disaster, or other catastrophe, we implement a disaster recovery program at all of our 3rd party data center hosting locations. This program includes multiple components to minimize the risk of any single point of failure. For business critical applications, application data is replicated to secondary or backup data centers that are geographically dispersed to provide adequate redundancy and high availability.
We apply a common set of data management principles to customer data that we may process, handle, and store. We protect customer data using appropriate physical, technical, and organizational security measures. Any non-public customer information that Onsharp may process, handle or store is encrypted at rest. Employees who may have access to this information use specially hardened and encrypted workstations.