Customer-facing page detailing the security in place for ZenGRC storage.
Link to Amazon's S3 Security page: http://docs.aws.amazon.com/AmazonS3/latest/dev/DataDurability.html
Answers from Slobodan appear in purple
Data protection
- How is data being protected?
Data is protected by Amazon logging system. We're not protecting data, we're just using S3, which has it's own security system. The users log into this system with their own credentials. Only we (as Reciprocity (devops)) have access to this, besides our customers
- How is data segregated - do we have one S3 bucket per instance, or one bucket that all customers use?
- We have one S3 bucket per instance (we're not mixing data from different customers)
- Are we encrypting information stored in S3? If so, who can decrypt it?
- We're not encrypting this information. I don't know if this is even possible to do automatically, but it sounds like a lot of effort for not so much gain
- Are keys shared between customers, or does each ZenGRC instance get its own encryption key?
- Each instance has its own keys, which are from that customer only, and only our devops have access to them.
Backup schedules
- How do we back up/replicate data in S3?
- What is the frequency of backups?
Rok is probably more qualified than me to answer the questions about the backup. But the following is certainly true: we do a regular DB backups to S3 (those are the same buckets that we use for evidence collection). These backups are only done for zengrc db data. Now, the evidence data that's being stored on S3, it's not being backed up, this is kinda pointless. AWS sould take care of this automagically
Access logs & restrictions
- Who can access files/information in S3 (other than the customer)?
- Only the customers can access their evidence data. Nobody outside of the zengrc has access to this. Of course, this doesn't apply to our devops
- How is this access monitored/logged?
- This access is not monitored or logged in zengrc. I don't know if S3 has automatic logging, it's possible that it does, but I'd have to double-check
- Do we have any security monitoring in place (e.g., if Rok downloads all the customer files stored in S3, would anybody get an alert?)
- Again, our devops are exception to the access restriction (because they have the keys). If they download or even delete the data, no one would get notified. But I don't see a problem in this fact, since the same thing would apply to the entire zengrc DB, and the customer instance.
Other considerations
- Versioning (S3 supports it, are we using it/exposing it to customers)?
- Other types of access (API) - are there use cases for supporting this?
- Compliance/Regulatory
- Do we offer different configurations of S3 for different applications (e.g. geo-bounded storage for certain compliance requirements, or higher level of encryption, etc.)?
- BYO Options (relevant to compliance/regulatory)
- Pricing (link to website?)