Security measures on the DoubleCloud side

The DoubleCloud platform security process and operations cover the following topics:

Information security management system

DoubleCloud has an Information Security Management System (ISMS). It describes policies and procedures for providing information security (IS) and minimizing security risks.

The ISMS defines secure development lifecycle processes, software update policies, and incident management action plans.

Asset inventory

DoubleCloud has a process for taking asset inventory, including accounting for systems with access to customer data processing. Rules for using information and assets related to information processing are contained in internal documents, and the security team educates employees about these rules on a regular basis. When dismissed, employees return all corporate assets.

Access control

The members of the DoubleCloud team have access to the resources necessary to perform their duties on the need-to-know principle. We grant security clearances and permissions according to the principle of least privilege .

Security development lifecycle

The Security Development Lifecycle (SDLC) is crucial in designing new and improving existing services. DoubleCloud implements and continually develops the critical components of this process.

In addition to the SDLC, the team pays attention to protecting the development environment. In DoubleCloud, the development, testing, and production environments are separate.

Training

All the employees involved in the development of DoubleCloud services go through the following training procedures on a regular basis:

  • Mandatory developer training with theory and practice tests.

  • Getting familiar with the internal documentation.

    It describes the basic SDLC principles, contains a list of possible vulnerabilities for different types of applications, and shows typical examples of vulnerable code and how to fix them.

    The documentation also provides information on how to use vulnerability mitigation technologies. The regulations specify the minimum requirements for using cryptography when developing services and applications.

  • Continuously gaining knowledge from outside security experts.

    On a regular basis, the DoubleCloud security and development teams hold meetings with leading security professionals to discuss specific topics, new threats, and counteractions in detail.

Architecture planning

In accordance with the SDLC, before developing any product and/or changing its architecture, we hold meetings with security experts to discuss possible threats and ways to attack the service.

As a result, the service acquires a certain "immune system." This, along with other measures for Defense in Depth, provides reliable protection to the service and the data it stores and processes.

Final security analysis

The final security analysis is, in fact, white-box penetration testing. It's performed before each major stage of a project, such as before the Preview release of a service.

To think through the most effective attack possible, test engineers have access to the documentation and a test bench. They also cooperate with the development team to test both the service itself and the environment in which it's running.

As a result, they assess the risks and audit the service's compliance with external requirements.

Vulnerability management

DoubleCloud performs vulnerability testing for its components on a regular basis. We fix any vulnerabilities before putting the systems into production.

When we detect vulnerabilities in the components of the production environment, the security team analyzes the operation complexity and the severity of the consequences. After this, the development team prepares updates based on the vulnerabilities found.

Internal and external audits, penetration testing

DoubleCloud conducts regular internal and external audits and penetration tests to check the efficiency of the existing information security processes and improves them.

  • As part of the internal audits, we check asset management, change management, IS incident management, monitoring, and other processes and groups of IS controls.

  • An internal auditor may conduct interviews, fill out checklists, audit documented information involving the audited employee, monitor their activities, and create a representative sample.

  • The security team analyzes any non-conformities identified during the internal audit to determine their cause and make changes to the action plan.

  • In accordance with the laws on personal data protection and ISO standards, DoubleCloud has a schedule of external audits for compliance.

Customer notifications

Human Resource measures

DoubleCloud holds events for its employees to mitigate possible information security risks associated with their actions:

  • The security team carries out background verification checks on all candidates for employment.

  • We educate our employees about the requirements of internal policies and regulations, including the Information Security Policy and privacy-related documents.

  • After going through the training, employees pass tests to asses their acquired knowledge. Employees who fail to pass training within the scheduled period aren't allowed to perform their duties. These results are then analyzed to adjust our ISMS.

  • When an employee quits or takes a different job within the company, permissions to access internal information resources are automatically revoked or changed.

  • We review permissions every six months.

  • We regularly evaluate password strength and make sure passwords aren't found in common dictionaries.

Cloud platform infrastructure security

Resource separation and isolation

DoubleCloud isolates administrative and user resources as follows:

  • Isolation using cloud provider technology. Security-critical services run on separate VMs.

  • Logical isolation with Identity and Access Management (IAM) . We perform all administrative operations exclusively through IAM using permission management.

  • Network-level isolation. All administrative VMs run in logically isolated networks. A provider's corporate network is separated from the cloud platform network. Access control is carried out automatically using dynamic and host firewall rules and access-control lists (ACLs) .

Cloud platform machine security

There are several levels of security protecting the DoubleCloud components:

  • We describe operating system configurations with code stored at a repository. Before transferring to the production environment, all configuration changes go through mandatory testing in test environments.

  • A bastion host controls administrators' and developers' access to the production environment.

  • All production environment packages are scheduled for vulnerability checks and updated to the latest versions.

Protecting employee credentials

Authentication on corporate resources not linked to the cloud infrastructure is based on the world's best practices:

  • DoubleCloud uses anti-phishing techniques.

  • The company has a password policy.

  • External access to the resources requires a VPN connection or two-factor authentication.

Data protection

The data owner is always the cloud platform user. DoubleCloud only uses customer data hosted on the platform to fulfill the purposes outlined in the User agreement and notifies the customer of any incidents that affect their data.

Protecting user information

The DoubleCloud team receives information about users on the need-to-know basis: user information is only available to the departments that require it to perform their duties.

User information processing and storage systems use authentication, authorization, and action logging.

The user information includes:

  • User action (operation) logs
  • API and Console access logs
  • Technical information about the status of user services
  • Financial and resource consumption information

We restrict the rights to access the above information by default and review them on a regular basis. Systems for storing and processing this information are created based on the Security Development Lifecycle and are regularly subject to internal penetration testing.

If possible, user information is encrypted during storage and transmission.

See also: