Secure Development #
As we handle sensitive data, the development processes are handled in accordance. Below we outline the most important principles regarding our secure development policy.
Organizational Measures #
Internal InfoSec policy #
At uman we have an internal information security policy. This policy handles best practices with regards to managing passwords, multi-factor authentication, information storage, etc. This policy is part of the onboarding and is reviewed periodically.
Staff Training and Awareness #
As a first line of defense against cyber threats, staff receive regular training in information security topics such as phishing, incident reporting, privacy regulation, information classification, information handling etc.
Technical staff receive more extensive training in secure development practices and web application security such as the OWASP Top 10 list. Furthermore technical staff have proven technical skills on Google Cloud in the form of Google Cloud certifications.
Periodic Sprint Reviews #
Every sprint is reviewed by the CISO and CTO to assess for potential security vulnerabilities. This is to minimize the risk of introducing security vulnerabilities when new functionality is added to platform.
Identity and Access Management #
Access to systems is provided to staff according to the principle of least privilege.
User authentication to high value systems is protected with two-factor authentication.
Technical Measures #
Staging environments don’t have production data #
The staging environments, which are intended for developing the uman platform, don’t have a copy of the production data. These environments work with dummy data to avoid exposing sensitive information to uman developers.
We do have an isolated environment next to production, which is solely intended for developments related to search. Only the search engineers have access to this isolated environment.
Private-first #
Our cloud infrastructure is set up following the private-first approach. This means that all services and machines that don’t need to be exposed to the public internet are kept private.
Least privilege access #
Systems are designed following the least privilege access principle, they have the minimum set of permissions they require to function.
Penetration Tested #
Periodically, penetration tests are performed to ensure the application security. These tests are performed by an independent third party.
Continuous delivery #
Whenever there is an intent to merge or release code, an advanced continuous delivery process kicks in. This process guarantees:
- Automated checks (e.g. linting, testing, vulnerability scan)
- Peer reviews
- Auditable changelog
Google Cloud #
The uman platform is hosted on Google Cloud. It uses the same secure-by-design infrastructure, built-in protection, and global network that Google Search Engine, Gmail, YouTube etc. were built upon.
Google Cloud regularly undergoes independent verification of security, privacy, and compliance controls, achieving certification against global standards.
uman is making an effort to align its system architecture with the recommendations specified in the CIS Google Cloud Platform Benchmark.
Elastic Cloud #
The uman platform leverages a managed version of ElasticSearch from Elastic Cloud that is hosted on Google Cloud. It is protected with a traffic filters that only allow traffic from within the uman VPC. For more information regarding the security measures Elastic Cloud is managing, see Elastic Cloud security.
