Introduction
Managing information system security is a priority for every organization. In fact, the level of security provided by software vendors has become a differentiating factor for IT purchase decisions. Quest strives to meet standards designed to provide its customers with their desired level of security as it relates to privacy, confidentiality, integrity and availability.
This document describes the security features of Quest Nova Core. This includes access control, protection of customer data, secure network communication, and cryptographic standards.
About Quest Nova Core
Quest Nova Core provides the following functionality and basic building blocks for other Quest Nova applications to be built upon:
·Provides identity for users and clients by using OpenID Connect standard
·Provides organization hierarchy for partners and end organization enforcing security access validation
·Allows users assignments to roles and organizations for access
·Exposes notification mechanism for all services (Alerting)
·Implements service lookup for internal service-to-service communication and description of service endpoints for UI (to call region specific service based on provisioning for customers data storage)
·Provides dashboard and widget(s) configuration storage to UI
·Ability execute and deliver (via email) reports on user configurable schedule
Quest Nova Core is hosted in Microsoft Azure and delivers most of its functions via Microsoft Azure cloud services.
Architecture overview
The following scheme shows the key components of the Quest Nova Core configuration.
Azure datecenter security
Microsoft Azure datacenters have the highest possible physical security and are considered among the most secure and well protected datacenters in the world. They are subject to regular audits and certifications including Service Organization Controls (SOC) 1, SOC 2 and ISO/IEC 27001:2005.
Relevant references with additional information about the Windows Azure datacenter security can be found here:
·Microsoft Azure Trust Center: https://azure.microsoft.com/en-us/overview/trusted-cloud/
·Microsoft Trust Center Compliance: https://www.microsoft.com/en-us/trust-center/compliance/compliance-overview?service=Azure#Icons
·Microsofts submission to the Cloud Security Alliance STAR registry: https://cloudsecurityalliance.org/star/registry/
·Whitepaper: Standard Response to Request for Information Security and Privacy: http://www.microsoft.com/en-us/download/details.aspx?id=26647
·Microsoft Global Datacenters: Security & Compliance: https://www.microsoft.com/en-us/cloud-platform/global-datacenters
·Azure data security and encryption best practices: https://docs.microsoft.com/en-us/azure/security/fundamentals/data-encryption-best-practices
·Microsoft and FIPS:https://docs.microsoft.com/en-us/compliance/regulatory/offering-FIPS-140-2?view=o365-worldwide