Tchater maintenant avec le support
Tchattez avec un ingénieur du support

On Demand Migration Current - Security Guide - SharePoint Migration

FIPS 140-2 compliance

On Demand Migration cryptographic usage is based on Azure FIPS 140-2 compliant cryptographic functions. For more information, see: https://docs.microsoft.com/en-us/azure/storage/blobs/security-recommendations

SDLC and SDL

The On Demand team follows a strict Quality Assurance cycle.

  • Access to source control and build systems is protected by domain security, meaning that only employees on Quest’s corporate network have access to these systems. Therefore, should an On Demand developer leave the company, this individual will no longer be able to access On Demand systems.
  • All code is versioned in source control.
  • All product code is reviewed by another developer before check in.

In addition, the On Demand Development team follows a managed Security Development Lifecycle (SDL) which includes:

  • MS-SDL best practices
  • Threat modeling.
  • OWASP guidelines.
  • Regularly scheduled static code analysis is performed on regular basis.
  • Regularly scheduled vulnerability scanning is performed on regular basis.
  • Segregated Development, Pre-Production, and Production environments. Customer data is not used in Development and Pre-Production environments.

On Demand developers go through the same set of hiring processes and background checks as other Quest employees.

Third Party assessments and certifications

Penetration testing

On Demand has undergone a third party security assessment and penetration testing yearly since 2017. The assessment includes but is not limited to:

  • Manual penetration testing
  • Static code analysis with Third Party tools to identify security flaws

A summary of the results is available upon request. No OWASP Top 10 critical or high risk issues have been identified.

Certification

On Demand is included in the scope of the Platform Management ISO/IEC 27001, 27017 and 27018 certification:

  • ISO/IEC 27001 Information technology — Security techniques — Information security management systems — Requirements : C710-ISMS222-07-19, valid until 2022-07-29.
  • ISO/IEC 27017 Information technology – Security techniques – Code of practice for information security controls based on ISO/IEC 27002 for cloud services: C711-ITCS2-07-19, valid until 2022-07-29.
  • ISO/IEC 27018 Information technology — Security techniques — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors: C712-ITPII2-07-19, valid until 2022-07-29.

Operational security

Source control and build systems can only be accessed by Quest employees on Quest’s corporate network (domain security.) If a developer (or any other employee with access to On Demand Migration) leaves the company, the individual immediately loses access to the systems.

All code is versioned in source control.

Access to data

Access to On Demand Migration data is restricted to:

  • Quest Operations team members
  • Particular Quest Support team members working closely with On Demand Migration product issues.
  • The On Demand Migration development team to provide support for the product

Access to On Demand Migration data is restricted through the dedicated Quest Azure AD security groups. For different types of data (e.g., product logs, customer data, and sensitive data) different access levels and lists of allowed people are assigned.

Permissions required to configure and operate On Demand Migration

Quest Operations team members have access to the Quest’s production Azure Subscription and monitor this as part of normal day to day operations. On Demand Migration developers have no access to Quest’s production Azure Subscription.

To access On Demand Migration, a customer representative opens the On Demand website and signs up for an On Demand account. The account is verified via email; thus a valid email address must be provided during registration.

An organization is automatically created once the new account is created.

Prerequisites:

Azure Active Directory Global Administrator must give the Admin Consent to provision On Demand Migration for the customer's Azure Active Directory with the following permissions:

OAuth 2.0 Permission Grants

Microsoft SharePoint Online

  • Read and write directory data (Microsoft Graph)
  • Read files in all site collections (Microsoft Graph)
  • Read and write directory data (Windows Azure Active Directory)
  • Read and write items and lists in all site collections (Office 365 SharePoint Online)
  • Read and write managed metadata (Office 365 SharePoint Online)
  • Read and write user profiles (Office 365 SharePoint Online)
  • Read and write items in all site collections (Office 365 SharePoint Online)
  • Have full control of all site collections (Office 365 SharePoint Online)

Microsoft Graph permissions reference - Microsoft Graph | Microsoft Docs

Operational monitoring

On Demand Migration internal logging is available to Quest Operations and On Demand Migration development teams during the normal operation of the platform. Some customer or Personally Identifiable Information (PII) data (e.g. document names, URLs, Metadata, error messages, etc.) can become a part of internal logging for troubleshooting purposes.

Production incident response management

Quest Operations and Quest Support have procedures in place to monitor the health of the system and ensure any degradation of the service is promptly identified and resolved. On Demand Migration relies an Azure infrastructure and as such, is subject to the possible disruption of these services.

Documents connexes

The document was helpful.

Sélectionner une évaluation

I easily found the information I needed.

Sélectionner une évaluation