Content Matrix 9.8 - Security Guide

Network Communications

Figure 2: List of protocols used and associated ports

.

Authentication of Users and Services

Metalogix® Content Matrix relies upon

·Windows Authentication and Active Directory group membership to authenticate users

·Forms Based Authentication which authenticates through IIS

·Azure Active Directory authenticating via Office 365 OAuth Authentication

·Azure Active Directory authenticating via Office 365 Web Browser

FIPS 140-2 Compliance

Metalogix® Content Matrix cryptographic usage is based on FIPS 140-2 compliant cryptographic functions. Metalogix® Content Matrix makes use of FIPS 140-2 compliant encryption keys stored locally using Microsoft DPAPI.

Metalogix® Content Matrix has undergone a Quest internal Self-Affirmation process to confirm that all cryptographic usage relies exclusively on Third-Party FIPS 140-2 validated modules.

More information: Microsoft and FIPS: https://www.microsoft.com/en-us/trustcenter/compliance/fips

Air Gap Compliance

Metalogix® Content Matrix is Air Gap compliant.

What is Air Gap?

Air Gap is an architecture based on physical separation and trusted people. Its goal is to demonstrably protects all product builds and code delivery from potential mischievous employee or external actors, regardless of world location.

Air Gap Components

Air Gap consists of:

· A secure facility within Quest that contains the complete supply and assembly chain for all products in scope.

·Limited access: only select employees have access to review, accept, and transfer contributions into this environment.

·A vetted secure build process which entirely separates the Product Development from the Product Build.