On Demand Group Management cryptographic usage is based on Azure FIPS 140-2 compliant cryptographic functions.
On Demand Group Management FIPS 140-2 compliance refers to Azure FIPS 140-2 at https://www.microsoft.com/en-us/trustcenter/Compliance/FIPS.
Microsoft and FIPS: https://docs.microsoft.com/en-us/compliance/regulatory/offering-FIPS-140-2?view=o365-worldwide
The On Demand team follows a strict Quality Assurance cycle.
- Access to source control and build systems is protected by domain security, meaning that only employees on Quest’s corporate network have access to these systems. Therefore, should an On Demand developer leave the company, this individual will no longer be able to access On Demand systems.
- All code is versioned in source control.
- All product code is reviewed by another developer before check in.
In addition, the On Demand Development team follows a managed Security Development Lifecycle (SDL) which includes:
- MS-SDL best practices.
- Threat modeling.
- OWASP guidelines.
- Regularly scheduled static code analysis is performed on regular basis.
- Regularly scheduled vulnerability scanning is performed on regular basis.
- Segregated Development, Pre-Production, and Production environments. Customer data is not used in Development and Pre-Production environments.
On Demand developers go through the same set of hiring processes and background checks as other Quest employees.
Third Party assessments and certifications
On Demand has undergone a third party security assessment and penetration testing yearly since 2017. The assessment includes but is not limited to:
- Manual penetration testing
- Static code analysis with Third Party tools to identify security flaws
A summary of the results is available upon request. No OWASP Top 10 critical or high risk issues have been identified.
On Demand is included in the scope of the Platform Management ISO/IEC 27001, 27017 and 27018 certification:
- ISO/IEC 27001 Information technology — Security techniques — Information security management systems — Requirements: Certificate Number: 1156977-3, valid until 2025-07-28.
- ISO/IEC 27017 Information technology — Security techniques — Code of practice for information security controls based on ISO/IEC 27002 for cloud services: Certificate Number: 1156977-3, valid until 2025-07-28.
- ISO/IEC 27018 Information technology — Security techniques — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors: Certificate Number: 1156977-3, valid until 2025-07-28.
Quest Software, Inc. has successfully completed a SOC 2 examination of its On Demand solution. The examination was performed by an independent CPA firm for the scope of service described below.
Examination Scope: Quest On Demand Platform
Selected SOC 2 Categories: Security
Examination Type: Type 2
Review Period: January 1, 2022, to July 31, 2022
Service Auditor: Schellman & Company, LLC
Source control and build systems can only be accessed by Quest employees on Quest’s corporate network (domain security.) If a developer (or any other employee with access to On Demand Group Management) leaves the company, the individual immediately loses access to the systems. All code is versioned in source control.
Access to data
Access to On Demand Group Management data is restricted to Quest Operations team members. On Demand Group Management developers have no access to customer production data.
Permissions required to configure and operate On Demand Group Management
Quest Operations team members have access to the Quest’s production Azure Subscription and monitor this as part of normal day to day operations. On Demand Group Management developers have no access to Quest’s production Azure Subscription.
To access On Demand Group Management, a customer representative opens the On Demand website and signs up for an On Demand account. The account is verified via email; thus a valid email address must be provided during registration.
An organization is automatically created once the new account is created.
Azure Active Directory Global Administrator must give the Admin Consent to provision On Demand Group Management for the customer's Azure Active Directory with the following permissions:
- Read directory data
- Read and write all groups
- Read and write all users' full profiles
Windows Azure Active Directory
- Sign in and read user profile
On Demand Group Management internal logging is available to Quest Operations and On Demand Group Management development teams during the normal operation of the platform. No customer or Personally Identifiable Information (PII) data is placed in internal logging and this is reviewed as part of the SDL process.
Production incident response management
Quest Operations and Quest Support have procedures in place to monitor the health of the system and ensure any degradation of the service is promptly identified and resolved. On Demand Group Management relies an Azure infrastructure and as such, is subject to the possible disruption of these services.
Security incident response management
Quest has established a formal process of preparation, detection, analysis, containment, eradication, recovery, and post-incident activities for theOn Demand Group Management solution. In accordance with intentional privacy laws, Quest has established a Security Breach Notice process as well.