/Dy. Security Overview

Transcription

1 /Dy Security Overview

2 Table f Cntents 1. Dcument Purpse Slutin Overview Functinality Certificatins and Awards Slutin Elements Cnnectivity Web Services Cnnectivity Methds Internet Facing Deplyment Service Bus Relay Cnnectr (SBRC) Standard Web Publishing Service User Data Cnnectin Details Data Prcessing Sends Persnalized Sends Frms Prfile Management Surveys Data Strage Data Access Data Ownership Data Lcatin Data Privacy Security Azure Security Netwrk Security Azure Threat Management Penetratin Testing Appendix A: Frequently Asked Questins ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 2

3 1. Dcument Purpse ClickDimensins understands that in tday s envirnment custmers are cncerned abut hw their data is accessed, prcessed and secured. Custmers must be able t trust that their data is safe and that it will nly be used in a way that is cnsistent with their expectatins. This dcument has been created t prvide an verview f data usage and security-related tpics pertaining t the ClickDimensins slutin. 2. Slutin Overview ClickDimensins bridges the gap between sales and marketing by fully integrating marketing autmatin activities directly int Micrsft Dynamics CRM/Dynamics Functinality ClickDimensins is fully embedded in Micrsft CRM all features are accessed thrugh the CRM interface and data is stred in yur CRM database. The built-in marketing capability in the ClickDimensins slutin prvides an intuitive experience that allws users t create and send bulk HTML s with send, pen, click and bunce data reprted at the mailing (aggregate) as well as individual recipient level. Our easyt-use editrs make creating an simple. ClickDimensins als prvides web intelligence, lead scring, nurture marketing, scial discvery, frm capture, surveys and mre. ClickDimensins allws rganizatins t discver wh is interested in their prducts, quantify their level f interest and take the apprpriate actins. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 3

4 2.2 Certificatins and Awards ClickDimensins is the highest-rated marketing slutin n Micrsft s Dynamics Marketplace. Our slutin is Micrsft CRM certified, and we are a Gld Micrsft Partner fr CRM. ClickDimensins was named by Micrsft as the 2012 Micrsft Dynamics Marketplace Slutin Excellence Partner f the Year Award winner. ClickDimensins was the first ever Dynamics CRM ISV t be named t the invitatinnly Micrsft BizSpark One prgram. 2.3 Slutin Elements There are three key systems invlved in the delivery f ClickDimensins functinality: Micrsft Dynamics CRM/Dynamics 365 Yur CRM data is held securely within yur CRM database Frm yur CRM instance yu access the ClickDimensins tls t build templates, generate sends, view statistics, see web analytics and mre ClickDimensins ClickDimensins uses a secure tw-way interface t yur CRM instance t receive requests t prcess sends and return statistics, web analytics, web frm submissins, surveys and mre Fr mre infrmatin abut this interface, please refer t the Cnnectivity sectin f this dcument Only the data needed t supprt yur marketing analytics is used by ClickDimensins t supprt yur marketing autmatin Please refer t the Data sectin f this dcument fr further details ClickDimensins is cmpletely hsted within Micrsft Azure and utilizes Micrsft tls t ensure the security f the limited amunt f [yur] custmer data that is used t create an message Please refer t the Security sectin f this dcument fr further details ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 4

5 3. Cnnectivity In rder t use the rich marketing autmatin features f ClickDimensins, ClickDimensins must be able t cmmunicate with yur CRM system. Installing ClickDimensins in yur CRM sets up a tw-way integratin where users can design templates, frms, landing pages and mre frm within CRM. This integratin als supprts the submissin f jbs t the ClickDimensins clud service. As yur messages are distributed, ClickDimensins synchrnizes data, such as pens, clicks and cmpleted web frms, back t yur CRM. 3.1 Web Services ClickDimensins cmmunicates with yur CRM using nly Micrsft-dcumented methds t interact with CRM s web services (this methd is described in Micrsft s Sftware Develpment Kit). Cmmunicatin via web services requires yur CRM t be accessible frm the web, hwever, yu cntrl hw this web accessibility is delivered. 3.2 Cnnectivity Methds ClickDimensins suggests Internet Facing Deplyment (IFD) cnfiguratin fr yur CRM system t allw the ClickDimensins applicatin t integrate with yur CRM withut being n yur netwrk. Access via IFD allws the cmmunicatin between ClickDimensins and yur CRM t be encrypted. This is the recmmended secure methd t enable an Azure-hsted applicatin t cmmunicate with an n-premise deplyment f Dynamics CRM. Fr rganizatins whse security requirements prevent them frm permitting cnnectins t be initiated frm external surces t their n-premise CRM deplyments, ClickDimensins has develped the Service Bus Relay Cnnectr (SBRC), which des nt require Active Directry Federatin Services (ADFS) r IFD. This methd is mre cmplex since it requires a client prxy applicatin t be installed and run n the custmer s netwrk, and fr the netwrk t be cnfigured t permit the establishment f a relay with Micrsft s Azure Service Bus. A third ptin fr cnnectivity is t expse the CRM website t the internet thrugh standard web publishing techniques Internet-Facing Deplyment ClickDimensins recmmends that yur CRM envirnment be cnfigured fr Internet-Facing Deplyment (IFD) t supprt ur cnnectivity requirements. IFD is Micrsft s recmmended methd fr cnfiguring secure external access t CRM. CRM 2011, 2013, 2015, 2016 and newer versins f CRM require ADFS, a claimsbased authenticatin service. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 5

6 Cnfiguratin f IFD enables the ClickDimensins services t access yur CRM withut being n yur netwrk. Access via IFD allws the cmmunicatin between ClickDimensins and yur CRM t be encrypted. The belw diagram utlines the cnnectin between a client applicatin, such as ClickDimensins, and CRM when ADFS is used in an Internet-Facing Deplyment f CRM. In this diagram, ClickDimensins is the Client applicatin. T ensure cnnectivity frm yur CRM server t the ClickDimensins system, it may be necessary t add an exceptin rule t allw utbund requests frm CRM t the ClickDimensins web applicatin endpint using SSL/443. Furthermre, fr inbund cmmunicatins, yur firewall may need t be cnfigured t permit the ClickDimensins applicatin t cnnect t the CRM and ADFS servers n the secure prt cnfigured fr yur CRM website. Fr a cmplete list f the IP addresses fr the ClickDimensins services which may initiate inbund cmmunicatin t CRM, refer t ur help site article n this tpic Service Bus Relay Cnnectr (SBRC) Fr rganizatins whse security requirements prevent them frm permitting cnnectins t be initiated frm external surces t their n-premises CRM deplyments, ClickDimensins has develped the Service Bus Relay Cnnectr (SBRC). The SBRC is available at an additinal annual cst fr prvisining and nging supprt and sftware maintenance. The SBRC is a small applicatin that must be installed n a server within the custmer s netwrk and which serves as a prxy relay that interacts with Micrsft s Azure Service Bus. Frm Micrsft s descriptin f the Azure Service Bus: Azure Service Bus prvides a hsted, secure, and widely available infrastructure fr widespread cmmunicatin, large-scale event distributin, naming, and service publishing. Service Bus prvides cnnectivity ptins fr Windws Cmmunicatin Fundatin (WCF) and ther service endpints that wuld therwise be difficult r impssible t reach. Endpints can be lcated behind netwrk address translatin (NAT) bundaries, r bund t frequently-changing, dynamically-assigned IP addresses, r bth. The cre features f the ClickDimensins SBRC are: ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 6

7 Wrks with CRM 2011 and new versins f n-premise CRM deplyments t cnnect t the ClickDimensins applicatin in Micrsft Azure Des nt require IFD r ADFS Prvides highly secure, encrypted integratin between ClickDimensins and n-premise CRM deplyments Supprts multi-tenant deplyments Creates a persistent relay with the Azure Service Cnnectivity with SBRC Inbund Cnnectivity ClickDimensins cnnects t Micrsft CRM When ClickDimensins has data t synchrnize t CRM, the ClickDimensins applicatin in Azure cnnects t Micrsft s Azure Service Bus, sending encrypted data and the accunt s cnnectin details t the Service Bus. Micrsft s Service Bus cnnects t the SBRC The Service Bus in Azure uses the established relay t cnnect t the SBRC, sending encrypted data and cnnectin details t the SBRC. The SBRC cnnects t CRM The ClickDimensins prxy service, running n a server in the custmer s netwrk, cnnects t CRM, handling authenticatin and submitting data via CRM s web services. Outbund Cnnectivity CRM submits requests directly t ClickDimensins The SBRC is nt invlved in utbund cmmunicatin frm CRM t ClickDimensins. Requests frm plugins are submitted via HTTPS directly t ClickDimensins web service endpints in the clud. The CRM server (in particular, the Micrsft CRM Sandbx Prcessing Service) must be able t cnnect t (US data center accunts) r (EU data center accunts). End users interact with the ClickDimensins web applicatin End users can design templates r frms using the ClickDimensins web applicatin UI, launched frm within the CRM UI. The SBRC is nt used except t authenticate the web applicatin behind the scenes. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 7

8 3.2.3 Standard Web Publishing If yu chse nt t use IFD t expse yur CRM website t ClickDimensins, yu can make it available using standard web publishing techniques (i.e., pen the firewall t a public IP fr the CRM server and permit direct Windws authenticatin). This methd is apprpriate fr develpment r testing and is nt recmmended fr prductin envirnments. This apprach can be less cmplex t cnfigure than IFD. Nte that this methd will allw the ClickDimensins clud service t cnnect t yur CRM, but will nt enable ther applicatins, such as the CRM Outlk client t access CRM while utside f yur netwrk. In this scenari, users and ur service wuld be able t access CRM externally thrugh standard Windws authenticatin. Please nte, if yu prvide us with just a public IP address fr yur CRM server, it will nt be pssible t use SSL, since the CRM address wuld need t match the SSL certificate. Fr example, the CRM address wuld need t be s that yu culd apply a cmmercial SSL certificate that matches the address crm.mycmpany.cm. Alternately, if yu wish t just use an IP address and wish t further secure the cnnectin, yu can cnfigure yur firewall t restrict access t nly ur IP addresses fr better security, but traffic will nt be encrypted if yu d nt use SSL. We cannt advise n firewall cnfiguratin (TMG, F5, ISA, etc.) fr this setup as it is nt a setup that Micrsft dcuments fr external CRM access. Fr a cmplete list f IP addresses fr the ClickDimensins API, refer t ur help site article n this tpic. 3.3 Service User T supprt the cnnectin t yur CRM system frm the ClickDimensins service, a CRM user with the ClickDimensins Service User rle must be created and registered with ClickDimensins. Assignment f the ClickDimensins Service User security rle t a CRM user is administered and cmpletely cntrlled by yu. Fr additinal security, when yu register with ClickDimensins, the details yu submit are securely encrypted. The credentials fr the ClickDimensins Service User are held in a securely encrypted state and used nly by the ClickDimensins web services. T prtect yur CRM data, ClickDimensins develpment and supprt staff d nt have access t the passwrd fr this user. Changes t the ClickDimensins Service User and its passwrd remain cmpletely within yur cntrl and are submitted via the ClickDimensins Settings page within yur CRM. All updates t the service user submitted via the ClickDimensins setting pages are securely encrypted. 4. Data ClickDimensins des nt directly access r cpy yur CRM database. Yur data is maintained safely and securely in yur database. Hwever, limited amunts f data will be submitted thrugh ur web services. The specific data elements submitted and then prcessed by ClickDimensins depends n which tls yu use and what fields yu chse t include in yur s, surveys, frms and prfile management page. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 8

9 The belw table prvides an verview f the data prcessing and strage element fr sme f the key ClickDimensins functins. Functinality Stred Data Element(s) System(s) Hlding Data Persistent? Cnnectin Details URL, Org Name, Dmain, User Name, Passwrd CRM Database ClickDimensins Clud Applicatin s Sends Recipient Addresses ClickDimensins Events Events CRM Database ClickDimensins Clud Applicatin Persnalized Sends Selected fields frm CRM t persnalize messages ClickDimensins Clud Applicatin Yes Yes Yes N nly held in memry while s are being created Web Frm Submissin Prfile Management Frm Data Fields ClickDimensins Clud Applicatin Yes Recipient Prfile Fields ClickDimensins Clud Applicatin Yes Surveys Frm Data Fields ClickDimensins Clud Applicatin Yes 4.1 Cnnectin Details The details needed fr ur web services t prcess yur data and update yur CRM are held within ur internal systems. These cnnectin details include the passwrd fr the ClickDimensins Service User that has been set up fr yur accunt. This passwrd is securely encrypted and used nly by ur web services t access yur CRM system fr prcessing. ClickDimensins develpment and supprt staff d nt have access t yur service user passwrd and thus have n access t yur CRM system. 4.2 Data Prcessing The data yu submit fr prcessing by ClickDimensins is cmpletely within yur cntrl. Fr example, if yu chse t send s (either individual r bulk) via ClickDimensins, the nly infrmatin needed t prcess yur is the recipient(s) address. N persnally identifiable data needs t be included in yur sends. Hwever, if yu chse t use features such as persnalizatin t add cntact r lead specific fields frm yur CRM int yur s, then the fields that yu select fr including in the send are needed in rder fr us t display that infrmatin in the recipient s . All data submitted is encrypted in transit between CRM and ClickDimensins Sends An send is the recrd in CRM that a user creates t define the prperties f an jb. Anytime an is sent thrugh ClickDimensins, the user creates an send recrd. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 9

10 When sends are sent, a request is psted t ClickDimensins via securely encrypted web services where they are prcessed by ur services and individual messages are created fr distributin t yur recipients. The nly data needed by ClickDimensins t prcess an send recrd is the template, the recipient(s) address(es) and recrd IDs, the send prperties, and unsubscribe/subscriptin preference infrmatin. After this infrmatin is submitted fr prcessing, the address and recrd ID is held in ur system s that statistics fr the distributed s can be crrelated and psted back int yur CRM system fr reprting. The address, send date and template used are accessible by ClickDimensins supprt and develpment staff fr trubleshting purpses Events events such as clicks, pens, unsubscribe and spam are bradcasted t ClickDimensins clud platfrm in real time, as a result f sends. ClickDimensins prcesses the events and prduces aggregated statistics in relatin t the requests and recipients which generated the events. The events and related aggregatin are stred in ClickDimensins clud platfrm and synced back t the custmers CRM database Persnalized Sends One f the benefits f using ClickDimensins in yur CRM is that yu can persnalize yur s with CRM data. Yu can persnalize s with infrmatin frm lead, cntact and accunt recrds, as well as the sender (user) recrd. The specific infrmatin yu include in yur persnalized templates is decided by yu. Many custmers chse t include things such as the recipient s first name. templates can be custmized using the Add Dynamic Cntent buttn within the editr t insert the desired infrmatin frm lead, cntact, accunt and user (wner f lead, cntact r accunt) recrds int yur template. It is imprtant t understand that any dynamic cntent (persnalized fields) added t yur templates will be transferred t ClickDimensins when the send is transferred fr prcessing. This data is nt accessible by ClickDimensins supprt r develpment staff, but it will reside within the ClickDimensins system in rder t facilitate crrelatin f recipient interactins and synchrnizatin f this data back t yur CRM Frms Frms allw yur visitrs t submit infrmatin such as their name, lcatin and address, which yu can then stre in yur CRM. Such infrmatin can be used in a wide variety f ways and can help yu, fr example, see the areas in which yur prduct has garnered the mst interest, add custmers t yur lists r even identify new visitrs. Frms can be embedded in landing pages r directly n yur website, and submitted frms can be tied t the lead r cntact that supplied the infrmatin. It is imprtant t understand that data submitted in a frm by yur web visitr will be transmitted (via securely encrypted web services) t ClickDimensins fr prcessing, and will then be transferred int yur CRM system. This data is als lgged within the ClickDimensins applicatin. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 10

11 4.2.5 Prfile Management Prfile management allws yu t put a link t a frm in yur s that will pre-ppulate with that cntact r lead s infrmatin. This means yu can shw them what infrmatin yu already have and let them update the current infrmatin and/r add new infrmatin. It is imprtant t nte that when yu enable prfile management, the data fields that yu chse t include in the prfile (the pre-ppulated fields) will be transferred t ClickDimensins fr prcessing and will in turn be held securely within ClickDimensins Surveys Surveys are a way t get feedback frm yur custmer base r ther clients. They allw users t answer a set f questins yu prvide in rder t capture insight n hw yur prduct r service is being received. Fr example, users can submit valuable data such as a rating f the prduct, whether they wuld recmmend it t a friend, r their favrite feature. Surveys can be embedded in landing pages, r directly n yur website, and answered survey questins can be tied t the lead r cntact that supplied the infrmatin. It is imprtant t understand that when a lead r cntact submits a survey, the answers t the survey questins will be transferred t ClickDimensins fr prcessing and will, in turn, be held securely within ClickDimensins Web Analytics Web analytics captures data relevant t page visits that ccur n web pages where yu have added the ClickDimensins tracking script. The web analytics data that can be captured includes the fllwing: IP Organizatins: IP Address, Organizatin Name, IP City, IP Pstal Cde, IP State, IP Cuntry Annymus Visits: IP Organizatin, IP Address, Pstal Cde, Latitude, Lngitude, IP City, IP Cuntry, IP State Visits: Time in UTC, Start Time, End Time, Scre, Duratin, Ttal Pages, Bunce (yes/n), First Visit (yes/n), Entry Page, Exit Page, Referrer, Key Wrds, Referring Hst, Referrer Type, IP Organizatin, IP Address, IP Pstal Cde, IP Cuntry, IP State, IP City, Brwser, Operating System, Flash Versin, Language, Adbe Reader (yes/n), Linked Recrds (lead, cntact, campaign, annymus visitr) Page Views: URL, Page Title, Viewed Date and Time, Dmain, Hst, Adbe (yes/n), Flash Versin, IP Address, Type, Campaign, Brwser, Operating System, Language, Referrer, Pririty, Scre, Duratin, Keywrds, Referrer Type, Linked Recrds (lead, cntact, annymus visitr, visit, IP Organizatin) The web analytics data cllected will be transferred t ClickDimensins fr prcessing. It will then be sent t yur CRM envirnment where it will be held. After transmissin t yur CRM envirnment, n web analytics data is held by ClickDimensins; the data resides nly within yur CRM envirnment. Please nte, nt all f the data elements referenced abve are always able t be cllected (fr example, lngitude and latitude are nt always prvided). The data that can be cllected will ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 11

12 depend n what the IP prvider makes available, what brwser is used and several ther factrs. 4.3 Data Strage The data yu prvide t ClickDimensins t facilitate yur marketing is held securely in Micrsft s Azure data center as lng as yur accunt s subscriptin remains active. Access t this data is securely cntrlled and is nt generally available t ClickDimensins supprt r develpment staff. But, it will reside within the ClickDimensins system fr supprt purpses. 4.4 Data Access ClickDimensins is tightly cntrlled. Data will nly be accessed as necessary t reslve a supprt r service issue. ClickDimensins supprt and develpment staff have visibility f send transmissins via their analysis tls. Hwever, the infrmatin visible t them is limited t the address, send date and template used fr the send. This data is nly used fr supprt and trubleshting and des nt cntain any persnally identifiable infrmatin. ClickDimensins services are cmpletely hsted within Micrsft Azure. As such, n ClickDimensins persnnel have physical access t any f the servers. Physical access t the data centers is cmpletely cntrlled by Micrsft. 4.5 Data Ownership Yu wn yur data. ClickDimensins uses the limited data yu submit nly t prvide the services agreed upn, including purpses that are cmpatible with prviding thse services. We will nt use custmer data r derive infrmatin frm it fr advertising. 4.6 Data Lcatin ClickDimensins utilizes the Micrsft Azure data centers in the Netherlands, the United States and Australia. A cmplete versin f ur clud applicatin is hsted within each data center, thus yur accunt s prcessing and related data will reside in and never leave the data center in which yur accunt is hsted. 4.7 Data Privacy Yur data is kept cmpletely secure and private. ClickDimensins will never access r use yur data fr any purpse ther than as necessary t deliver the ClickDimensins functinality. If a gvernment requests custmer data including fr natinal security purpses it must fllw the applicable legal prcess, serving us with a curt rder fr cntent r a subpena fr accunt infrmatin. If cmpelled t disclse custmer data, we will prmptly ntify yu and prvide a cpy f the demand, unless legally prhibited frm ding s. We d nt prvide any gvernment with direct r unfettered access t custmer data except as yu direct r where required by law. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 12

13 5. Security ClickDimensins is cmpletely hsted in Micrsft Azure. 5.1 Azure Security Security and privacy are embedded int the develpment f Azure. Micrsft makes security and privacy a pririty at every step, frm cde develpment thrugh incident respnse. Please refer t the Micrsft Azure Trust Center fr mre in-depth security details related Azure Netwrk Security Operatinal Security Assurance (OSA) makes the infrastructure f Micrsft clud-based services mre resilient t attack by decreasing the amunt f time needed t prevent, detect and respnd t real and ptential internet-based security threats. It ensures that peratinal activities fllw rigrus security guidelines and validates that these guidelines are fllwed effectively. When issues arise, a feedback lp helps ensure that future revisins f OSA supprt mitigatins t address them. Azure blcks unauthrized traffic t and within Micrsft datacenters, using a variety f technlgies such as firewalls, partitined lcal area netwrks (LANs) and the physical separatin f back-end servers frm public-facing interfaces. 5.2 Azure Threat Management Micrsft s glbal incident respnse team wrks arund the clck t mitigate the effects f any attacks against the security f Azure. The teams are backed by centers f excellence that fight digital crime, respnd t security incidents and vulnerabilities in Micrsft sftware, and cmbat malware. Azure s DDS defense system is nt nly designed t withstand attacks frm the utside, but frm ther Azure tenants as well. Azure uses standard intrusin detectin and mitigatin techniques such as SYN ckies, rate limiting and cnnectin limits t prtect against these attacks Penetratin Testing Micrsft cnducts regular penetratin testing t imprve Azure security cntrls and prcesses. As an additinal measure, ClickDimensins cnducts its wn penetratin tests twice annually t ensure data security. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 13

14 Appendix A: Frequently Asked Questins Questin Hw des ClickDimensins cmmunicate with my CRM? Answer Installing ClickDimensins in yur CRM sets up a tw-way integratin between yur CRM and the ClickDimensins services. ClickDimensins cmmunicates with yur CRM using nly Micrsftdcumented methds t cnnect t CRM s web services (this methd is described in Micrsft s Sftware Develpment Kit). Is there a recmmended methd fr allwing cnnectivity t my CRM? ClickDimensins recmmends that yur CRM envirnment be cnfigured fr Internet-Facing Deplyment (IFD) t supprt ur cnnectivity requirements. IFD is the Micrsft s recmmended methd fr cnfiguring secure external access t CRM. CRM 4.0 uses an IFD tl t assist in cnfiguring frmsbased authenticatin. CRM 2011, 2013,2015 and 2016 require Active Directry Federatin Services (ADFS), a claims-based authenticatin service. Are cmmunicatins between my CRM and ClickDimensins encrypted? If cnnectin is supprted via IFD cmmunicatin between ClickDimensins and yur CRM is encrypted. Can I restrict the IP addresses that can access my CRM via IFD? Yes, yu can restrict access via yur firewall t just ur IP addresses. A list f these IP addresses can be fund n the ClickDimensins help and supprt site (r clicking here). Yu can expse the CRM website t the internet thrugh standard web publishing techniques (pen the firewall t a public IP fr the CRM server and permit direct Windws authenticatin). This apprach can be less cmplex t cnfigure than IFD. This methd will allw the ClickDimensins clud service t cnnect t yur CRM. In this scenari, ur service wuld be able t access CRM externally thrugh standard Windws authenticatin. Are any cnnectin methds besides IFD supprted? Nte: If yu prvide us with just a public IP address fr yur CRM server, it will nt be pssible t use SSL, since the CRM address wuld need t match the SSL certificate. Fr example, the CRM address wuld need t be s that yu culd apply a cmmercial SSL certificate that matches the address crm.mycmpany.cm. Alternately, if yu wish t just use an IP address and wish t further secure the cnnectin, yu can cnfigure yur firewall t restrict access t nly ur IP addresses fr better security, but traffic will nt be encrypted if yu d nt use SSL. Als, please nte that we cannt advise n firewall cnfiguratin (TMG, F5, ISA, etc.) fr this setup as it is nt a setup that Micrsft dcuments fr external CRM access. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 14

15 Questin What firewall changes are needed t allw ClickDimensins prper access t my CRM? Answer Many crprate firewalls restrict traffic t web services by IP addresses and prts thrugh the use f firewalls, prxies and ther security mechanisms. If this is the case in yur envirnment this can this can cause ClickDimensins and CRM t be unable t cmmunicate. A list f IP addresses that may need an exceptin thrugh yur firewall can be fund n the ClickDimensins help and supprt site (r clicking here). Are netwrks with prxies supprted? N, the utging request t ur API will nt supply prxy authenticatin credentials and may ultimately fail. In rder t circumvent this issue, yu will need t add the ClickDimensins IP addresses t the Prxy Bypass List. A list f these IP addresses can be fund n the ClickDimensins help and supprt site (r clicking here). D yu supprt VPNs r Azure Cnnect? We d nt supprt VPNs r Azure Cnnect. What if my cmpany plicy des nt permit cnnectins t applicatins inside ur firewall? Sme custmers have deplyed an additinal CRM web frnt end server in their DMZ in rder t prvide external access t their CRM system s web services. This is an ptin yu can explre with yur CRM partner and netwrk administratr. Is the cmmunicatin between ClickDimensins and my CRM secure? Yes. If yu register yur CRM using an address that starts with HTTPS, then ur cnnectin t yur CRM will always be securely encrypted using the SSL certificate yu ve installed n yur CRM website (r the ne used by Micrsft fr CRM Online). Nte that self-signed SSL certificates are nt supprted. Will my data leave the EU? Where des ClickDimensins maintain data centers? ClickDimensins uses Azure data centers lcated in the US, the EU (Netherlands) and Australia (NSW). When yu register yur slutin file, yu will be given the chice t register yur slutin fr the apprpriate data center. Our EU specific implementatins ensure that n data will be transmitted utside the EU. This setup has been established t cmply with the requirements f ur many custmers lcated in the EU. Can I retain cntrl f the passwrd that ClickDimensins uses t cnnect t my CRM? Yes, when yu register yur CRM with ClickDimensins, the cnnectin infrmatin is securely transmitted in encrypted frmat. At any time after installing ClickDimensins, yu can change the passwrd ur system uses frm within CRM by clicking n Settings > ClickDimensins Settings > Service Credentials. (Nte that yu must update it here prir t actually changing the passwrd fr the user.) What are the IP addresses f ClickDimensins service in Azure? A list f IP addresses can be fund n the ClickDimensins help and supprt site (r clicking here). Are backups r ther custmer data stred n any remvable media r mbile devices? Custmer data and cnfidential infrmatin is nt stred n any remvable media r mbile device. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 15

16 Questin What are yur plicies regarding security r data breaches? Answer ClickDimensins has never experienced a security r data breach, and maintains a detailed incident management and respnse plan. In the event f a security breach that may affect a custmer, ClickDimensins will in a timely fashin ntify the custmer via f the breach and prvide a descriptin f the ccurrence. In the event ClickDimensins reasnably determines t ntify a custmer f a breach and that it is necessary fr all r part f such infrmatin t be frwarded n t individuals n ne r mre f the custmer s lists, the custmer will prmptly frward such infrmatin t the individuals n such list r lists. What is ClickDimensins backup and/r disaster recvery plan? Because all hsting and prcessing f data is handled by Micrsft Azure, with 99.9% availability standard, and yur wn CRM database, any disruptin t ClickDimensins facilities wuld nt impact ur ability t deliver the service. ClickDimensins emplyees, cntractrs and vendrs are subject t a data access plicy with strict rules gverning access t prductin resurces. Hw des ClickDimensins manage emplyee access t the prductin resurces? Rule based access will be utilized in the prductin envirnments a batch f resurces will be encapsulated inside specific Azure Resurce Grups. Access t prductin envirnments in Azure require tw-factr authenticatin based n Micrsft accunts. As permitted by law, ClickDimensins emplys backgrund checks fr new emplyees. What happens t my data at the end f my cntract? ClickDimensins can purge all yur data frm the ClickDimensins service at the end f a cntract upn request. What are ClickDimensins physical access cntrls? ClickDimensins emplyees, cntractrs and thers are subject t infrmatin security plicies that gvern the handling f hardware, dcuments and media. Due t the clud nature f ur business, and hsting n Micrsft Azure, we d nt have any servers r ther strage devices lcated at ur facilities. Our facilities emply traditinal security measures and access cntrls. ClickDimensins may bserve and reprt back t yu n yur usage f the service, and make recmmendatins t imprve yur experience. Hw will ClickDimensins use my data? Can it be shared with any third party? ClickDimensins may aggregate usage data fr understanding custmer behavir and imprving the service; hwever, in n circumstance wuld findings include any infrmatin that culd identify a custmer r any cnfidential infrmatin. ClickDimensins will nt share any custmer specific data with any third party. In the event f a curt rder r subpena, ClickDimensins wuld ntify yu befre sharing any infrmatin. What cntrls des ClickDimensins use fr cntractrs/subcntractrs r cnsultants? ClickDimensins maintains an infrmatin security plicy and data access practices that apply t all emplyees, cntractrs and vendrs. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 16

17 Questin What types f security audits r third party testing are perfrmed? Answer Azure meets a brad set f internatinal and industry specific cmpliance standards, as well as cuntry specific standards. Please refer t the Micrsft Azure Trust Center fr additinal details. ClickDimensins cnsults third party security experts fr review f ur infrmatin security practices and recmmendatins. ClickDimensins has nt engaged any third party security audits r testing; hwever, perfrms regular penetratin tests. We have, hwever, had custmers perfrm their wn security testing fr their wn purpses. ClickDimensins Security Overview CONFIDENTIAL - Versin 1. 17