Security in Confirmit Software - Additional Options

Transcription

1 Security in Confirmit Software - Additional Options Unclassified. Copyright 2017 Confirmit. All Rights Reserved Page 1 of 5

2 1 Encryption of data exports If you are concerned about the safety of your data while in transit, Confirmit Horizons offers an add-on module where data transferred to and from our servers can be PGP-encrypted. PGP encryption works by encrypting and decrypting files using a matching public/private key pair. The public key is used to encrypt a file, and the private key is used to decrypt a file that has been encrypted with the corresponding public key. Public keys can be distributed to anyone who will be sending you encrypted files, while private keys should be kept safe and never shared with anyone. In order to export encrypted files from Confirmit Horizons, we will need a copy of your public key so it can be associated with your user account. Once uploaded, encryption of exports can be selected as shown in the screenshot below. Similarly, in order to support uploading of encrypted files into Confirmit Horizons, Confirmit has a secure private key installed on servers that handle encrypted files, and the public key that should be used to encrypt these can be found in the Home > Help > Public PGP Key menu in Confirmit Horizons. You can upload files encrypted with this key directly into Confirmit Horizons without having to specify that the file is encrypted - Confirmit will automatically decrypt the file for import into the relevant database upon task execution. PGP encryption can be enforced in company settings to apply to all file transfers (when enabled, this cannot be bypassed by users). Unclassified. Copyright 2017 Confirmit. All Rights Reserved Page 2 of 5

3 The Confirmit Horizons PGP Encryption add-on is available at an additional charge. Contact your account manager for pricing details. 2 Secure data file transfers The default delivery of files in Confirmit Horizons is via for exports from the system, and direct upload through the Confirmit Horizons GUI for files that will be imported. Confirmit Horizons supports an additional delivery mechanism for both imports and exports: File delivery through FTP/SFTP. In our SaaS environments, we run an enterprise file transfer server that currently supports connections over FTP and SFTP for file delivery and downloads. By enabling this feature, scheduled uploads can be set up for accepting files on a recurring basis (e.g. for scheduled synchronization of respondents from a CRM system), and size restrictions for exports are no longer an issue as the file transfer server does not limit the download file size. Additionally, transfers can be performed securely using SFTP, which uses the SSHv2 protocol to encrypt data and provides a similar command set as FTP (which means it can also be automated). Authentication methods over SFTP support username/password, key exchange (we associate a public key with your user account while you have the private key installed on your computer), or a combination of these two. FTP for file transfer can be enforced in company settings to apply to all file transfers (when enabled, this cannot be bypassed by users). SFTP can also be enforced on user or company basis in the file transfer software module. The Confirmit Horizons File Transfer add-on is available at an additional charge. Contact your account manager for pricing details. Unclassified. Copyright 2017 Confirmit. All Rights Reserved Page 3 of 5

4 3 Enforcing encryption of delivery Our mail software has the ability to enforce TLS encryption for delivery on target domain basis. If you want to ensure that s sent to a domain you control must be delivered over an encrypted connection, we can enable this for your domain in the server configuration for no additional charge. 4 Database encryption In addition to providing encryption of data for and under transit, Confirmit Horizons also supports encryption of data at rest by completely encrypting a survey or SmartHub database. This encryption is possible through the use of the Transparent Data Encryption module (often abbreviated TDE), which is included in Microsoft SQL Server Enterprise. The TDE module uses certificates to encrypt databases on disk and supports different encryption algorithms (see this MSDN article for a brief introduction on this feature). Database encryption can be enforced in system company settings to apply to all new survey and SmartHub databases (when enabled, this cannot be bypassed by users). Note: this setting must be set by Confirmit support; please contact support for more information. Unclassified. Copyright 2017 Confirmit. All Rights Reserved Page 4 of 5

5 The Confirmit Horizons Database Encryption add-on is available at an additional charge. Contact your account manager for pricing details. Unclassified. Copyright 2017 Confirmit. All Rights Reserved Page 5 of 5