Page1 Security & Privacy November, 2015 1
Introduction Lithium takes information security and privacy of personal data very seriously. We fully support and abide by the data privacy principals established in the EU Directive on Data Protection as well as all other applicable local privacy laws and regulations. Our security controls and mechanisms are based on the ISO 27001 global security management standard and we conduct external security audits and independent security testing on an annual basis. This datasheet provides a summary of the security measures implemented throughout the organization to provide full transparency and a peace of mind for Lithium customers that their personal data and information are in good hands. Privacy Audits and Compliance Lithium Technologies is a licensee of the TRUSTe Privacy Program and abides by the EU Safe Harbor Framework as outlined by the U.S. Department of Commerce and the European Union. The Safe Harbor Framework requires compliance with seven core principals of privacy including Notice, Choice, Transfer of Information, Access, Security, Data Integrity and Enforcement. In addition, the Safe Harbor Framework compliance requires an independent third party dispute resolution process for resolving data privacy issues and complaints as well as compliance verification by independent third parties such as TRUSTe. Verify Lithium s US-EU/US-Swiss Safe Harbor certification status here: http://safeharbor.export.gov/companyinfo.aspx?id=13668 Verify Lithium s TRUSTe Privacy Seal and TRUSTe Safe Harbor Programs here: http://privacy-policy.truste.com/click-with-confidence/eusafe/en/www.lithium.com/seal_m 2
Security Testing, Audits and Compliance At Lithium, we believe in raising the bar when it comes to security audits and compliance. We conduct various internal and external assessments on a regular basis including but not limited to: Annual internal security audits, Annual independent SSAE 16 SOC 2 audits, Annual ISO 27001security assessment and certification, Annual static code analysis Continuous automated web application security penetration testing, Independent security penetration testing, and Monthly security vulnerability scanning. Annual SSAE 16 SOC 2 Audits The SSAE 16 auditing standard is the successor to the SAS 70 auditing standard and updates the US service organization reporting standard in line with the international service organization reporting standard ISAE 3402. Lithium conducts annual SSAE 16 SOC 2 audits using independent external auditors and has passed this rigorous assessment with no exceptions for the past two consecutive years. A full copy of the report can be requested by contacting security [at] lithium [dot] com. ISO 27001 Certification Lithium is ISO 27001:2013 certified, which is a global standard based on information security controls and management best practices. This venerable certification provides an assurance that Lithium has achieved full maturity in information security management practices according to the specifications of a world class security management standard. Certifying to the ISO 27001standard involves a rigorous three-stage assessment conducted by independent auditors. Subsequent annual onsite audits are required to maintain the certification. Click this link to verify the Lithium s ISO 27001 certification status: http://www.bsigroup.com/en-gb/our-services/certification/certificate-and-clientdirectory/searchresults/?searchkey=standard%3diso%252fiec%2b27001%26licence%3d574923%26company%3 dlithium%2btechnologies&licencenumber=is%20574923. Security Penetration Testing In addition to the industry compliance assessments referenced above, Lithium conducts annual internal security audits, annual independent security penetration 3
testing, security code reviews, security vulnerability scanning, and continuous automated and manual web application security penetration testing. Lithium welcomes responsible security testing by our customers. Numerous Lithium customers perform independent security audits and testing of their Lithium implementations at least annually. Since Lithium operates a shared multitenant SaaS environment, we limit all security testing to our staging or nonproduction environments. Lithium Security Testing and Reporting Policy is available on our website at https://www.lithium.com/security. Hosting in Europe Lithium is committed to its European customers and has made significant investments in the region. One notable investment is our hosting facility in the Netherlands using an industry-leading collocation provider, Equinix. The Equinix data center is a mission-critical Tier 3+ facility that conducts separate annual SSAE 16 SOC 2 and ISO 27001 assessments using independent auditors. While Equinix provides the collocation space, physical security and access to telecommunications resources, Lithium owns and manages the entire services infrastructure. Physical Security Lithium communities are hosted in independently audited and certified secure datacenters. The security measures permeate through the entire facility including but not limited to a CCTV monitoring system, digital video recorders, man traps, biometric identification, mandatory visitor check-ins, a 24x7x365 front desk, and security guards around the clock. Datacenters are also equipped with fire, water, and heat detection and protection systems as well redundant UPS and diesel generators for uninterrupted high availability operation of mission critical systems. All systems undergo regular maintenance and are tested at least every ninety days for proper operation and safety. Access Security Access to the datacenters is restricted to authorized Lithium staff and trusted local European vendors for remote-hands system management only and reviewed on a regular basis. Multiple forms of authentication are required to access the facility such as a valid picture ID, a secret PIN code, and biometric identification (hand or palm geometry scan). 4
Logical access to the live customer environment can only be established via a secure encrypted session and is restricted to authorized Lithium staff. All administrative access is continuously logged and audited on a regular basis. Personal Data Storage and Protection Lithium products are designed to promote collaboration and social engagement which requires some personal information to be collected to allow for a safe, responsible, yet friendly environment for all community users. The collection of any personal information on our communities reflect first and foremost the core principles of privacy including but not limited to disclosure, timely notice, responsible collection and usage, accountability, and security. There are only three pieces of required information to register and login to a community, including a username, a password, and a working email address. There may be other pieces of information such as a first name, a last name, location data, or a custom avatar that users may share and disclose at their personal option and choice. All personal user information with the exception of the avatar is securely stored on Lithium servers using strong AES 128-bit encryption. The user passwords are stored using a strong cryptographic one-way SHA 512-bit hash with a unique salt. The one-way nature of the SHA 512-bit hash and unique salt ensures that no one including Lithium will ever know of the actual user password other than the user herself. Additional Security Controls Proactive Monitoring Lithium monitors all its customer implementations and critical infrastructure on a 24x7x365 basis. An alert system is tied to each of the site s health statistics as well as all major parts of the Lithium hosting infrastructure. All major services such as DNS, firewalls, servers, and Internet connectivity are actively monitored. Alerts are also set up to monitor security-related events and detect security violations from the Intrusion Detection System. Security auditing is enabled on host systems and logs are sent to a secure log collection system for retention and safe keeping. In addition to proactive alerts, security logs are monitored regularly and audited on a monthly basis. Application Security Lithium has deployed a secure software development lifecycle process (Secure SDLC) to ensure that security is tightly integrated within the application. We conduct regular security design reviews and security QA testing before each 5
release cycle. A rigorous set of manual and automated security tests are conducted for each release cycle, typically several times a month, in addition to security code reviews and web application penetration testing before releasing it to the customers. The Lithium application also has several layers of security to address common web application security flaws and attacks, some of which include: An extensive input and output validation layer checks and validates for proper and expected input and output to protect against cross-site scripting and script injection attacks. All user-provided content, such as the URI, query string parameters, form submissions, cookies, etc. are validated through this framework before the underlying application layers are allowed to handle the request. All non-validated input is either escaped or rejected as necessary. The application has a robust permission system which allows granular control over user, role, and group level access. Permissions and roles can be applied at the global community level, on categories, boards, and individual users. The fine granularity of the permissions ensures that users can be granted the specific access they need without having to grant them excessive rights. All unauthorized access attempts are logged in the audit logs. User provided content is also checked and validated using an intelligent HTML parser. Administrators can specify which HTML tags are allowed including tag attributes and sub-tags. This intelligent parsing protects against many forms of attacks such as cross-site scripting and script injection. By providing such extensive HTML parsing capability we can allow users to safely use HTML tags for rich and lively content creation without forcing them to learn custom or proprietary markup languages. Sensitive features and form submissions are protected with secure and time sensitive tickets to protect against cross-site request forgery attacks. The ticketing system is completely transparent to the user and helps protect against cross-site request forgery attacks that can originate from external content outside of Lithium s control. Logging is enabled to record key information about the system and user requests such as the request timestamp, URL or action, agent or browser type, and source IP address. In case of a security breach, Lithium can review these logs to identify exactly how and when the breach took place as well as any actions and damage that the intruder may have inflicted. 6
In addition to the Secure SDLC process and the web application security mechanisms described above, Lithium conducts annual independent security penetration testing. We also conduct our own internal web application security penetration testing and security code reviews on a regular basis. Infrastructure Security Lithium is ISO 27001certified, which signifies that our security controls and mechanisms are modeled after a globally accepted standard based on security best practices: Redundant multi-tier firewalls allow relevant ports only such as port 80 (HTTP) and port 443 (HTTPS); Front-end application and web servers are isolated from utility services such as DNS and SMTP; Database servers are in a separate data island firewalled from the front-end servers; No direct access from the Internet is allowed to the database servers; Intrusion Detection Systems are deployed to monitor unauthorized access or detect malicious traffic; Regular security vulnerability scanning on a monthly basis, at minimum. System-level security conforms to the same high standard of security best practices: Only necessary services and software are installed; Servers are regularly updated with the latest security patches; All management traffic to the servers is encrypted; Malware detection tools scan for malicious uploads and attachments; Administrative access to servers is restricted to authorized staff and must occur over a secure encrypted session. All administrative access is logged and monitored; Security auditing is turned on and logs are sent to a secure log collection system. Database encryption All customer production databases are considered sensitive customer data that might contain personal information or password hashes. Access to that data is restricted and protected using a broad set of security controls including, but not limited to, encryption at rest (hence the ISO 27001 and SOC 2 annual audits). 7
Currently, the following data is stored encrypted at rest (minimum AES 128-bit): Lithium communities: user profile table and specifically user email addresses and password hashes. Lithium Social Intelligence: same as above Lithium Social Response in AWS: Encrypted AWS volumes (AES 256-bit) Denial-of-Service (DDoS) Attack Defense Lithium platform is highly scalable, and we can quickly scale vertically and horizontally to handle sudden spikes. Since we can handle very large volume of traffic without any major performance issues, most DDoS (Denial of Service) attempts are futile and fail. However, in the rare cases when large capacity and scalability are not enough, we have strong measures in place to combat this type of issue. For example: At the application layer, we have resource pools to monitor access to resources and apply throttling dynamically per IP and per session when certain thresholds are met. We can tweak these pools on-demand, as needed. We use a CDN provider which provides caching on most static assets and reduce latency and load on the application. We have continuous monitoring of all production sites. Any deviations from baseline latency or page views/requests are immediately investigated. We have network-level denial-of-service protection on our network devices. Additionally, we use a reputable DDoS attack migration service provider for combatting large DDoS attacks on our sites. All of these measures are typically used in combination to handle any possible attack scenario. Vulnerability Management Apart from security hardening and installing security patches during the controlled build process, Lithium has adopted a standards-based approach to vulnerability lifecycle management following these four key steps: Acquire, Assess, Manage, and Report. Acquire - during the Acquire phase, we collect relevant security information via subscriptions to various security outlets such as US-CERT, Secunia, SANS, BugTraq, as well as direct mailing lists and notification from vendors such as Microsoft. There might be other events and processes that feed in to the Acquire phase such as security incidents, security alerts, and security scan reports. 8
Assess during the Assess phase, the acquired vulnerability information is assessed for relevance and criticality based on a pre-established criteria. High risk, high severity items are classified as P1 and mitigation is rolled out on an urgent basis. Other categories are prioritized based on the likelihood and impact of a given vulnerability. Manage during the Manage phase, we acquire the patch and deploy it using appropriate tools to the target systems. The patches are tested in the QA environment before they are rolled out to the production environment. Standard patches are installed during normal maintenance windows on a published schedule. Report during the Report phase, the systems are assessed using manual and automated tools to report on the status of security patches. Any missing patches and updates are processed using the Lithium vulnerability management lifecycle process. Incident Response Lithium s incident response process conforms to ISO 27002security best practices. It involves the following phases: Detection, Validation, Response, and Recovery. Detection the Detection phase involves monitoring of systems, security alerts, security log reviews, vulnerability scanning, and penetration testing to detect information security incidents. Validation the Validation phase involves analysis and prioritization of detected security incidents. Response the Response phase includes proportionate response based on the prioritization. This phase may include one or more steps such as containment, evidence collection, and eradication. Recovery the last step in the process involves recovery and lessons learned. The incident response process is thoroughly documented and exercised at least once a year. Lithium also has provisions for customer notifications in case of a breach involving customer or personal data. Redundancy, Backup, and Disaster Recovery The hosting infrastructure at Lithium is designed with multiple redundancies for maximum uptime. Secure datacenters have UPS and generator backup systems for power and diverse entry points for key utilities and communication facilities. Multiple high-speed Internet Service Providers for fast Internet connectivity using BGP for redundancy and automatic failover. 9
Critical systems are set up in a redundant manner to eliminate single points of failure. This includes redundant servers, load balancers, firewalls, switches, and routers. Servers are deployed with redundant power supplies, redundant network cards, and redundant disk storage. At the database layer, data replication is set up from master database servers to slave database servers in real-time. We also take regular snapshots throughout the day. Regular backups are made and stored offsite in a secure location for safety. The backups are encrypted using AES 256-bit encryption. Lithium s Disaster Recovery Plan is updated at least annually and tested on a six month basis. Contact Lithium For Privacy related requests please email privacy [at] lithium [dot] com. Please consider using a secure communication method such as PGP or SMIME for sharing sensitive information. o Lithium s Privacy Policy is located at http://www.lithium.com/privacy. For Security related requests please email security [at] lithium [dot] com. Please consider using a secure communication method such as PGP or SMIME for sharing sensitive information. o Please be sure to read and adhere to our Security Testing and Reporting Policy at https://www.lithium.com/security. For all other inquiries please open a support case by visiting our online Support Portal at https://lithosphere.lithium.com and clicking on the Support tab. For sales related and general inquiries please contact your designated Account Manager or visit our website at http://www.lithium.com and c Contact tab. 10
About Lithium Lithium Technologies helps leading companies use social media to engage customers and drive business results. We create vibrant social communities across websites, Facebook, and the broader social web that increase sales, reduce service costs, and accelerate innovation. The world's most innovative companies such as AT&T, Best Buy, Sephora, and HP use Lithium to engage their customers in breathtaking new ways (literally, breathtaking). They're increasing revenue, reducing expenses, and strengthening their brands. And most importantly, they're building a lasting competitive asset a brand nation with their customers. 11