Infrastructure, Security & Compliance

EYVO and DFARS NIST 800-171

Our own company already operates and adheres to the latest NIST 800-171 security framework standards. We have in place a Systems Security Plan and a Plan Of Action to address any identified gaps. We also maintain a long list of security policies, procedures and controls to address everything in the NIST 800-171 Standard.

Physical Security

With Azure providing the physical hosting infrastructure through their Azure service, Microsoft enforces physical security through a variety of methods as covered in their Security Whitepaper per this link

The buildings, servers, and infrastructure of Microsoft’s Azure service is the same as their multi-billion dollar retail business, so you can be assured that your application and data are secure.

Transport Security

We encrypt all communication between customers and our Azure center using military-grade encryption (AES-256 256 bit). Access to Eyvo’s applications and services is only available through Port 443 secure sessions (https) and then only available with an authenticated login and password. Passwords are never transmitted or stored in clear text, so cannot be read by third parties or bad actors.

Server and Perimeter Edge Security

We protect our application infrastructure by using Azure’s firewalls at both the infrastructure and application levels, as well as IDS ( intrusion detection systems) across all application and database servers. Anomaly detection systems instantly notifies operations staff, 24/7, if anything unusual is detected. In addition, we work with third party security firms and consultants to conduct vulnerability threat assessments including penetration tests.

As mentioned, all our front-facing servers are behind firewalls and only accessible via the https protocol. Database servers inside the perimeter firewalls are protected using several sub-nets with non-routable IP addressing schemes, network address translation.

We enforce a hardened operating system with level security by maintaining a minimal number of access points to all production servers. operating systems (O/S) accounts are protected using secure public key authentication schemes and only ops personnel have access to the servers. All O/S’s are run at each supplier's latest patch levels for security and are hardened according to recommended standards e.g. by removing/disabling any unnecessary users, irrelevant ports, and stopping unneeded processes. Access to the databases is controlled via a controlled password list.

Our employees are all background checked and go through a rigorous on-boarding and off-boarding process. They do not have direct access to live production equipment, databases or any customer data, except where necessary for system support management, maintenance, and backup restores. Access to customer data is further restricted to technical and customer support staff on an as -required basis. No parties outside Eyvo have access to customer data unless required by relevant law enforcement authorities. For more information, please refer to Eyvo’s Privacy Policy.

Application Security

No customer can see another customer’s data as each customer's data is held on their own separate SQL Server instance. This is additionally enforced by several additional layers of our architecture, including authenticated sessions, which are required for any page access. Sessions are stored in cookies that do not encode any customer identifiable information and no customer information is ever sent or stored during page access, thus preventing customer spoofing.

Reliability and Backup

In addition to the physical redundancy that Azure provides, we have redundant configurations for each component of our dependent infrastructure. All customer data is stored on Azure business class SQLServer with live failover and geographic replication where needed. All customer data is replicated in real time to a secondary environment in a different data center varying between the East and West regions of Azure and then continually backed up onto the Microsoft Azure service allowing an ‘any point in time restore’. The Microsoft Azure service is then replicated throughout the Azure data centers globally. We use Azure High Availability Business Critical Gen5 class servers.

Disaster Recovery Program

We’re able to leverage the Microsoft Azure cloud to provide a best in class disaster recovery program. Using Microsoft Azure services for data storage as described above we eliminate the risk of customer data loss. If the primary hardware for a customer fails, we can immediately switch over to the secondary hardware, which is running concurrently with the primary. If there is a disaster that fails both the primary and secondary servers, we have the ability to failover to any number of Azure data centers in the United States and in Europe, in a matter of minutes.

Database Security

Databases are partitioned for each customer so that the data for different customers does not commingle. Database infrastructure is completely segregated from the Application servers and the Internet via firewalls. Only application servers can query the database using strong authentication. Data is encrypted in transit and at-rest with cryptographically strong ciphers before storing into the database. Database servers have the same host-based security that protects all Eyvo servers.

Network Technicians Dedicated, Managed Firewalls Private Cloud

In partnership with our Custom Application Delivery Team, you may also run your own private cloud. It has the same benefits as all of the above but with the added difference that its not shared and you may also layer on top of it any custom application code you need. We allow you to change our code base to better fit your ideas of how the system should perform around your business.

Furthermore, we will provide you with structured access through our firewall so that you, and only you, can gain access to your raw data – perhaps to run additional reports or to link to 3rd party tools.

How we secure against brute force hacking

For regular retail clients – Access to our application can be as simple as just entering your user id and password but we would not recommend that route – usually that’s for systems that are self-hosted and that are behind a hardened corporate firewall.

For systems that we host for you on the public internet, we provide three additional optional pieces of access security:

CAPTCHA – This is a process that protects websites against bots by generating and grading tests that humans can pass but current computer programs cannot. For example, humans can read distorted text but current computer programs can’t – this optional piece is free of charge to switch on and is implemented system wide and affects all users on the system.

2 Factor Authentication (2FA) – The Knowledge factor and the Possession factor. In other words this works on the premise of something you know and something you have – a well known principle in computer security. In our implementation of 2FA we assume you can receive an SMS text message on your cell phone or you have a smartphone. After you have entered your userid/password (and the optional Captcha code) then you are asked to enter the 2FA verification code which you get from either an SMS message or the installed app on your phone. This verifies that you really are who you say you are – this optional piece does generally incur a small cost per user and is implemented on a per user basis only (for a minimum of 6 users) and so can be rolled out to all users or only to users who have high levels of approval authority.

Static IP & VPN – We only grant access through our Firewall from your fixed static IP address and also only via our VPN – this really locks you down to access from a specific site and ensures no one can ‘listen in’.

White Paper

We have a specific downloadable White Paper on this subject that you may like to download to share with your colleagues available from Here

Cloud Security Alliance

You may also download our Cloud Security Self Assessment (CAIQ v3.0.1) Response Document Here

Contact us for more information.