Enterprise-grade security you can trust

• The organisation implements attack-monitoring tools—such as network-based intrusion detection and prevention, and web-application firewalls.
• The organisation also implements Layer 7 web application firewalls.

• Anti-malware is installed on all endpoints (desktops, laptops, smartphones and tablets).
• App-code signing, sandboxing and file quarantine are used for all smartphones and tablets.
• EDR/XDR technology is used as anti-malware agents on all desktop and laptop computers.
• EDR/XDR is managed and monitored by a 24/7 Security Operations Center (SOC).
• Anti-malware is centrally managed and monitored by authorised personnel only.

• The organisation implements controls that limit access to the organisation’s data to trusted servers and applications over encrypted channels with strong authentication.
• The organisation implements controls that limit access to the organisation’s critical third-party applications and data to trusted devices or endpoints using only encryption and strong authentication.
• The organisation implements multi-factor authentication (MFA) for its staff to access data in critical applications.
• Data access is locked down so that consultants needing access to our applications also need a trusted endpoint.

• Incoming HTTPS connections are protected with at least TLS 1.2 encryption.
• Equivalent security is used for other types of encrypted connections such as Ipsec, SSH or SFTP.
• Asymmetric file or message encryption uses RSA with at least 2048-bit keys or ECC with standard curves such as P256.
• Symmetric file or message encryption uses AES with at least 256-bit length.
• Endpoints (desktops, laptops, smartphones and tablets) are protected with full hard-drive encryption.
• Off-site database backups are protected using strong encryption.
• Emails are encrypted in transit, over the internet, server-to-server, inbound and outbound, using opportunistic TLS encryption.
• Specific email domains are protected with forced TLS transit encryption.
• The Merchant API requires the use of cryptographic signatures, both for incoming requests and outgoing replies, in addition to TLS transit encryption. This guarantees proof-of-possession and minimises the risk of a MITM attack.
• The checkout service uses per-session point-to-point asymmetric encryption for sensitive end-user data, such as passwords or challenge codes.

• Local host Layer 3 firewall devices are used internally to support the implementation of access-control lists (ACLs).
• Layer 3 firewall devices are used to control the network traffic between the public internet and the organisation.
• Layer 7 firewall devices are used to inspect and control the traffic between the public internet and the organisation’s service.
• Network ACLs are used to control communication between the organisation’s network, sites and clouds.
• System ACLs are used to control system access or object access (e.g storage objects).
• ACLs are managed by authorised employees and are based on job description (for system ACLs) or pre-approved network designs (network ACLs).
• ACLs are reviewed at regular intervals (based on classification) or when major changes occur.

• Logical access control is implemented for all systems and services within the organisation.
• Access permissions are allocated via an approval process and are related to the job description.
• Access permissions are allocated on a least-privilege basis.
• Access permissions are reviewed periodically based on the classification of the system/service.

• Centralised logging is implemented for applications participating in the offering of the organisation’s payment service.
• Logs are accessible by authorised employees, based on the need-to-know principle.
• The log management system is managed by authorised employees.
• The log management system generates alerts based on predefined criteria.

• The organisation implements an MDM solution for endpoint devices (desktops, laptops, smartphones and tablets), covering both employees and long-term consultants within the organisation.
• The MDM solution controls who has access to each endpoint using conditional access and two-factor authentication.
• The MDM solution controls endpoint settings like allowed applications, as well as security settings like encryption and login details.
• The MDM solution controls endpoint updates like the operating system and application updates that can be pushed to specific devices as needed.
• The MDM solution can be used to lock or remote-wipe endpoints that have been misplaced.
• The MDM solution is managed by authorised employees.

• The organisation implements multi-factor authentication (MFA) both for services provided and consumed by the organisation.
• The organisation implements a number of approaches to MFA based on system/service/data classification:
  1. Hardware token MFA
  2. Device certificates
  3. User certificates
  4. Software token MFA (such as TOTP)
  5. SMS (text) MFA

Security updates are automatically installed.

Source code changes are cryptographically signed by the developer using GPG with private key on a personal HSMs.

• The organisation implements a vulnerability-management program for internal and publicly exposed assets and services.
• The organisation implements a source code vulnerability scanner.
• The organisation executes a vulnerability assessment of internal and publicly exposed assets and services on a weekly basis where vulnerabilities are prioritised according to their severity.