Security Overview

6. Communications and operations management

1. Our organisation maintains and periodically reviews a documented operational change management / change control program that has been approved by management and communicated to relevant employees.
2. Changes to the production environment including systems, application updates and code changes are subject to the change control process.
3. Our organisation IT configure organisation-wide security policies (Configuration options) for our user’s accounts to better protect access to our organisation. These configuration options include:

• • Multi-factor authentication;
  • Role-based administration;
  • Granular access control ability (based on IP address filtering);
  • Provisioning/deprovisioning process for our organisation’s user accounts;
  • Customised password policies;
  • Forced periodic password change;
  • Minimum password length and complexity;
  • User lockouts after repeated failed login attempts;
  • Disallowed password reuse; and
  • Encrypt passwords in transit and in storage; encrypted communications are required for all remote connections.

4. Our organisation uses a hybrid cloud model that includes AWS/Azure Cloud and on prem data centre hosting, the underlying physical infrastructure on which a customer’s Customer Data is stored is in data centre and our organisation SaaS runs on top of the AWS/Azure public cloud.

5. All hardware, software, and other supporting infrastructure is owned and managed by AWS or Azure or our Data Centre Hosting provider;

1. 1. AWS data centre controls are available at: https://aws.amazon.com/compliance/data-center/controls/.
   2. Google data centre controls are available at: https://www.google.com/about/datacenters/data-security/
   3. Azure data centre controls are available at: Securing the Microsoft Online Services infrastructure – Microsoft Service Assurance | Microsoft Learn

6. Our organisation’s SaaS is operated in a multi-tenant architecture that is designed to segregate and restrict access to Customer Data.

7. Our organisation’s cloud environment has a logging, monitoring and alerting process in place and is monitored using AI and machine-based systems to identify anomalies and trigger alerts when detected.

8. Our cloud environment has the following controls in place:

• Firewalls
• IDS/IPS
• Antivirus / antimalware
• Access login
• Security incident response

9. Our applications is hosted on AWS or Google infrastructure and as such AWS or Google is responsible for all network management.

7.    Access Control

1. Our organisation has an access control program that has been approved by management and communicated to all staff.
2. Our organisation Head of Department is responsible for ownership and regular review of our organisation’s access control program.
3. Our organisation uses a central identity and access management system to provision access by OUR ORGANISATION employees in accordance with the principle of least privilege.
4. Individual IDs are required for user authentication to our systems.
5. Segregation of duties is taken into account for approving and implementing access requests.
6. User access rights are reviewed at least yearly.
7. Access rights are reviewed when an employee changes roles.
8. Privileged user access rights are reviewed at least quarterly.
9. All privileged account activities are logged and monitored.
10. Multi-factor authentication is deployed for Office365 access, remote access (VPN) and privileged accounts (admin) access.
11. We enforced security policies in our applications, and our employees are required to use passwords that include:

8. Information systems acquisition, development and maintenance

1. Development, test and staging environments are separated from the production environment by either separate VPC, Availability Zone or physical location.
2. Our organisation utilises a formal Software Development Life Cycle (SDLC) process that has been approved by management and communicated to appropriate our employees.
3. The Head of Technology is responsible for maintaining and reviewing the SDLC policy.
4. We adopt Security by Design and Privacy by Design in our SDLC process.
5. We maintain a documented change management / change control process that includes:

• Change control procedures required for all changes to the production environment.
• Testing prior to deployment.
• Stakeholder communication and/or approvals.
• Documentation for all system changes.
• Version control for all software.
• Logging of all change requests.
• Backout procedures are required for production changes.
• For every release, the following security testing procedures are performed:
• Security requirements gathering.
• Security architecture review.
• Security signoffs.
• Secure code reviews.
• Vulnerability scans. 

6. Our organisation is subject to third party penetration testing at least annually.
7. Our organisation conducts regular vulnerability analysis.
8. Our organisation logs any production issue on a daily basis.
9. Security updates are performed on all servers;
10. Security events detected by A/V, IPS/IDS, MXDR;
11. For Customer Data sent or received electronically, our organisation encrypt Customer Data both in transit while outside the network and within the network.
12. For Customer Data stored electronically, we encrypt Customer Data at rest using AWS Key Management System (KMS) or Google Key Management System and AES 256-bits encryption.
13. We enable full-disk encryption on laptops, pc, mobile devices issued to our staff.
14. We employe HTTPS on all of our applications and X.509 certificate must be used for server authentication.
15. HTTPS must be used with RSA.

9. Information Security Incident Management

1. Our organisation has an established incident management program that has been approved by management and communicated to all employees.
2. Our organisation’s incident management program leverages a centralized incident management tool.
3. Our organisation maintains a formal incident response plan; it includes guidance for:
4. Feedback and lessons learned.
5. Applicable data breach notification requirements (including notification timing).
6. Escalation procedure
7. Communication timelines and process.
8. Procedures to collect and maintain a chain of custody for evidence during incident investigation.
9. Actions to be taken in the event of a Security Incident.
10. Testing of incident response plan occurs at least annually and includes:

• End-to-end testing.
• Security incident response and data breach response.
• Associated BCP / DR plans.
• Review of the test result by management and remediation if needed.

11. We notify our Cloud Service customers of

(a) Security Incidents as required by applicable law; and

(b) Personal Data Breaches without undue delay. Notification(s) of any Security Incident(s) or Personal Data Breach(es) (as applicable) will be delivered to one or more of the customer’s business, technical or administrative contacts by any means including via email.

12. We will provide all such timely information and cooperation as a customer may reasonably require in order for the customer to fulfill its data breach reporting obligations under applicable data protection laws.

13. We will take such measures and actions as it considers necessary to remedy or mitigate the effects of a Security Incident or Personal Data Breach and will keep respective customers informed in connection with such Security Incident or Personal Data Breach.

10. Business continuity, data backup and disaster recovery

1. Our networking, server and application components are configured in a redundant configuration.
2. Our databases are backed-up on a daily basis; back-ups are retained for a one (1) week period and each back-up includes any data retained for the previous twelve (12) month period on a rolling basis.
3. We has a business continuity plan (“BCP”) and disaster recovery disaster recovery (“DR”) plan.
4. We test our DR tests on a half yearly basis to validate the ability to failover a production instance from the primary data cente to the secondary data center utilizing our DR procedures.
5. The BCP plan is validated on an annual basis.

11. Supplier Relationship Management

1. Our organisation has established procurement guidelines that has been approved by management and communicated to all employees
2. External party access to information, information systems or information processing facilities can only be granted after an agreement have been completed and signed.
3. Access agreement must have (where applicable):

• Roles and responsibilities of the information asset owner and the external party.
• Signed NDA.
• Sub-contracting requirements
• Contractual documents
• Reporting obligations for suspected or actual security and data breach incidents

4. Prior to granting access to INTERNAL or CONFIDENTIAL information systems or information assets, information processing facilities for external parties, asset owners, project manager, project team members must:

• Determine if supplier have signed NDA (Non-Disclosure-Agreement).
• Determine that risk identification, risk assessment and mitigation strategies have been implemented to address information security requirements.
• Determine that the security control implemented (if any) will not affect the service delivery level or incurred unnecessary cost to our organisation.

5. Prior to granting access to INTERNAL or CONFIDENTIAL information systems or information assets, information processing facilities for external parties, asset owners, project manager, project team members must:

• Determine if supplier have signed NDA (Non-Disclosure-Agreement).
• Determine that risk identification, risk assessment and mitigation strategies have been implemented to address information security requirements.
• Determine that the security control implemented (if any) will not affect the service delivery level or incurred unnecessary cost to our organisation.

12. Regulatory Compliance

1. Our organisation is based in Singapore and we follow the local regulatory requirements governing our business.
2. Under Personal Data Protection Act (PDPA) in Singapore, we have established the required Data Protection Policies, protection and data breach notification process.
3. Our DPO contacts can be found on our website and her email is dpo@knoveleng.com