Under Web Connection data security policies, all of IT operations undergo regular risk, compliance and business continuity reviews. The reviews are driven from multiple assessment frameworks including but not limited to PCI-DSS and PII, and occur at least annually.
For PCI-DSS we undergo an annual external audit by an independent auditor (currently BAE Systems) covering all relevant systems, risks and processes that fall under within the scope of the PCI-DSS certification. PCI-DSS Certification and Attestation of Compliance can be shared subject to appropriate confidentiality arrangements being in place.
In addition to regular calendar review events there are multiple sources of real-time, semi- real time and recurring information sources that give data on compliance, risk and operations within Web Connection. These data points are used to aid decision making and ongoing operational controls.
Information security documents, procedures, policies and training materials are regularly updated, reviewed and audited. Audits are performed on representative sample sets to ensure reasonable coverage by staff across the aforementioned materials.
All accounts on Web Connection systems have role based privileges. An accompanying audit trail with active/disabled status uniquely identifies user accounts. Segregation of duties is an underlying principle used to design Web Connection processes. In the cases where the above is not a good representation (like "root" account of systems) relevant compensating controls are in place. Roles and privileges are granted via systems with equivalent audit trails and approval gates and are regularly reviewed. Where possible roles and privileges are stored in change control systems. All user accounts that can access sensitive data are managed by automated systems and policies that enforce PCI-DSS compliant password standards, as follows:
Amazon Web Services (AWS) - Oregon region data centres house all production data and systems for Web Connection. No sensitive data is processed, managed, stored or archived outside of these locations. Physical security access is entirely managed by AWS with no input from Web Connection.
Web Connection does not keep any data in physical form.
Developers and systems personnel that work on PAN related products at Web Connection undergo a background check process that includes police criminal history checks. Developers are also trained on security paradigms like OWASP. All Web Connection staff undergo card data management training at start of employment and thereafter on a yearly basis.
All production assets at Web Connection are changed managed through set policies, procedures, approval gates and audit trails. This approach covers the entire lifecycle of software development, testing, release and post release operations. Typically emergency changes are assessed on an individual basis and subsequent actions are decided upon post assessment of incident. Whilst there are documentation for emergency fixes, most are performed the same way as regular fixes to reduce risk and maintain integrity of production environment.
The methodology for how Web Connection manages change, ensures data integrity, data protection and asset security is documented and reviewed by each relevant area of the business and subsequently audited by external auditors. This is then socialised as part of staff on-boarding as well as subsequent operational updates and regular update compliance training.
Web Connection has logically or physically separate environments from production for all development and testing. No sensitive production data will be transmitted, stored or processed in a non- production environment.
Key metrics of production systems and the operational health of the Web Connection platform is monitored 24x7 and tiered with multiple on-call teams and escalation procedures. These metrics cover networks, backups, uptime and security points, as well as product specific data including integration availability, uptime and integrity.
Data backup and retention schedules are documented in line with requirements of Web Connection business operation requirements. Security event logs and application audit trails are kept for one year online. Periodic checks are performed to ensure backup integrity and procedure completeness.
All data transfers with external parties are done over industry standard encryption channels. When sensitive data at rest it is encrypted by industry standard encryption and encryption keys are managed to satisfy PCI-DSS standards.
Dedicated incident (breach and non breach) management documents are reviewed, audited and socialised on a periodic basis at least annually in accordance with Web Connection’s DataSecurity Breach Policy. Web Connection also conducts a yearly roundtable around the incident workflow to flesh out operational gaps. Relevant personnel are allocated and trained for incident specific scenarios.
All security incidents are initially prioritised as critical, and then adjusted as the incident progresses and is assessed. Priority is given to containment. While active, all security incidents have dedicated resources applied until resolution of the incident is achieved. Following resolution, a post-event analysis is performed and all reasonably practicable steps are taken to implement measures to avoid recurrence and improve security for both direct and indirect related risks. All security incidents as well as known operational risks are recorded and managed from a central risk register.
Web Connection will advise all relevant third parties of any security or data breach in accordance with applicable legal requirements. Web Connection may share a high level summary of the incident timeline, data impact and resolution taken once confidence has formed around scope, impact and resolution.
External vulnerability scans are performed monthly by an PCI approved scanning vendor. Internal vulnerability scans are performed monthly and are wholly managed within Web Connection. Penetration testing is done on an annual basis by another independent external entity. Security notices and vulnerabilities are automatically monitored from “Ubuntu Security Notices” and “AWS Vulnerability Reporting”. Any vulnerability flagged by notification services are recorded, prioritised and applied based on risk parameters including severity, likelihood, compensating measures and impact.
Web Connection maintains and patches/remediates all systems, devices, operating systems, applications, and other software consistent with industry best practices. Security notifications like but not limited to USN and SANS are subscribed to as part of patch management process. Each vulnerability is then assessed on impact, likelihood, compensating measures and applied accordingly.
All production networks holding sensitive data has deployed dedicated firewall (AWS security groups), intrusion detection/prevention (IDS), file integrity management systems, systems hardening (CIS), and other network security technology in the operation of systems and facilities. Workstations will have anti-malware software deployed as of August 2018.
Web Connection uses cryptographically secure protocols that are generally accepted in the industry at all times to encrypt data when in transit or transported/stored via any physical media. Supplier will maintain an appropriate key management process, including, but not limited to, access controls to limit access to private keys, (both synchronous and asynchronous), key revocation processes, and key storage protocols.
Audit trails follow permanent changes to assist in reporting and auditing. The status and integrity of transactions can be determined by reporting and audit data trails. Reasonable efforts are undertaken to alert and proactively monitor transaction health and completeness.
Personally Identifiable Information (PII) and Personal Access Number (PAN) data are both protected to industry compliance levels and/or legislative compliance levels in the regions where Web Connection operates.
Dedicated systems and procedures include but are not limited to:
