The IronBox Data Protection and Privacy Platform
We don’t take any chances when it comes to your data and reputation. Here’s how we protect your data.
Design
Development
Verification
Deployment
Maintenance
Mobile
Design
Defense in Depth
Designed with multiple layers of defense to provide the best security experience.
Secure Defaults
All settings and features are pre-set with the most secure settings by default.
Reduced Attack Surface
Services are designed only to expose only necessary endpoints and limit number of potential attack vectors.
Separation of Data
Critical security data is separated helping to ensure that a compromise of one component does not lead to an entire system/data compromise.
Non-Repudiation
Your data is handled in an application environment where the authenticity of critical actions can be verified.
Multi-Factor Authentication
Enhanced security using SMS based access codes is built into the platform at no-extra cost to you.
Data Protection at Rest
Our IronBox platform keeps your data protected at rest using AES-256 bit encryption (CBC).
Data Protection in Transit
SSL tunnels using 2048-bit public keys and AES-128 bit encryption help ensure your data stays safe while transmitted across networks. In many cases data is pre-encrypted before entering SSL tunnels.
Data Protection on Access
Our IronBox platform keeps your data safe when it’s being accessed (from disk, memory and more).
Data Protection on Disposal
We take proprietary steps to help ensure that the data you delete stays deleted and can’t be easily recovered.
Data Expiration and Availability
With IronBox you don’t need to worry if your data is exposed or unnecessarily left in the cloud. IronBox can automatically expire your data for you so you don’t have to.
Geo-Spatial Protection
Our patent-pending technology helps ensure that your data is not exposed to threats that arise from it’s actual physical location (coming soon)
High Privacy
Your data is encrypted such that even we can’t access it once it’s been locked by IronBox. This helps provide the highest privacy and security for our customers and their data.
Platform Protection
Design utilizes platform protection mechanisms whenever possible.
Development
FIPS-Approved Implementations
Only FIPS validated cryptographic libraries are used for data protection.
Symmetric Encryption
AES 128-bit or 256-bit (default) CBC is used for symmetric data encryption operations.
Asymmetric Encryption
Variable length RSA (2048 default) is used for asymmetric encryption operations.
Server-Side Input Validation
White-list input validation is required for un-trusted data and helps reduce risk from many common attacks. Mandatory server-side validation is performed.
Anti-SQL Injection Library
We co-invented the Anti-SQL Injection Library which helps ensure that un-trusted data is parameterized to reduce the risk of common database injection attacks.
Data Context Encoding
Un-trusted data is encoded using the AntiXSS library or a standard encoding library to reduce the risk from cross-site scripting and related attacks.
Generic Exception Handling
Generic error handling helps ensure that information that could aid attackers is not exposed.
100% Managed Code Implementation
A managed code implementation greatly reduces the risk from common injection and memory corruption attacks, such as buffer overflows.
Key Hardening
Any symmetric keys derived from user data is generated using standard key derivation protocols and hardened with iterations that exceed industry recommendations.
Cryptographically Random Data
Any random data used for security related functions is cryptographically generated.
Standard Authentication/Authorization
Standard authentication/authorization libraries and identity providers are used to help prevent unauthorized access.
Anti-Session Fixation
Controls are implemented to help mitigate risk from Web-based session fixation attacks.
Verification
Manual Code Reviews
Manual code reviews are performed regularly by senior security developers to identity and mitigate potential risks in code.
Automated Code Reviews
Automated code scanning is used to supplement code review efforts to reduce risk in code.
Security Unit Tests
Security unit tests are developed to validate security functionality and detect regressions.
Deployment
SSL Certificates
Minimum 2048-bit SSL certificate is used to protect all in-transit data.
Least Privilege
Least privilege deployment of services helps isolate damage from any potential attacks.
Reduced Attack Surface
Unnecessary services are disabled or uninstalled to limit potential attack vectors.
Generic Exception Handling
Generic error handling helps ensure that information that could aid attackers is not exposed.
Platform Protection
Built-in platform protection features are enabled to reduce risk from common attacks.
Strict Transport Security
HTTP Strict Transport Security (HSTS) is enabled on production servers to help enforce secure communications with IronBox.
Session Expiration
Sessions after a period of inactivity are automatically expired to better protect data.
White-list Rules
Protective devices like firewalls are configured with white-list based ACLs and rules.
Production Accounts
Non-essential production accounts are disabled or removed.
Compliance
Data centers are certified and attested for ISO/IEC 27001:2005, SOC 1 and SOC 2 SSAE 16/ISAE 3402, Cloud Security Alliance Cloud Controls Matrix, Federal Risk and Authorization Management Program, PCI and HIPAA BAA.
Web Attack Prevention
Platform-based controls to help reduce risk from common attacks like XSS, CSRF and ClickJacking are employed.
Forward Secrecy
SSL Forward Secrecy (FS) is configured to help ensure the protection of data even if SSL public and private key pairs are compromised.
Maintenance
Security Patches
All security patches are deployed to production systems within 24-48 hours of public release and verification testing.
Vulnerability Scanning
Automated and scheduled vulnerability scanning is performed on production systems to quickly identify common vulnerabilities.
Penetration Testing
Self and third-party conducted penetration tests are performed on production systems on a regular schedule.
Password Changes
Production system strong passwords are used and changed regularly.
Mobile
Low-Level Wiping
Data is automatically wiped using DoD 5220 style wiping to prevent unauthorized recovery of data.
Certificate Pinning
SSL certificates are validated to help ensure the authenticity of secure communication channels.
Platform Checking
Mobile app automatically checks the underlying device to help ensure that it has not been jail-broken, and refuses to run if it has been.
Secure Storage
Credentials while in use are stored in secure storage facilities and securely wiped when no longer needed.
Session Timeouts
Sessions automatically expire after a period of inactivity to help ensure the security and privacy of your data.
Client-Side Encryption
All cryptographic functions are performed on the client side for better security and privacy.
Data Protection at Rest
Your data is kept protected at rest using AES-256 bit encryption (CBC).
Data Protection in Transit
SSL tunnels using 2048-bit public keys and AES-128 bit encryption help ensure your data stays safe while transmitted across networks. In many cases data is pre-encrypted before entering SSL tunnels.