Access Control

Access Control - Foundry

Foundry utilizes AWS Cognito authentication and AWS Identity and Access Management (IAM) for allowing access to data. Users receive Cognito tokens from AWS specifying what access credentials they have, and then all subsequent requests to AWS services use this Cognito token, ensuring that all access requests only return data for which they have access rights. IAM in turn is where the definition of what access roles/users have within the system exist.

AWS accounts with access to Foundry source code in all environments should be periodically reviewed and re-authorized by the CTO. Accounts which show no activity for more than 60 days shall be disabled or locked.

Foundry User Accounts are controlled by the Customer and the Customer can create and revoke accounts and rights. Passwords for Foundry user Accounts are encrypted using MD5 and kept in an RDS table that is installed with Foundry into the Customer’s AWS instance.

All Foundry API Access Control is to be controlled via AWS Cognito and temporary AWS credentials via the AWS API Gateway service. The API Gateway itself will be bound to the Customer's AWS account into which Foundry is installed. Once API access is negotiated using Cognito, then Foundry standard User account information should be utilized to access Foundry information exposed by the specific API being called. This will ensure all Foundry user access definitions, ACL, and other restrictions are enforced when retrieving or inserting/updating data. For more information see the original design document at: https://docs.google.com/document/d/1v4Zc5clkvvaKKq_eOS1OsGav_btB-WeCfTE5UhFkXh4/edit?usp=sharing

Office Access Control

ThingLogix offices should require either keycard (electronic fob) or physical key access to all doors with entry to the offices. If physical keys are utilized, upon the departure of any employee or contractor, then the locks on the doors should be changed and new keys distributed to those remaining employees or contractors requiring access. For key cards or electronic fob access, upon employee or contractor departure, the key cards should be electronically deactivated. A monthly audit process should be in place to review all keycard access rights, and remove anyone missed.

Password Policies - ThingLogix

Foundry:

• Customer’s may configure their own password policies for Foundry Users. The following options are available for choosing the strength of the password policy, from low strength to high strength:
  • Low Strength:
    • Any characters
    • One Capital Letter, One Special Character
    • One Capital Letter, One Number and One Special Character
    • Minimum 8 Characters, One Capital Letter and One Number
    • Minimum 8 Characters, One Capital Letter and One Special Character
    • Minimum 8 Characters, One Capital Letter, One Special Character and One Number
  • High Strength

Laptop/PC equipment:

ThingLogix employees and contractors should have passwords on their laptop/PC equipment, and they should change their passwords at least every 60-90 days. Passwords should not be written down nor stored anywhere electronically unless that electronic storage is encrypted.

AWS Account Passwords:

ThingLogix employees and contractors should utilize AWS IAM accounts/roles with 2 factor authentication, and preferably use AWS MFA authentication, for all AWS root accounts where access to the AWS Console is accessible. Foundry should not be installed in the AWS root account, but instead should be installed within a specific IAM account setup under the Root account. This is applicable for development, test or production installations of Foundry.

GSuite

ThingLogix employees are provisioned at GSuite account when they are hired. Strong Passwords and 2 factor authentication are enabled on GSuite. This account is used to login to the following systems:

• Harvest
• Slack
• Freshdesk

QuickBooks

QuickBooks is considered a restricted system. System administrator will grant access. QuickBooks uses 2 factor authentication and strong passwords.

IAM Policies:

Admin Privileges

Admin Privileges are given only to the CTO’s team. Administrators should manage users IAM policies to ensure they only have permissions to the services they need for their work.

On-Boarding Process

When new employees are on-boarded into the company. If they require access to AWS account and IAM user is created. Accounts are never shared.

Assigning Policies

Use AWS-Defined policies to assign permissions whenever possible. Use Groups to assign permissions to IAM users.

Revoking Access

When employees leave the company the IAM user is immediately removed from the team. If an employee changes roles their permissions will be updated to reflect their new role.

MFA

Multi-factor authentication is required for all IAM users with console access.

Rotating Passwords

Passwords will be rotated every 6 months.

Policies Review

Policies are reviewed monthly to ensure they grant the least privilege that is needed to perform only the necessary actions.

Bitbucket Policies:

Admin Privileges

Admin Privileges are given only to the CTO’s team. Administrators should manage team access to data. Only give contributors access to the data they need to do their work.

On-Boarding New Members

New members are added to the Team repo and access permissions for only the required repositories are applied. Accounts are never shared.

Rotating SSH & Tokens Keys

SSH & Tokens keys are to be rotated every 6 months.

Revoking Access

When employees leave the company the user is immediately removed from the team. If an employee leaves a project then their access to the project repository should either be revoked or restricted based on the situation.

MFA

Multi-factor authentication is required for all users with access to Foundry Core Lambdas and Foundry Web-App teams. MFA is not supported for SSH git connectivity to BitBucket.

Production Branches

• Do not allow force pushes.
• Commit privileges are only for a small set of users.

Development Branches

Write access only granted to those on Foundry Core Lambdas and Foundry Web-App teams.

JAMf Developer Security Blueprint

ThingLogix utilizes JAMf to manage developer and employee workstations. ThingLogix only provides Macintosh computers. JAMf profiles and restrictions will be reviewed monthly by CTO.