Security Requirements of Information Systems

Thinglogix objective is to Prevent unauthorized access to information held in our customer system.

We recommend our customers only provide root access to administrators, and instead grant IAM rights to roles/users and do not use the root account for production use, but rather only for AWS console use. Customers should setup users with IAM rights to information, databases and application functions to authorized users only, in accordance with the “need-to-know” and “least privilege” access models

• Information “cloned” to a non-production environment that is “sensitive” shall be obfuscated, masked, redacted, or encrypted.
• Code, scripts, and processes shall not have embedded user IDs and passwords.
• Critical systems storing sensitive information shall operate in an isolated lambda functions.
• Communication should use encryption protocols such as HTTPS, FTPS, X.509, TLS or other commercially available encryption protocols.

Best practices