CIS Software Security & Data Protection
Security Built Into the CIS Environment
CIS combines protected cloud infrastructure, layered server security, controlled application access and backup and recovery safeguards to help protect the quality and operational information entrusted to the system.
Layered protection
Security is not dependent on a single control
CIS security combines protections at several levels, from the hosting environment and server configuration through to application permissions, authentication and backup safeguards.
Cloud Infrastructure
CIS is hosted on infrastructure provided by Liquid Web in the United States with monitoring and security services supporting the hosted environment.
Server Protection
The server environment uses intrusion detection, security monitoring, malware protection, hardened configuration and firewall controls.
Application Security
CIS controls access to transactions and functions through user identification, authentication, roles and permissions.
Backup & Recovery
Backup safeguards include server backup, drive redundancy and encrypted off-server backup storage.
Hosting environment
Secure cloud infrastructure
CIS Software is hosted using infrastructure provided by Liquid Web in the United States.
Liquid Web publishes security, privacy and compliance information describing the controls and frameworks applicable to its hosting services.
Those resources are available below for organizations that need additional information during supplier qualification or security review.
Security frameworks
Infrastructure supported by established security practices
The hosting environment and supporting services are associated with recognized security and compliance frameworks including NIST 800-53, SOC 2, PCI-DSS and ISO 27001.
These references describe the hosting provider’s security and compliance environment; they should not be interpreted as a claim that every CIS customer installation is independently certified to each framework.
Server protection
Multiple protections work together
The server environment includes controls designed to identify suspicious activity, protect files and limit unauthorized network access.
Protective layers
Server-level safeguards
- Intrusion detection and security monitoring
- File-level malware protection
- Hardened server configuration
- Operating-system firewall protection
- Network-level firewall protection
- Monitoring of critical systems and suspicious behaviour
CIS application security
Control who can see what – and what they can do
Infrastructure security is only one part of the picture. CIS also includes application-level controls that allow organizations to manage access according to user responsibility.
User Identification
Users are identified and authenticated before access to CIS is granted.
Roles & Permissions
Functions and transactions can be controlled according to the user’s assigned role and permissions.
Controlled Access
Organizations can restrict users to the areas of CIS appropriate to their responsibilities.
Administrative Oversight
User account information, including last-login information, is maintained to assist with account administration.
Backup & recovery
Protecting against more than unauthorized access
Security also means maintaining the ability to recover information when hardware failure or another disruptive event occurs.
- Server backup processes
- RAID-based drive redundancy
- Encrypted off-server backups
- Off-server backup storage
- Recovery capability
Resilience
Backup copies are separated from the production server
Off-server backup storage provides an additional layer of protection by keeping backup data separate from the primary production environment.
Encryption is used for the off-server backup process described in the CIS security environment.
Shared responsibility
Security also depends on how each organization uses the system
Customers frequently ask about requirements such as NIST 800-171. Some security responsibilities belong to CIS and its hosting environment, while others remain under the customer’s control.
CIS & Hosting Environment
- Hosting infrastructure
- Server protection
- Application security mechanisms
- Backup and recovery safeguards
- Maintenance of the CIS environment
Customer Organization
- Deciding what information is entered into CIS
- Assigning appropriate user permissions
- Managing employee access
- Internal information-handling practices
- Compliance with customer-specific security requirements
NIST 800-171
A frequent customer question
NIST 800-171 concerns the protection of Controlled Unclassified Information, or CUI, in non-federal systems and organizations.
Whether a particular customer’s use of CIS satisfies its complete contractual or regulatory obligations depends on the customer’s data, configuration and internal security practices as well as the technology itself.
Security qualification
Detailed questions can be reviewed before implementation
Organizations with specific contractual, customer or regulatory security requirements can discuss those requirements during the CIS review and qualification process.
Supporting information from the hosting provider can also be reviewed when customers require additional infrastructure or compliance documentation.
CIS system integrity
Locked Tight
This CIS video provides additional background on system security and integrity features introduced as the platform evolved.
Supporting documentation
Third-party security & compliance information
Organizations performing supplier qualification or security review can consult Liquid Web’s published information for additional details about hosting security, privacy and compliance.
Need additional security information?
Discuss CIS security during your software review
If your organization has specific IT, customer, contractual or compliance requirements, they can be discussed as part of the CIS review and qualification process.