This document is designed to share the system security controls at Junify Corporation for external organizations. It is based on the original document that defines the company's internal operations, excluding confidential information, and extracts the policy and philosophy behind the document. Once the internal documents are updated, this document shall be updated.
This security control system is based on the model defined by the NIST SP 800 series. It must be adapted to the latest best practice of the original NIST SP 800 concept. At the same time, the basic concept of Junify’s security control system comes from the core concept of the Junify app (Junify product). It does not completely follow the NIST SP 800 model.
Junify’s security policy is built on a zero-trust model which assumes to access cloud systems and information remotely by putting Junify (as a product) at the center of security tools. Therefore this document does not define physical security control for offices or data centers. The only hardware devices owned by the company are PCs, laptops, and smartphones. But there shall be no confidential data left on any devices. In Junify, all information systems are built on the cloud infrastructure or using SaaS services.
Persons in this document are identified strictly by Junify App. The information access must be started from the Junify app on a smartphone owned and controlled by each individual person. No password is input manually, and no session and password remain on the client-side computer.
Tools and systems can mitigate the risks of incidents, but it is not always perfect. All individuals who engage in the Junify system must understand the policies and rules in this document. Training persons, monitoring data and behaviors, and maintaining a security control system are essential things defined in this document.
Security policies are the specific controls and behavior expectations that each member of the organization’s staff must meet in the control system’s daily operation. The development of the organization’s security policy is the first and most important step in developing an organizational security program. Security policies lay the groundwork for securing the organization’s information.
At Junify corporation, we work remotely. So the company shall require all members to accept the following security policies.
The scope of this document is defined as follows.
External systems which make up Junify Service are out of scope in this document. Junify shall be responsible for checking the security control of each service in detail.
There are three key roles in this document. A company must assign top two roles to make clear the responsibility of the security control system.
All persons within the scope defined in Section 4 must observe the following rules.
The Junify app will monitor the following information. This data is owned and controlled by a company. A company has a right to check this information when it’s needed. The staff has a right to protect their privacy by turning the working switch off on the Junify app.
Information and document management is generally a part of the company records retention and document management system. Information associated with the development and execution of a control system is important and sensitive and needs to be managed. Control system design, operations data, and procedures, risk analyses, business impact studies, risk tolerance profiles, etc., contain sensitive customers and company information and need to be protected. Security measures, philosophy, and implementation strategies are other examples. In addition, business conditions change and require updated analyses and studies. Care is given to protect this information and verify that the appropriate versions are retained. Inherent in this is an information classification system that allows information assets to receive the appropriate level of protection.
The organization develops, disseminates, and periodically reviews and updates:
All information is classified to indicate the protection required commensurate with its sensitivity and consequence. We define the following 5 categories.
| Category | Category Name | Definition |
|---|---|---|
| 1 | Highly Confidential | Limited to a small number of staff who are authorized to access |
| 2 | Confidential | Limited to staff who need to access |
| 3 | Restricted | Many staff have access but limited to some staff |
| 4 | Internal | All staff have access |
| 5 | Public Information | Everyone has access |
All information must be managed as digital data in the cloud systems which are authorized by the company. All documents must be placed in the proper places protected by an access control system. The detail of the access control is defined in Section 9. The head of system security is in charge of the information lifecycle in category 1 defined above.
Personal information and other Category 1 information are subject to stricter access controls. Access is granted only to authorized personnel on a need-to-know basis, approved by the Head of System Security, and is periodically reviewed and monitored.
The company ensures the security awareness and training policy and procedures are consistent with applicable federal laws, directives, policies, regulations, standards, and guidance. The company provides basic security awareness training to all control system users before authorizing access to the system, when required by system changes, and at least annually thereafter. The effectiveness of security awareness training at the organizational level, needs to be reviewed at least once a year.
The head of security is responsible for making all staff understand this security control system through the following programs.
Security is most effective when it is designed into the control system and sustained, through effective maintenance, throughout the system's life cycle, and through all future configurations. Maintenance activities encompass appropriate policies and procedures for performing routine and preventive maintenance on the components of a control system. This includes the use of both local and remote maintenance tools and the management of maintenance personnel.
The Junify service uses many libraries, packages, modules, os images, and components developed outside of the company. All risks, like vulnerabilities of all libraries, must be checked and confirmed before it is used.
It must be reviewed and authorized by the head of system security when:
Old and out-of-date libraries have a risk of potential vulnerabilities. Staff must be aware of risk information like vulnerabilities of libraries that are used. All libraries, components, packages, and OS images must be updated to the latest or safe version.
There are always risks when we change the configurations of systems. Small changes must be checked in detail, taking into account the risk of unrecognized information leaks.
Monitoring and reviewing the performance of the security control system provides the company with the ability to evaluate the performance of its security program. Internal checking methods, such as compliance audits and incident investigations, allow the company to determine the effectiveness of the security program and whether it is operating according to expectations.
The ways of cyber attacks have been always improved and newly invented. The system must be checked even if there has been no change in it. System security checks must be done in a certain time period, and the security level condition must be kept healthy all the time.
In cloud and SaaS systems, account management is the most critical part of security control. The focus of access control is ensuring that resources are only accessed by the appropriate personnel and that personnel is correctly identified. At Junify Corporation, we adopt a two-tier account management and access control system by using the Junify app. The key identification and authentication, and authorization are controlled by the Junify app (the first tier), and all SaaS accounts are integrated with the Junify app (the second tier).
Identification and authentication is the process of verifying the identity of a user, process, or device, as a prerequisite for granting access to resources in a control system. We use the Junify app for both identification and authentication.
All accounts (both the Junify app account and SaaS accounts) need to be managed by adding, altering, and removing access rights as necessary.
There are two tiers of authorization. The first tier is that the Junify app controls access. Each SaaS application integrated with the Junify app is required to define conditions of access. The second tier is roles and other conditions which are configured on each SaaS. Both must be configured appropriately by the person who has the manager role in the Junify app.
SaaS accounts shall be managed by each person basically, but some cases require using shared accounts. Sharing passwords among many people increases the risk of incidents. The Junify app reduces it by defining the owner of the shared accounts and not sharing any passwords with staff.
Privileged accounts must be managed separately from normal accounts. It shall not be allowed to add privilege roles on the daily use account as a default.
Risk management planning is a key aspect of ensuring that the processes and technical means of securing control systems have fully addressed the risks and vulnerabilities in the system.
The system security team develops a risk management plan. CISO reviews and approves the risk management plan. The head of system security monitors the progress of the plan and reports it to CISO.
The head of system security monitors the security mechanisms in the control system on an ongoing basis. Those security mechanisms that are volatile or critical to protecting the control system are assessed at least annually. Continuous monitoring of security controls using automated support tools facilitates near real-time risk management for systems.
The security control system shall be assessed by experts periodically whenever significant changes occur to the security control system, the major updates of software, or other conditions that may affect the security or accreditation status of the system.
The incident response addresses the capability to continue or resume operations of a control system in the event of disruption of normal system operation. In this document, we focus on security incidents which are information leakage or other incidents related to system security.
Security incidents are classified with the following criteria.
| Category | Name | Description |
|---|---|---|
| Category 1 | Extreme | Severe incidents like serious data breaches, severe intrusion in the production environment, stolen secret keys, or data lost by ransomware. |
| Category 2 | High | Incidents like server intrusion in the development environment, malware infection, or stolen credentials. |
| Category 3 | Medium | Minor computer virus infections, or non-critical data leakage. |
| Category 4 | Low | Failure or misconfiguration of access control |
All security incidents must be managed on the incident master list. The head of system security shall be responsible for keeping it updated, and CISO shall be aware of the progress of the incident response.
The Junify system depends on some external systems. All critical dependencies must be managed on the list, and the security control system of each external system must be checked and examined.
https://aws.amazon.com/compliance/
https://www.heroku.com/compliance