Lua Security Whitepaper - Citrix Ready Marketplace

Instant, Secure and Accountable
Lua Security Whitepaper
Security is Paramount
We know that when you communicate with your team, information security is paramount.
The information discussed, the files circulated, and the decisions made all help your
organization maintain its competitive edge. Major organizations across all industries use Lua
every day to communicate and share files, and we never take that trust for granted. Lua is
an enterprise-grade, mobile first solution that adheres to the highest industry standards for
security at every level. Connect your staff and share information with confidence.
LUA SECURITY WHITEPAPER
1
section one
Lua Security Overview
Lua allows you to securely and instantly message, call and share files with
colleagues from any device. Track account activity, revoke access to files and
remotely lock or wipe data from a lost or stolen device — quickly and easily.
30%
of IT practitioners say
they have no mobile
security features in
place.1
Protection at the app level
Data is segmented at the Network level within Lua; under no
circumstances will it be available to users who have not been
invited into a specific network.
Each device used to access a user account is associated with that
account via the user’s email address.
Upon logging out, all data is removed from the client device.
Administrators can revoke access to individual users, instantly
removing all data from the user’s device.
Allow admins to easily grant and revoke access to conversations
and files.
Protection at the platform level
All connections are 256-bit TLS encrypted, both at rest and in
transit.
A service-oriented architecture allows us to isolate our components
and compartmentalize permissions between them.
The codebase is regularly audited for cross-site scripting, SQL
injection, cross site request forgery, unpatched insecurities
in external libraries and flaws in authentication and session
management.
Regular penetration testing is performed using the same tools
malicious hackers use, so that new vulnerabilities are assessed as
they are discovered.
1. Raytheon Cyber Products, “Security in the New
Security updates for 3rd party components are typically performed
Mobile Eco-System”, 2014
within 24 hours of availability.
LUA SECURITY WHITEPAPER
2
Protection at the facilities level
Lua’s data centers provide state of the art physical security to
our clients. With ISO 27001 certifcation and regular SOC 1 audits,
our physical infrastructure is trusted by Fortune 500 companies,
government agencies and NGOs.
Multiple Availability Zones are used for a high degree of physical
redundancy, mitigating the impact of network outages and
natural disasters.
Lua works to take advantage of new physical security measures as
they become available.
Lua Security Architecture
Storage
Tier
Application
Tier
Encrypted
Volume
Encrypted
Volume
Firewall
TLS
Encrypted
Device
LUA SECURITY WHITEPAPER
3
section two
52%
of IT professionals say
mobile security practices
have been sacrificed
in order to improve
employee productivity.2
Encryption of Data
Lua’s cloud-based services offer 256-bit Transport Layer Security (TLS) encryption
to ensure the privacy of confidential messages and files during transfer and
in storage. Your data is backed up on redundant servers and protected by
geography, people and failsafes, ensuring its availability, no matter what.
Lua also uses industry standard ciphers and protocols to protect your sensitive
data from end to end - at rest and in transit, including the Advanced Encryption
Standard (AES). Lua’s SSD volume is also encrypted at a hardware level. In
addition to our database, all logs and data being passed through our messaging
servers and devices are fully encrypted.
Encryption of Data
Encryption is the process of encoding messages or information in such a
way that only authorized parties can read it. Malicious users may intercept or
monitor data transmitted across unencrypted networks and gain unauthorized
access which jeopardizes the confidentiality of the sensitive data. The secure
transmission of data in transit and at rest relies on both encryption and
authentication − on both the hiding or concealment of the data itself, and on
ensuring that the computers at each end are valid.
Encryption does not of itself prevent interception, but rather denies the message
content to the interceptor. In a traditional encryption scheme, the message or
information, referred to as plaintext, is encrypted using an algorithm, generating
ciphertext that can only be read if decrypted. For technical reasons, an
encryption scheme usually uses a pseudo-random encryption key generated by
the algorithm.
While in principle it may be possible to decrypt a message without possessing
the key, it is almost mathematically improbable and would require extremely
large computational resources, unprecedented technical abilities and a genius
level mathematical skill set. An authorized recipient can easily decrypt the
message with the key provided by the originator to recipients, but not to
unauthorized interceptors.
2. Ponemon Institute, “Corporate Data: A
Protected Asset or a Ticking Time Bomb?”, 2014
LUA SECURITY WHITEPAPER
4
Encryption at Rest
Encrypted data stays encrypted even when access controls such as usernames
and password fail -- meaning all of your Lua data is encrypted while it remains on
the client device. The data also maintains its security while resting on the server
at the hardware level.
Encryption in Transit
Data in transit can be defined as the flow of information over a network, such
work
personal
as the internet or an internal private network. When sensitive data is going
from the client device to a server, 256-bit TLS prevents ‘man in middle’ attacks
(i.e. eavesdropping). The sent data maintains full encryption while in this transit
period, preventing access by unauthorized users.
Lua Encryption Best Practices
More than
one half
of all employees access
business applications
from personally owned
mobile devices.3
Data encryption keys are updated on a regular basis
Encryption keys are stored separately from the data
Periodic auditing of sensitive data
Only store the minimum amount of sensitive data as possible
Regular monitoring of threats
Powerful firewall
What is AES?
Simply put, the Advanced Encryption Standard (AES) is a web tool cipher used to
encrypt and decrypt text using the AES encryption algorithm. Administrators can
chose 128, 192 or 256-bit long key size for encryption and decryption. The result
of the process is downloadable in a text file.
In more technical terms, AES is a symmetric block cipher used by the U.S.
government and major enterprises to protect classified information. It is
implemented in software and hardware throughout the world to encrypt
sensitive data. AES is robust and capable of protecting vital information well into
the next century.
3. Raytheon Cyber Products (see footnote 1)
LUA SECURITY WHITEPAPER
5
AES comprises three block ciphers, AES-128, AES-192 and AES-256. Each cipher
encrypts and decrypts data in blocks of 128 bits using cryptographic keys of 128-,
192- and 256-bits, respectively. Symmetric or secret-key ciphers use the same key
for encrypting and decrypting, so both the sender and the receiver must know
and use the same secret key.
All key lengths are deemed sufficient to protect classified information up to the
“Secret” level with “Top Secret” information requiring either 192- or 256-bit key
lengths. There are 10 rounds for 128-bit keys, 12 rounds for 192-bit keys, and
14 rounds for 256-bit keys -- each round consists of several processing steps
71%
of end users say they have
access to confidential
corporate data that they
should not see. 4
that include substitution, transposition and mixing of the input plaintext and
transform it into the final output of ciphertext.
What is TLS?
TLS is a cryptographic protocol designed to provide communication security
over a network, ensuring privacy between communicating applications and
their users on the internet. When a server and client device communicate, TLS
ensures that no third party may eavesdrop or tamper with any message. TLS
is the successor to the Secure Sockets Layer (SSL). TLS and SSL are most widely
recognized as the protocols that provide secure HTTP (HTTPS) for Internet
transactions between web browsers and web servers.
TLS is composed of two layers: the TLS Record Protocol and the TLS Handshake
Protocol. The TLS Record Protocol provides connection security with some
encryption method such as the AES or Data Encryption Standard (DES). The TLS
Handshake Protocol allows the server and client to authenticate each other and
to negotiate an encryption algorithm and cryptographic keys before data is
exchanged.
In the authentication process, a TLS/SSL client sends a message to a TLS/SSL
server, and the server responds with the information that the server needs
to authenticate itself. The client and server perform an additional exchange
of session keys, and the authentication dialog ends. When authentication is
completed, SSL-secured communication can begin between the server and
the client using the symmetric encryption keys that are established during the
authentication process.
4. Ponemon Institute (see footnote 2)
LUA SECURITY WHITEPAPER
6
TLS Enhancements to SSL
The keyed-Hashing for Message Authentication Code (HMAC) algorithm replaces
the SSL Message Authentication Code (MAC) algorithm. HMAC produces more
secure hashes than the MAC algorithm. The HMAC produces an integrity check
value as the MAC does, but with a hash function construction that makes the
hash much harder to break.
Key Benefits of Using TLS Encryption
Strong authentication, message privacy, and integrity
TLS can help to secure transmitted data using encryption technology. TLS also
authenticates servers and authenticates clients to prove the identities of parties
engaged in secure communication. It also provides data integrity through an integrity
check value. In addition to protecting against data disclosure, the TLS security
protocol can be used to help protect against masquerade attacks, man-in-the-middle
or bucket brigade attacks, rollback attacks, and replay attacks.
Interoperability
TLS/SSL works with most Web browsers and on most operating systems and web
servers, including the Microsoft Windows, UNIX, Novell, Apache, Netscape Enterprise
Server and Sun Solaris. It also is often integrated in news readers, LDAP servers, and a
variety of other applications.
Algorithm flexibility
TLS provides lots of options for the authentication mechanisms, encryption
algorithms and hashing algorithms that are used during the secure session.
LUA SECURITY WHITEPAPER
7
section three
Securing Your Data
Overall Security Responsibility
Security in the cloud is slightly different than security in your on‐premises data
centers. Since Lua is cloud-based, security responsibilities are shared between
you and Lua. Lua is responsible for securing the underlying infrastructure that
supports the cloud and protecting your data. You are responsible for using
secure passwords and best practices (like mobile phone lock codes).
60%
of IT professionals
believe employees have
become less diligent in
practicing good mobile
security. 5
Physical and Environmental Security
Your data is stored in world-class, highly secure, audited data centers that utilize
state-of-the art electronic surveillance and multi-factor access control systems. All
data centers are housed in nondescript facilities, staffed 24x7 by trained security
guards and access is strictly authorized. Environmental systems are designed to
minimize the impact of disruptions to operations. Multiple geographic regions
and Availability Zones allow you to remain resilient in the face of most failure
modes, including natural disasters or system failures.
Data center access is only provided to employees and contractors who have a
legitimate business need for such privileges. When an employee no longer has
a business need for these privileges, his or her access is immediately revoked. All
physical access to data centers by employees is logged and audited routinely.
Data Reliability
Lua data servers reside in SSAE 16 accredited datacenters with features including
hurricane-rated roofs and multiple redundant power sources. All data is
automatically updated to servers in separate locations. Regular backups are
performed on all data, including off-site data backups to protect against almost
all disaster scenarios.
5. Raytheon Cyber Products (See footnote 1)
LUA SECURITY WHITEPAPER
8
Fire Detection and Suppression
Automatic fire detection and suppression equipment has been installed to
reduce risk. The fire detection system utilizes smoke detection sensors in all data
center environments, mechanical and electrical infrastructure spaces, chiller
rooms and generator equipment rooms. These areas are protected by either wet‐
pipe, double‐interlocked pre‐action, or gaseous sprinkler systems.
Power
The data center electrical power systems are designed to be fully redundant
and maintainable without impact to operations, 24 hours a day, and seven days
a week. Uninterruptible Power Supply (UPS) units provide back‐up power in the
event of an electrical failure for critical and essential loads in the facility. Data
centers use generators to provide back‐up power for the entire facility.
one third
of IT leaders say their
organization does not
have a mobile security
strategy for all sensitive
and confidential
proprietary data.6
Climate and Temperature
Climate control is required to maintain a constant operating temperature for
servers and other hardware, which prevents overheating and reduces the
possibility of service outages. Data centers are conditioned to maintain optimal
atmospheric conditions. Personnel and systems monitor and control temperature
and humidity at appropriate levels.
Management
The data centers monitor electrical, mechanical and life support systems so that
any issues are immediately identified. Preventative maintenance is performed to
maintain the continued operability of equipment.
Storage Device Decommissioning
When a storage device has reached the end of its useful life, procedures
include a decommissioning process that is designed to prevent customer data
from being exposed to unauthorized individuals. Techniques detailed in DoD
5220.22‐M (“National Industrial Security Program Operating Manual “) or NIST
800‐88 (“Guidelines for Media Sanitization”) are used to destroy data as part of
the decommissioning process. All decommissioned magnetic storage devices
are degaussed and physically destroyed in accordance with industry‐standard
6. Raytheon Cyber Products (See footnote 1)
practices.
LUA SECURITY WHITEPAPER
9
Availability
Data centers are located in clusters in various global regions. In case of failure,
automated processes move customer data traffic away from the affected area.
Applications are deployed in an N+1 configuration, so that in the event of a data
center failure, there is sufficient capacity to enable traffic to be load‐balanced to
the remaining sites.
The data centers offer flexibility to place instances and store data within
multiple geographic regions as well as across multiple availability zones within
45%
of senior executives
surveyed say their
company experiences
cyber attacks hourly or
daily. 7
each region. Each availability zone is designed as an independent failure zone.
This means that availability zones are physically separated within a typical
metropolitan region and are located in lower risk flood plains (specific flood zone
categorization varies by Region).
In addition to discrete uninterruptable power supply and onsite backup
generation facilities, the centers are each fed via different grids from independent
utilities to further reduce single points of failure. All availability zones are
redundantly connected to multiple tier‐1 transit providers. Distributing
applications across multiple availability zones allows the servers to remain
resilient in the face of most failure modes, including natural disasters or system
failures.
Incident Response
The data centers employ industry‐standard diagnostic procedures to drive
resolution during business‐impacting events. Staff operators provide around the
clock coverage to detect incidents and manage the impact and resolution.
Communication
Various methods of internal communication have been implemented at a global
level to help employees understand their individual roles and responsibilities
and to communicate significant events in a timely manner. Lua will alert you
immediately to any potential problems or issues.
7. http://www.ponemon.com, 2015.
LUA SECURITY WHITEPAPER
10
Secure, Enterprise Text Messaging
Lua’s comprehensive mobile messaging solution offers advanced security features at every
level -- the device, the network and physical locations. Rest assured your data is safe, no
matter where or how you work.
LUA SECURITY WHITEPAPER
11
The enterprise communication solution.
Instant, secure, and accountable.
www.getlua.com
[email protected]