Security Built Into Every Layer
Protecting customer data is a priority at Aprimo. Our security approach combines strong access controls, data encryption, proactive monitoring, and secure development practices to help safeguard your content and information.
Security Policies
Aprimo is dedicated to providing comprehensive system and data security for our customers. To ensure the highest level of security, we follow the NIST standard for security remediation. Our Security guild meets bi-weekly to review current AppSec and SecOps Security issues, associated workstreams, and security initiatives. We employ multiple layers of Security Testing, Validation, and Monitoring to identify and address any potential vulnerabilities. We also conduct annual Information Security training for all contractors and employees to keep them informed of the latest security practices and protocols. With these measures in place, our customers can trust that their data is secure with Aprimo.
Defense in Depth Strategy
At Aprimo, we take the protection of our customer's data seriously. Our layered approach to security begins with security training for all software developers to ensure that security is integrated into every aspect of our product development process. We also use automated dynamic and static scanning of product builds and conduct penetration testing through 3rd parties to identify any potential vulnerabilities. We implement least privilege access control strategies to limit access to sensitive information, and end-to-end encryption to ensure that data remains secure throughout its lifecycle. Additionally, we use infrastructure as code to standardize our security practices and ensure consistency across all environments. With these measures in place, our customers can trust that their data is secure with Aprimo.
Data Encryption
Aprimo has strict security policies in place to protect customer data. These policies include minimum key sizes for legacy and new certificates, recommended advanced encryption standards, secure hashing algorithms, and approved cryptographic protocols. Aprimo also requires semi-annual testing and validation of cipher suites for internet-facing systems and applications. The company uses TLS v1.2 and v1.3, SSHv2, and public key-based authentication to enhance security. Additionally, Aprimo requires non empty passwords and employes techniques to block brute force attacks when using password-based authentication with SSH. By following these policies, Aprimo ensures that customer data remains secure and protected.
Incident Response
Aprimo's incident response policy outlines the following high-level steps to follow in the event of a security incident: documenting everything, notifying appropriate contacts, using out-of-band communications, incident containment, backing up/imaging affected systems, mitigating the security incident, returning to business, and conducting a postmortem review. Aprimo emphasizes the importance of maintaining clear and detailed documentation throughout the process and involving the Information Security Team in incident response efforts. Aprimo provides Incident Response updates via https://status.aprimo.com.
Secured SDLC Practices
Aprimo implements a Secured SDLC (Software Development Lifecycle) to ensure the security of our software applications. This includes utilizing both static and dynamic code analysis tools on source code and leveraging third-party vendors to perform penetration testing. Aprimo also trains our software engineers on secure development practices and maintain a security guild to drive security best practices during application development. These measures help to ensure that Aprimo is developed with security in mind from the beginning, reducing the risk of vulnerabilities and improving the overall security of our products.
Data Protection
Aprimo databases are locally redundant and point-in-time recoverable for up to seven days, with zone replication within the same continental region. Digital assets are stored in Azure Blob Storage and synchronously zone-replicated, with production assets regionally backed up for seven days. The overall point-in-time recovery objective is less than 15 minutes, with a recovery time objective of less than six hours and a data restore time objective of less than 12 hours.
Multi-factor Authentication
Aprimo places a high priority on data security and requires VPN and multi-factor authentication for access to production networks. This policy ensures that only authorized personnel are able to access sensitive data and systems. By requiring these additional security measures, Aprimo can better protect customer data and reduce the risk of unauthorized access or data breaches.
Proactive Monitoring
As a part of the management of its SaaS application and platform, Aprimo has incorporated multiple layers of Performance Testing and Monitoring throughout the product life cycle. Aprimo leverages timing comparisons of recent user sessions versus a baseline in Production, while focusing on tool based, automated testing during development.