2-BPM006737_Infrastructure and Security Overview.pdf

Page 1 of 6 Cybersoft Technologies, Inc.

4422 Cypress Creek Parkway, Suite 400, Houston TX 77068 Ph. 281.453.8500 Fax. 281.895.9555 www.cybersoft.net

Infrastructure and Security Overview

Security considerations are the foremost part of any organization. Cybersoft uses several services and tools to achieve the highest security standards using the required industry standards as basis. Cybersoft also addresses the various dependencies, alerts, and recovery plans, in case of system interruptions. This document provides details on System Infrastructure, Data Security, User Access, and Disaster Recovery measures put in place by Cybersoft, its contractors, agents, and affiliates.

System Infrastructure Servers

Cybersoft runs its applications on Microsoft Windows servers and Microsoft SQL Server database with ample CPU capacity, memory, disk storage and high-speed disks (SSDs). Cybersoft also supports a load balanced web server and SQL clusters.

Server features:

• All servers have built-in redundancy on power supplies, network cards, hard drives, etc.

Server components are hot-swappable where applicable.

• All disks are configured in appropriate RAID arrays to prevent downtime or data loss even in the event of a failed hard disk.

• All hardware is monitored 24x7 and the relevant personnel are alerted in the event of a component failure.

Encryptions

Cybersoft takes advantage of proprietary encrypted connection strings. We use procedures throughout the application to enhance performance and provide additional layers of security.

Development Platform

Our software is developed using the Microsoft .NET framework. .NET is a powerful and robust software development technology that provides the security advancements, management tools, and updates needed to build, test, and deploy highly reliable and secure software.

Datacenter

Cybersoft applications are hosted in SSAE 16 certified provider in a secure, high availability datacenter in

Austin, Texas.

Datacenter features:

▪ Building Security – 24x7 monitoring and controlled access through biometric security

▪ Network Security – Constant performance monitoring, Switched and segmented network.

Page 2 of 6 Cybersoft Technologies, Inc.

Ph. 281.453.8500

▪ Backup Power – Uninterrupted power supply and diesel generator

Application Monitoring

The Cybersoft application is monitored continuously for external access as well as resource utilization on the servers. The monitoring goes deeper into the application beyond hitting the login page and sends alerts if it encounters an error or poor performance. Cybersoft team is alerted via email, phone, and text messages if an application is unavailable, or system resources exceed thresholds at any time.

Antivirus

All servers are actively protected with Enterprise Edition of Symantec Endpoint Protection.

Firewalls

Well-designed firewalls and DMZ segments provide for high security. The application and servers also go through quarterly security audits and logs are monitored daily.

Data Security

Security Practices

The Cybersoft development process is based on industry best practices. Information security and secure coding practices are followed throughout the software development life cycle (SDLC) process. In addition, security assessments and penetration tests are performed on our software before any major releases go into production.

Some security best practices that are part of the Cybersoft development process include:

▪ Use of a dedicated test environment separate from production.

▪ Storing of sensitive information in databases that utilize Federal Information

▪ Processing Standard 140-2 encryption algorithms

▪ Controls within the server to prevent SQL injection and other bypassing of client side-input controls.

Cybersoft team also performs penetration tests for the following:

▪ Configuration Management

▪ Authentication

▪ Authorization

▪ User and Session Management

▪ Data Validation

▪ Error Handling

▪ Data Protection

Page 3 of 6 Cybersoft Technologies, Inc.

Ph. 281.453.8500

Data Backups

Each week, full backups, nightly differentials, and hourly transaction logs are sent to a backup server in the same datacenter. Primary offsite backups for SAAS customers are stored in Houston, Texas, and the application can be switched over to secondary backups in Oregon.

User Access

Permissions

To protect the accessibility and integrity of data, Cybersoft incorporates highly configurable role-based security with user-defined roles, permissions, and access levels. Users can be restricted to perform certain tasks pertaining to one or more campuses or regions.

The principle of least privilege is followed throughout the implementation process. Administrators assign security levels and privileges by job function and / or school. Through this, the system will automatically limit access to the operational tasks specifically assigned to each individual. Cashier’s functions can be limited and controlled by login or by assigning permissions by individual to POS functions.

Password Policy

Cybersoft allows admin to set the minimum complexity on passwords for further security. This includes variables like length, special characters, numeric, case, or other requirements. Temporary passwords can also be configured to expire in any set number of hours to prevent unauthorized access.

Disaster Recovery

Prevention

Cybersoft is set up to have reduced downtime and a reduced risk of data loss so that customers can continue their business operations without adverse effects or delays.

Several practices are in place in order to prevent data loss and avoid data related emergencies:

▪ Datacenters, servers, applications, network connections, security, operations, backup power and recovery are all set up in a robust manner.

▪ All servers have redundant components such as arrays of hard drives, extra power supplies, etc., to ensure continuity. All components are hot swappable components and can be replaced within one hour if needed.

▪ Various types of backups are set up to prevent data loss. Primary offsite backups for SAAS customers are stored in Houston, Texas, and the application can be switched over to secondary backups in

Oregon. Varied locations prevent data loss as a result of natural disasters or catastrophic events.

▪ Well-designed firewalls and DMZ segments provide for high security. The application and servers also go through monthly security audits, and logs are monitored daily.

Page 4 of 6 Cybersoft Technologies, Inc.

Ph. 281.453.8500

Backup and Recovery Approach

In the case of a data related emergency, the Cybersoft SQL Server database has an established backup and restore plan for disaster recovery. The plan has been thoroughly tested and documented in a simulated environment using production backups. Additional backups and restores are tested every six months to ensure functionality. Tests are also carried out on a regular recurring basis so that all possible scenarios of failure are addressed. Full backups are scheduled to happen weekly and differentials daily. Transaction logs are backed up every hour. The backup jobs are scheduled with Rubrik* and will be done automatically without manual intervention.

Restoration

To make recovery faster, easier, and more complete, the master and MSDB databases are also backed up any time a change occurs that affects either database. If needed, Cybersoft servers can be rebuilt, the software reinstalled, and databases restored once servers and connectivity are available. Offsite backups will be brought back, and the database restored.

Data Handling

Any reference to “Data” includes all confidential records, customer information, employee-related information, financial information handled by Cybersoft. Data includes Personally Identifiable Information

(PII) or any PII derived from it. Data includes PII which is made directly or indirectly available to Cybersoft or collected/generated by Cybersoft in connection with the performance of its contractual commitments.

Data Privacy

Data is used by Cybersoft only for the purpose of fulfilling its duties under a contract and for the sole benefit of the Licensee and will not share such data with or disclose it to any third-party without the prior written consent of Licensee or as otherwise required by law.

Cybersoft will not use Data for its own benefit and, in particular, will not engage in data mining of such data or communications, whether through automated or human means, except as specifically and expressly required by law or authorized in writing by the Licensee.

Cybersoft will provide access to Data only on a needed basis to fulfill our obligations under a contract/agreement. Cybersoft will ensure that, prior to being granted access to the data, Cybersoft personnel who perform work under an Agreement have all undergone background verification in accordance with the Fair Credit Reporting Act; have successfully completed annual instruction of a nature sufficient to enable them to effectively comply with all data protection provisions.

To the extent not already addressed herein, Cybersoft agrees to use best efforts to facilitate the Licensee’s compliance with the Family Educational Rights and Privacy Act.

Page 5 of 6 Cybersoft Technologies, Inc.

Ph. 281.453.8500

Data Security and Integrity All facilities used to store and process Data will implement and maintain administrative, physical, technical, and procedural safeguards and best practices at a level sufficient to secure such data from unauthorized access, destruction, use, modification, or disclosure. Such measures will be no less protective than those used to secure Cybersoft’ s own data of a similar type and in no event less than reasonable in view of the type and nature of the data involved.

Data Compromise Response Cybersoft shall report, either orally or in writing, to any data compromise involving Data, or circumstances that could have resulted in unauthorized access to or disclosure or use of Data, not authorized by the Licensee, including any reasonable belief that an unauthorized individual has accessed Data. Cybersoft shall make the report within forty-eight (48) hours from the discovery of the unauthorized disclosure.

Oral reports by Cybersoft regarding data compromises will be reduced to writing and supplied as soon as reasonably practicable. Immediately upon becoming aware of any such data compromise, Cybersoft shall fully investigate the circumstances, extent, and causes of the data compromise, and report the results and continue to keep relevant parties informed on a daily basis of the progress of its investigation until the issue has been effectively resolved. Within five (5) business days of the date, Cybersoft becomes aware of any such data compromise, we shall implement corrective actions to remedy the data compromise, restore access to the software as directed, and prevent further similar unauthorized use or disclosure. Cybersoft, at its own expense, shall cooperate fully with the investigation of and response to any such data compromise incident.

Except as otherwise required by law, Cybersoft will not provide notice of the incident directly to the persons whose data were involved, regulatory agencies, or other entities, without prior written permission.

Data Storage, Retention, and Disposition Cybersoft will regularly backup Data using appropriate and reliable storage media. Further, Cybersoft will retain the Data for as long as it is required by FERPA regulations. At the Licensee’s election, which must be made within thirty (30) calendar days from termination or expiration of contract/agreement, Cybersoft will either securely destroy or transmit to the Licensee’s repository any backup copies of Data. Cybersoft will supply a certificate indicating the records disposed of the date disposed of, and the method of disposition used.

Upon Licensee’s election, which must be made within thirty (30) calendar days from termination or expiration of contract/agreement, Cybersoft will immediately place a hold on data destruction or disposition under its usual records retention policies of records that include Data, in response to an oral or written request from the Licensee indicating that those records may be relevant to litigation that the

Licensee reasonably anticipates. Oral requests for a hold on record destruction will be reduced to writing and supplied to Cybersoft for its records within forty-eight (48) hours of said oral request. The Licensee will promptly coordinate with Cybersoft regarding the preservation and disposition of these records. Cybersoft shall continue to preserve the records until further notice. This preservation of records will be carried out at a mutually agreed upon cost to the Licensee.

Page 6 of 6 Cybersoft Technologies, Inc.

Ph. 281.453.8500

Data Transfer Upon Termination or Expiration

Upon Licensee election, which must be made within thirty (30) calendar days from termination or expiration of contract/agreement, Cybersoft will ensure that all Data is securely transferred to the Licensee or a third-party designated by the Licensee, within thirty (30) calendar days from the election. Cybersoft will ensure that Data will be made available to the Licensee in a mutually agreed upon non- proprietary format.

Cybersoft will provide the Licensee with no less than thirty (30) calendar days’ notice of impending cessation of its business or that of any of its subcontractors and any contingency plans in the event of notice of such a cessation of business. Cybersoft’ s contingency plan will include a plan for the immediate transfer of data.