Given the role that AuditWolf plays in auditing your cloud environments, its important to understand how we approach the security of your information.
As a SaaS application responsible for accessing important metadata belonging to your cloud resources, you have every right to understand how we approach security. This document outlines how AuditWolf works, and how our shared responsibility model works when working with our company, Microsoft and you.
Access to your login information
AuditWolf is fully integrated into Azure Active Directory as an enterprise application, and doesn't actually store your login information. In other words, we do not hold or store your username and password combination. In fact, we never ask for it.
Instead, we work directly with the Microsoft Cloud and allow the Microsoft Identity Provider (login.microsoftonline.com) to authenticate you. We then use the information that is generated by Microsoft in the form of an "access token" to read the claims about you that they provide and exchange that token for an AuditWolf token that authorizes you access to your information in our services.
This provides simplicity with single sign-on (SSO) so you don't have to ever remember a username or password for AuditWolf, and helps to keep you safe. Account management ends up in your Azure AD tenant, not within AuditWolf.
Fun fact: Want to enforce two-factor authentication when accessing information in AuditWolf? No problem. You can set that up directly in your Azure AD tenant to protect your account. (You should do that anyways... you're probably an Azure admin!)
Access to your cloud subscription(s)
AuditWolf uses role-based access control (RBAC) in Azure to limit the privileges we have to your cloud resources. During onboarding Microsoft prompted you during your first login for consent to allow us to work with you. When you approved that, it granted AuditWolf the "Reader" role to your subscription(s). You can verify this by visiting the Azure portal, selecting a subscription and clicking on "Access Control (IAM)". You will find our application listed there.
No longer wish to have us audit a particular subscription? Simply remove our access by selecting "AuditWolf" from the list and clicking "Remove" from the menu. You can add us to other subscriptions in the same way.
NOTE: Your previous audit history and scan results will not be immediately deleted from AuditWolf when you do this. We consider the subscription "disconnected" but not yet "removed". You will however get a notification from AuditWolf that we no longer see the subscription. If you want the data destroyed you will need to delete the subscription information from the AuditWolf portal.
Access to your data
Data is an organization’s most valuable and irreplaceable asset, and encryption serves as the last and strongest line of defense in a multilayered data security strategy. Our products use encryption to safeguard customer data and help you maintain control over it. Encrypting your information renders it unreadable to unauthorized persons, even if they break through your firewalls, infiltrate your network, get physical access to your devices, or bypass the permissions on your local machine. Encryption transforms data so that only someone with the decryption key can access it.
Our products also use industry-standard secure transport protocols for data as it moves through a network—whether between user devices and Microsoft datacenters or within datacenters themselves. To help protect data at rest, Microsoft offers a range of built-in encryption capabilities, and we use them in AuditWolf.
Protocols and technologies we use include:
- Transport Layer Security/Secure Sockets Layer (TLS/SSL), which uses symmetric cryptography based on a shared secret to encrypt communications as they travel over the network.
- Internet Protocol Security (IPsec), an industry-standard set of protocols used to provide authentication, integrity, and confidentiality of data at the IP packet level as it’s transferred across the network.
- Advanced Encryption Standard (AES)-256, the National Institute of Standards and Technology (NIST) specification for a symmetric key data encryption that was adopted by the US government to replace Data Encryption Standard (DES) and RSA 2048 public key encryption technology.
- Microsoft Azure Storage Service Encryption encrypts data at rest when it’s stored in Azure Blob storage. Azure Disk Encryption encrypts our Windows and Linux virtual machine disks by using the BitLocker feature of Windows and the DM-Crypt feature of Linux to provide volume encryption for the operating system and the data disk.
- Transparent Data Encryption (TDE) encrypts data at rest when it’s stored in an Azure SQL database.
- Azure Key Vault helps us manage and maintain control of the encryption keys used by our cloud apps and services via a cloud based hardware security module (HSM).
Access to your AuditWolf account
By utilizing Microsoft's Azure AD, your login information is tied to your Azure tenant(s). During account creation the first time you used AuditWolf, we linked that information together with our service. Only the account owner can contact us to make changes, or merge AuditWolf accounts (in the case that someone else has a subscription that you are now going to audit and monitor). In the case of ownership changes or significant account alternations we may ask for additional evidence of your identity.
When requesting help from the AuditWolf team, we may need access to your AuditWolf account. In many cases we can't see your encrypted data without this permission. You will be asked to grant us temporary access that will allow us to login with the same permissions as you into your AuditWolf account. Once you do this, the following occurs:
- An audit record is written to your Account timeline to provide evidence of when you granted permission, and for how long.
- When staff attempt to access your AuditWolf account they will go through an additional multi-factor authentication check to prove their identity before they will be permitted access.
- After the MFA is validated, the staff member will be granted access to your AuditWolf account.
- All interactions to your account and data that we conduct are recorded in a special audit trail report that you can review at any time.
- On expiration of the authorization window AuditWolf will automatically revoke our access and remove our ability to access your AuditWolf account.
In cases where you cannot grant us access to your AuditWolf account we can arrange a Skype for Business Live Meeting session so you can share your screen and help you that way.
How we protect our infrastructure
AuditWolf itself was built on top of the Microsoft Cloud, and we follow their shared responsibility model. We use a combination of Microsoft's Azure Active Directory for our identity backplane along with a distributed cloud architecture using serverless computing, containerization, durable large-scale queues all backed by our own customized Graph stored in a globally distributed multi-model database cluster. We strive to meet the objectives defined by Microsoft for Operational Security Assurance (OSA).
Our machine learning and artificial intelligence (AI) work is built on top of Azure Machine Learning. Our learning models are designed to anonymize datasets when looking at our metadata in aggregate to protect your privacy while allowing us to continuously make AuditWolf smarter with every scan. This 'privacy-preserving deep learning" is a key tenet of our operations, and we align our beliefs in ethical AI with Microsoft's principles for AI.
We follow Microsoft's Security Development Lifecycle (SDL) patterns & practices for how we build, test and deploy our code to Azure. We enforce multi-factor authentication (MFA) on all our staff, and we do not allow direct access to production workloads without gated elevation. All deployments are handled through deployment automation using Microsoft's enterprise VSTS Release Management processes. This is how we can successfully release several times a week.
We were the first customer of our own platform. AuditWolf continuously monitors our own production workloads.
What happens when things go wrong?
If you get a notification of a non-compliance violation during an audit and you are unsure what it means or what to do, you can always reach out to us by clicking the chat bot on the below right or by sending an email to firstname.lastname@example.org.
What if its more serious? If you have a security concern with AuditWolf, your data or your Azure environment please email us at email@example.com. That account is designed for escalated security triage and alerts our entire security team that you need help. Use it sparingly. Know its there.
Need more information?
Have more questions on the security of AuditWolf? While our information security practices are not generally shared publicly, we will try to help you on a need-to-know basis. Simply click the chat bot on the below right or send an email to firstname.lastname@example.org to engage with our team.