Security is of the utmost importance in the modern digital age, and we take it very seriously at CobbleStone. In addition to taking CISA's (Cybersecurity and Infrastructure Security Agency) Secure by Design Pledge, we utilize a robust, multi-layered defense to safeguard our clients' data and systems. This blog entry describes some of the most important security measures we have in place, with a focus on our proactive strategy for threat mitigation and data protection.
The Cybersecurity and Infrastructure Security Agency (CISA) launched the "Secure by Design" program to encourage software developers to incorporate security into the design and development of their products. The goal is to reduce vulnerabilities and make it harder for an attacker to exploit weaknesses in software.
Under this initiative, CISA released the "Secure by Design Pledge," a self-proclaimed commitment by software vendors to adhere to a list of key security goals. By signing the pledge, companies demonstrate outwardly that they are dedicated to building security into their products from the very beginning.
CobbleStone Systems is proud to endorse CISA's Secure by Design Pledge, demonstrating our commitment to developing software that is both reliable and inherently secure from the moment it is deployed.
CobbleStone Contract Insight® Enterprise supports Multi-Factor Authentication (MFA), adding an extra layer of security for user logins. Beyond the standard username and password, authorized users can set up additional validation. This can involve requiring a code or answering configurable challenge questions, significantly reducing the risk of unauthorized access.
We maintain a stringent internal password policy, adhering to NIST guidelines, to secure our corporate network. Key aspects of our password management include:
CobbleStone is committed to actively monitoring and managing vulnerabilities. Our approach includes:
Regular Vulnerability Testing: We conduct monthly Vulnerability Penetration (VulPen) tests and reporting using the Qualys platform. We also utilize specialized tools like PenTest Tools, Probely, and ImmuniWeb. Our vulnerability scanning leverages a comprehensive database of over 35,000 checks, ensuring we stay ahead of emerging threats.
Dependency Monitoring: We perform manual source code reviews and Static Application Security Testing (SAST) for all software projects. Each release undergoes thorough vulnerability scanning, including malware scanning and VulPen testing against OWASP standards, using tools like Fortify Static Code Analyzer.
Patch Management: Critical OS and software patches are applied immediately upon verification. If a critical patch cannot be applied immediately, the affected services are disabled until the patch is implemented. We conduct weekly audits of our Vulnerability Management reports.
Zero-Day Vulnerability Response: In the event of a zero-day vulnerability discovery, we issue an immediate stop usage order for the affected product or service. Our security posture includes keeping systems updated, using antivirus and firewalls, and monitoring networks with an SIEM tool.
Security Controls for Public-Facing Applications: We have implemented several controls, including HTTP Strict Transport Security, Content Security Policy, and Cross-Site Scripting Protection, to protect our public-facing applications.
For our standard SaaS offering, CobbleStone's dedicated IT resources handle all software and vulnerability patching. Critical OS and software patches are applied immediately upon verification to mitigate security risks. If a critical patch cannot be applied immediately, the affected services are disabled until the patch can be applied. We audit Vulnerability Management reports weekly.
CobbleStone will notify clients as soon as possible (and within one hour of confirmation if unresolved) upon confirming a true intrusion, attack, and/or full denial of service affecting the system(s) a client resides on.
This notification will include:
We at CobbleStone are committed to the highest level of security for our clients. We recommit ourselves every day to protecting your valuable data and assuring security, integrity, and availability in our services. We continuously review and update our security practices to stay ahead of evolving threats and to earn your trust.
To see CobbleStone in action, book a free demo today!
*Legal Disclaimer: This article is not legal advice. The content of this article is for general informational and educational purposes only. The information on this website may not present the most up-to-date legal information. Readers should contact their attorney for legal advice regarding any particular legal matter.