Your organisation is exposed to threats from actors who can attack your buildings, people and systems. The attacks on IT systems are increasing so even the smallest business with an online presence can expect over 100 attacks each day. These attacks can be direct to your external interfaces (such as login attempts or denial of service) or indirect (malware in e-mails or URLs).
Cradle's architecture and features minimise the vulnerabilities that it creates for the organisations that use it. You can deploy Cradle and be confident that it will contribute to the confidentiality, integrity and availability of your information:
- Known Origin. All software in the Cradle product has a known origin that you can trust.
- Guaranteed Content. 3SL guarantees that malicious code cannot be built into Cradle.
- No External Links. Cradle has no interface to external resources and never accesses the Internet for any reason.
- Independent Certification. Cradle has been approved for Government use and has received security accreditation.
- Information at Rest. Everything is stored on the server, nothing is local to users. The only access to data is by Cradle. All features that allow information to be copied locally, including printing, can be restricted. Passwords are stored encrypted.
- Information in Transit. All information pathways in Cradle are encrypted, including SSL when requested (such as HTTPS). Passwords are sent encrypted.
- Resistance to Attack. Cradle resists attacks using IP blocking, automated account disable and user disconnection. Logs are provided. All web UIs have been independently checked and have no vulnerabilities.
- Resilience. Cradle servers run, unattended, 24x7. They detect and recover from data or internal errors to be 100% available.
- User Authentication. You can allow Cradle to authenticate or link to your LDAP server. A range of policies can be defined if Cradle is to authenticate its users.
- Access Control. You can control what information users can access, what their access is, and the operations they can perform.
- Change Histories. Cradle records every change made to the content of, and links to and from, all database items. You can control how users are alerted to changes.
- Notifications. You can control which events in Cradle will trigger alerts, how alerts are delivered (typically e-mail) and who will receive them.
- API Misuse. It is impossible for the database to be compromised by applications created with the Cradle API. Operations through the API are subject to the same controls as Cradle itself.
- Problem Diagnosis. Cradle includes a feature to sanitise exported information so you can safely pass data to 3SL for problem diagnosis, after other approaches have been used.
Cradle helps to reduce all information security risks and contributes to the information security of your projects and your organisation. It is a powerful addition to your ISMS for accreditations including ISO 27001.
