Sikkerhetsdokumentasjon
This document provides a comprehensive overview of the security framework for Identum's products and services, including eADM and eFeide. Our security posture is built on industry best practices, robust operational procedures, and a commitment to protecting customer data.
1. Development and Design Philosophy
Our development process is guided by a "security-first" mindset, incorporating foundational principles of modern cybersecurity.
Privacy by Design
Identum's core development philosophy is Privacy by Design. This means that privacy and data protection are embedded into the design and architecture of our systems from the outset, not added as an afterthought. We adhere to the seven foundational principles:
Proactive not Reactive; Preventative not Remedial: We anticipate and prevent privacy-invasive events before they happen.
Privacy as the Default Setting: User data is protected automatically; no user action is required to secure their privacy.
Privacy Embedded into Design: Privacy is an essential component of the core functionality.
Full Functionality (Positive-Sum, not Zero-Sum): We avoid false dichotomies, such as privacy vs. security, proving it is possible to have both.
End-to-End Security (Full Lifecycle Protection): Data is securely protected from collection to destruction.
Visibility and Transparency: We maintain open communication about our processes and are subject to independent verification.
Respect for User Privacy (User-Centric): We place the interests of the individual first by offering strong privacy defaults and user-friendly controls.
Zero Trust Architecture
We operate on a Zero Trust security model. This model assumes that no user or device should be trusted by default, regardless of whether they are inside or outside the network perimeter. Every access request is strictly verified and continuously authorized.
Identity Verification: All access requests require strong authentication, typically using Multi-Factor Authentication (MFA).
Principle of Least Privilege: Users are granted the minimum level of access required to perform their tasks. Permissions are granular, dynamic, and based on need.
Continuous Monitoring: All system activity is monitored and analyzed to detect and respond to suspicious behavior or unusual access patterns.
Data Protection: Data is protected through encryption, both in transit and at rest, with access strictly controlled based on necessity.
Data Minimization
In line with GDPR, we practice data minimization. We only collect, process, and store the personal data that is strictly necessary for a legitimate purpose.
Limited Collection: We only import data required for specific functions. For example, salary data is not imported by default.
Limited Retention: Data is stored only as long as there is an operational or legal need. Deactivated users are retained for a default of 365 days, a period that can be customized by the customer.
Anonymization and Aggregation: Whenever possible, data is aggregated or anonymized to prevent individual identification.
Purpose Limitation: Data is only used for the clear and transparent purposes for which it was collected.
Pseudonymization: Where identifiable data is necessary, we use data aliases to protect user identities and reduce the impact of potential data breaches.
2. Operations and Hosting
Our operational security is based on the Norwegian National Security Authority's (NSM) fundamental principles for ICT security and is hosted on a world-class infrastructure.
Hosting and Infrastructure
Identum's solutions are cloud-based, hosted, and maintained by our partner, Microsoft Azure in Norway. The physical servers are located in Eastern Norway.
The infrastructure includes built-in redundancy, external backups, and load balancing, with an uptime guarantee of 99.9% as defined in our SLA.
Identum is responsible for the operating system and software, while Microsoft manages the hardware, network, offsite backups, redundancy, and firewalls.
Access to the server environment is strictly limited to authorized technical personnel at Identum and necessary operational staff at Microsoft, secured via TeamViewer clients with MFA.
Patching and Updates
To mitigate known vulnerabilities, all systems, servers, and components are patched and updated weekly on Sundays. A dedicated resource at Identum is responsible for this process.
As an organization designated as critical infrastructure, Identum receives notifications from the National Cyber Security Centre (NCSC) regarding security vulnerabilities and exploits. We conduct continuous threat assessments and patch relevant vulnerabilities promptly.
Product updates for eFeide and eADM are deployed on Sundays following 14-day development sprints. Note: To ensure stability, non-critical eFeide updates are paused during school start and exam periods.
Encryption
Data at Rest: All data stored on our Azure-hosted servers is protected by standard server-side encryption. Encryption keys are managed automatically by the Azure platform.
Data in Transit: All communication between Identum's servers, clients, browsers, and third-party systems is end-to-end encrypted using TLS 1.2 with 2048-bit keys. SSL certificates are issued by Digicert and renewed annually.
Passwords and Secrets: All system passwords (secrets) within eADM and eFeide are secured with Rijndael AES 256-bit encryption. User passwords are stored hashed and encrypted in our LDAP database, which uses standard Active Directory technology.
Data Segregation
Customer data is logically separated using a unique customer ID. All data tables are linked to this ID, and every API request must include this key as a mandatory parameter. This ensures that each customer's data remains isolated and secure, preventing any cross-customer data exposure.
3. Backup and Business Continuity
We have robust plans and procedures to ensure data integrity and service availability.
Backup and Recovery
Databases are backed up every 10 minutes. The entire production environment is backed up daily.
Backups are stored in a physically separate environment from the production servers.
To validate backup integrity, our test environment, a complete copy of production, is restored from these backups at least every 14 days.
Business Continuity Plan
Our entire server environment can be restored from scratch in under six hours, either in the primary or a secondary environment (e.g., in case of a DDoS attack).
Individual customer instances can also be restored from backup. This service can be requested through Identum support for scenarios like correcting a faulty data import and is treated as a Level A priority issue.
4. System Monitoring and Threat Management
As a wholly-owned subsidiary of Visma, Identum is integrated into Visma's advanced cybersecurity, monitoring, and threat management routines.
Threat Detection and Response
Visma utilizes SentinelOne, an AI-powered platform, for Managed Detection and Response (MDR).
SentinelOne continuously monitors all Identum servers, clients, endpoints, and employee computers.
All events are logged and evaluated by Visma's Security Operations Centre (SOC) team, which provides 24/7/365 monitoring and response. In the event of a critical incident, the SOC team initiates countermeasures immediately, even before notifying Identum.
Penetration Testing
An annual security review and penetration test of our solutions is conducted by Visma's cybersecurity team. Any identified weaknesses are remediated promptly. The latest test revealed no critical risk elements.
Customers are free to conduct their own penetration tests of our services.
Incident Management
All security and privacy incidents are logged in a dedicated register. Customers are routinely notified of any relevant internal or external incidents.
Identum has an agreement for assistance from Visma's cybersecurity group in the event of an attack. A dedicated response team will be established to manage the situation and restore any affected systems.
5. Information Security and Compliance
Identum is committed to upholding the highest standards of information security and regulatory compliance.
GDPR and Privacy
We only import user data that is necessary for processing. For example, parental data is not used for Feide catalogs, and we filter out employees who do not require accounts.
The customer's source systems (e.g., HR, Student Admin) are the authoritative source for user data. The user lifecycle in our systems (create, update, delete) is driven by the data in these source systems.
eADM automates the de-provisioning process, ensuring that user accounts and data are handled correctly when a user leaves, dies, or goes on leave, preventing orphaned accounts.
All users can view the data registered on them at any time through a dedicated privacy section in the user interface.
ISO 27001 and the Visma Cloud Delivery Model (VCDM)
As a Visma company, Identum adheres to the Visma Cloud Delivery Model (VCDM), a framework for developing, delivering, and operating secure cloud services.
Our Information Security Management System (ISMS) is ISO 27001 certified and is audited annually by an independent third party.
Visma's compliance with the ISMS is also audited annually under the ISAE 3402 SOC 1 Type II standard, providing comprehensive assurance of our security and quality controls.
Change and Update Management
We use a Continuous Integration/Continuous Deployment (CI/CD) methodology with frequent, small updates to minimize risk.
Changes are typically deployed behind "feature toggles," allowing us to activate new functionality only when it is fully tested and ready.
Our release strategy is to "roll forward" by fixing any issues with a new update rather than rolling back, ensuring continuous improvement.
6. Security and Access Control
Access to our systems is strictly controlled for both customers and internal personnel.
Customer Access Control
We strongly recommend MFA for all users and require MFA for all administrator-level accounts. Supported authentication methods include username/password with MFA, IDporten, or SSO with Entra ID.
We enforce the principle of least privilege. Customers are advised to be restrictive with administrator permissions and use roles like Servicedesk for daily tasks.
All changes made through the web interface are automatically logged.
Internal Access Control
Identum employees are granted access based on the principle of least privilege according to their role.
Only employees actively working with operations and support have access to customer data.
All access is immediately revoked upon employment termination.
All actions taken by Identum employees are logged in the same manner as customer actions, ensuring full transparency.
Comprehensive Logging and Auditing
eADM maintains a complete, immutable log of all changes to users, groups, and departments. This includes changes from source systems and manual changes made in eADM.
Logs record the object ID, timestamp, reason for change, who made the change, the previous value, and the new value.
All login attempts (successful and failed), password changes, and API calls are logged with user, timestamp, IP address, and status.
Passordadministrasjon
Temporary first-time passwords can be generated according to customer-defined complexity rules.
Users can be required to change their first-time password upon initial login.
Self-service password reset is available via SMS or IDporten authentication (recommended).
Passwords are not visible to any user—including administrators—after the initial setup.
Data Export and Handling
Customers control what data is exported to third-party target systems via synchronization templates.
Our best-practice recommendation is to export only the minimum data necessary for the target system's function.
Use of National ID Numbers:
On-Premises AD: If a national ID number is used as a unique attribute (e.g., employeeID), we recommend that the attribute is either encrypted or hidden from non-administrative users.
Azure AD / Entra ID: Warning: We do not recommend using the national ID number as a unique attribute in Azure AD, as the field cannot be adequately protected or hidden. Use an employee number or another unique identifier instead.
Sammendrag for AI og søk
This document outlines the comprehensive security framework for Identum's eADM and eFeide products. It covers the "Privacy by Design" and "Zero Trust" development philosophy, ISO 27001 certification via the Visma Cloud Delivery Model, and secure hosting in Microsoft Azure. The framework includes continuous threat monitoring by Visma's SOC, annual penetration testing, robust backup and disaster recovery plans, and detailed policies for encryption, access control, and GDPR-compliant data handling.