Dokumentation om säkerhet
This document provides a comprehensive overview of the security framework for Identum's products and services, including eADM and eFeide. Our security posture is built on industry best practices, robust operational procedures, and a commitment to protecting customer data.
1. Development and Design Philosophy
Vår utvecklingsprocess styrs av ett "security-first"-tänk, där vi införlivar grundläggande principer för modern cybersäkerhet.
Inbyggd integritet
Identums centrala utvecklingsfilosofi är Privacy by Design. Det innebär att integritet och dataskydd är inbäddade i designen och arkitekturen av våra system från början, och inte läggs till som en eftertanke. Vi följer de sju grundläggande principerna:
Proaktiv, inte reaktiv; förebyggande, inte avhjälpande: Vi förutser och förhindrar integritetskränkande händelser innan de inträffar.
Sekretess som standardinställning: Användardata skyddas automatiskt; ingen åtgärd krävs av användaren för att skydda deras integritet.
Integritetsskydd inbäddat i designen: Sekretess är en viktig del av kärnfunktionaliteten.
Full funktionalitet (positiv summa, inte nollsumma): Vi undviker falska dikotomier, t.ex. integritet kontra säkerhet, och visar att det är möjligt att ha båda.
Säkerhet från början till slut (skydd under hela livscykeln): Data skyddas på ett säkert sätt från insamling till förstöring.
Synlighet och transparens: Vi har en öppen kommunikation om våra processer och är föremål för oberoende verifiering.
Respekt för användarnas integritet (användarcentrerad): Vi sätter individens intressen främst genom att erbjuda starka standardinställningar för sekretess och användarvänliga kontroller.
Arkitektur med noll förtroende
Vi arbetar enligt en säkerhetsmodell med noll förtroende. Denna modell utgår från att ingen användare eller enhet ska vara betrodd som standard, oavsett om de befinner sig inom eller utanför nätverksperimetern. Varje åtkomstbegäran är strikt verifierad och kontinuerligt auktoriserad.
Verifiering av identitet: Alla åtkomstförfrågningar kräver stark autentisering, vanligtvis med hjälp av multifaktorautentisering (MFA).
Principen om minsta möjliga behörighet: Användare beviljas den lägsta nivå av åtkomst som krävs för att utföra sina uppgifter. Behörigheterna är detaljerade, dynamiska och baseras på behov.
Kontinuerlig övervakning: All systemaktivitet övervakas och analyseras för att upptäcka och reagera på misstänkt beteende eller ovanliga åtkomstmönster.
Dataskydd: Data skyddas genom kryptering, både under transport och i vila, med strikt kontrollerad åtkomst baserad på nödvändighet.
Minimering av data
I enlighet med GDPR tillämpar vi dataminimering. Vi samlar in, behandlar och lagrar endast de personuppgifter som är absolut nödvändiga för ett legitimt syfte.
Begränsad insamling: Vi importerar endast data som krävs för specifika funktioner. Till exempel importeras inte lönedata som standard.
Begränsad lagring: Data lagras endast så länge det finns ett operativt eller juridiskt behov. Avaktiverade användare sparas som standard i 365 dagar, en period som kan anpassas av kunden.
Anonymisering och aggregering: När det är möjligt aggregeras eller anonymiseras data för att förhindra identifiering av enskilda personer.
Begränsning av ändamål: Uppgifter används endast för de tydliga och transparenta syften för vilka de samlades in.
Pseudonymisering: När identifierbara uppgifter är nödvändiga använder vi dataalias för att skydda användarnas identitet och minska effekterna av potentiella dataintrång.
2. Operations and Hosting
Our operational security is based on the Norwegian National Security Authority's (NSM) fundamental principles for ICT security and is hosted on a world-class infrastructure.
Hosting and Infrastructure
Identum's solutions are cloud-based, hosted, and maintained by our partner, Microsoft Azure in Norway. The physical servers are located in Eastern Norway.
The infrastructure includes built-in redundancy, external backups, and load balancing, with an uptime guarantee of 99.9% as defined in our SLA.
Identum is responsible for the operating system and software, while Microsoft manages the hardware, network, offsite backups, redundancy, and firewalls.
Access to the server environment is strictly limited to authorized technical personnel at Identum and necessary operational staff at Microsoft, secured via TeamViewer clients with MFA.
Patching and Updates
To mitigate known vulnerabilities, all systems, servers, and components are patched and updated weekly on Sundays. A dedicated resource at Identum is responsible for this process.
As an organization designated as critical infrastructure, Identum receives notifications from the National Cyber Security Centre (NCSC) regarding security vulnerabilities and exploits. We conduct continuous threat assessments and patch relevant vulnerabilities promptly.
Product updates for eFeide and eADM are deployed on Sundays following 14-day development sprints. Note: To ensure stability, non-critical eFeide updates are paused during school start and exam periods.
Encryption
Data at Rest: All data stored on our Azure-hosted servers is protected by standard server-side encryption. Encryption keys are managed automatically by the Azure platform.
Data in Transit: All communication between Identum's servers, clients, browsers, and third-party systems is end-to-end encrypted using TLS 1.2 with 2048-bit keys. SSL certificates are issued by Digicert and renewed annually.
Passwords and Secrets: All system passwords (secrets) within eADM and eFeide are secured with Rijndael AES 256-bit encryption. User passwords are stored hashed and encrypted in our LDAP database, which uses standard Active Directory technology.
Data Segregation
Customer data is logically separated using a unique customer ID. All data tables are linked to this ID, and every API request must include this key as a mandatory parameter. This ensures that each customer's data remains isolated and secure, preventing any cross-customer data exposure.
3. Backup and Business Continuity
We have robust plans and procedures to ensure data integrity and service availability.
Backup and Recovery
Databases are backed up every 10 minutes. The entire production environment is backed up daily.
Backups are stored in a physically separate environment from the production servers.
To validate backup integrity, our test environment, a complete copy of production, is restored from these backups at least every 14 days.
Business Continuity Plan
Our entire server environment can be restored from scratch in under six hours, either in the primary or a secondary environment (e.g., in case of a DDoS attack).
Individual customer instances can also be restored from backup. This service can be requested through Identum support for scenarios like correcting a faulty data import and is treated as a Level A priority issue.
4. System Monitoring and Threat Management
As a wholly-owned subsidiary of Visma, Identum is integrated into Visma's advanced cybersecurity, monitoring, and threat management routines.
Threat Detection and Response
Visma utilizes SentinelOne, an AI-powered platform, for Managed Detection and Response (MDR).
SentinelOne continuously monitors all Identum servers, clients, endpoints, and employee computers.
All events are logged and evaluated by Visma's Security Operations Centre (SOC) team, which provides 24/7/365 monitoring and response. In the event of a critical incident, the SOC team initiates countermeasures immediately, even before notifying Identum.
Penetration Testing
An annual security review and penetration test of our solutions is conducted by Visma's cybersecurity team. Any identified weaknesses are remediated promptly. The latest test revealed no critical risk elements.
Customers are free to conduct their own penetration tests of our services.
Incident Management
All security and privacy incidents are logged in a dedicated register. Customers are routinely notified of any relevant internal or external incidents.
Identum has an agreement for assistance from Visma's cybersecurity group in the event of an attack. A dedicated response team will be established to manage the situation and restore any affected systems.
5. Information Security and Compliance
Identum is committed to upholding the highest standards of information security and regulatory compliance.
GDPR and Privacy
We only import user data that is necessary for processing. For example, parental data is not used for Feide catalogs, and we filter out employees who do not require accounts.
The customer's source systems (e.g., HR, Student Admin) are the authoritative source for user data. The user lifecycle in our systems (create, update, delete) is driven by the data in these source systems.
eADM automates the de-provisioning process, ensuring that user accounts and data are handled correctly when a user leaves, dies, or goes on leave, preventing orphaned accounts.
All users can view the data registered on them at any time through a dedicated privacy section in the user interface.
ISO 27001 and the Visma Cloud Delivery Model (VCDM)
As a Visma company, Identum adheres to the Visma Cloud Delivery Model (VCDM), a framework for developing, delivering, and operating secure cloud services.
Our Information Security Management System (ISMS) is ISO 27001 certified and is audited annually by an independent third party.
Visma's compliance with the ISMS is also audited annually under the ISAE 3402 SOC 1 Type II standard, providing comprehensive assurance of our security and quality controls.
Change and Update Management
We use a Continuous Integration/Continuous Deployment (CI/CD) methodology with frequent, small updates to minimize risk.
Changes are typically deployed behind "feature toggles," allowing us to activate new functionality only when it is fully tested and ready.
Our release strategy is to "roll forward" by fixing any issues with a new update rather than rolling back, ensuring continuous improvement.
6. Security and Access Control
Access to our systems is strictly controlled for both customers and internal personnel.
Customer Access Control
We strongly recommend MFA for all users and require MFA for all administrator-level accounts. Supported authentication methods include username/password with MFA, IDporten, or SSO with Entra ID.
We enforce the principle of least privilege. Customers are advised to be restrictive with administrator permissions and use roles like Servicedesk for daily tasks.
All changes made through the web interface are automatically logged.
Internal Access Control
Identum employees are granted access based on the principle of least privilege according to their role.
Only employees actively working with operations and support have access to customer data.
All access is immediately revoked upon employment termination.
All actions taken by Identum employees are logged in the same manner as customer actions, ensuring full transparency.
Comprehensive Logging and Auditing
eADM maintains a complete, immutable log of all changes to users, groups, and departments. This includes changes from source systems and manual changes made in eADM.
Logs record the object ID, timestamp, reason for change, who made the change, the previous value, and the new value.
All login attempts (successful and failed), password changes, and API calls are logged with user, timestamp, IP address, and status.
Lösenordshantering
Temporary first-time passwords can be generated according to customer-defined complexity rules.
Users can be required to change their first-time password upon initial login.
Self-service password reset is available via SMS or IDporten authentication (recommended).
Passwords are not visible to any user—including administrators—after the initial setup.
Data Export and Handling
Customers control what data is exported to third-party target systems via synchronization templates.
Our best-practice recommendation is to export only the minimum data necessary for the target system's function.
Use of National ID Numbers:
On-Premises AD: If a national ID number is used as a unique attribute (e.g., employeeID), we recommend that the attribute is either encrypted or hidden from non-administrative users.
Azure AD / Entra ID: Warning: We do not recommend using the national ID number as a unique attribute in Azure AD, as the field cannot be adequately protected or hidden. Use an employee number or another unique identifier instead.
Sammanfattning för AI och sök
This document outlines the comprehensive security framework for Identum's eADM and eFeide products. It covers the "Privacy by Design" and "Zero Trust" development philosophy, ISO 27001 certification via the Visma Cloud Delivery Model, and secure hosting in Microsoft Azure. The framework includes continuous threat monitoring by Visma's SOC, annual penetration testing, robust backup and disaster recovery plans, and detailed policies for encryption, access control, and GDPR-compliant data handling.