anDREa is committed to protecting the security of its business information in the face of incidents and unwanted events.
The purpose of this document is to describe anDREa’s what is at the core of the design and implementation of the myDRE.
This document will be updated at least annually and when a significant change happens to the relevant areas covered.
In providing a solution for organizations employing people needing to receive, process, analyze and transfer data in a secure and controlled manner, we have come to value:
Being in control over eliminating risks
Empowering responsibility over organizational procedures
Making the easiest the correct way over eliminating all possible wrong ways
Containment and isolation over low-cost solutions
Stimulating good behaviour over preventing wrong behaviour
That is, while there is value in the items on the right, we value the items on the left more.
Further, while we are diligent in protecting against unauthorized processes or people and we do monitor for strange behaviour, we do not provide protection against authorized people with malicious intent.
Known risks can be managed, unknown risks not.
It is relatively easy to ensure that people working on the platform cannot do any wrong things. However, this means that only very few people can do their work properly. The majority of people need to find an ‘alternative’. Apart from the alternatives we know are much less secure, those alternatives are most of the time not visible to the organization.
It is our belief that both the users and the organization are best served by being in control from their own perspective
Even the notion of scarcity triggers more demand than actually needed. Opening ports does impact the security and audit of a workspace. Turning off auto shutdown can result in higher costs, too much compute and storage increases cost. Turning off auto-update/patching of Windows VMs impacts security.
It is our belief that people, already entrusted with great responsibility, that can access the things they need on-demand are less likely to use it any longer than strictly needed. This is inversely true for how dependent on others they feel.
Less is more.
Efficiency is a key driver in the behaviour of people, especially the target group for the Azure DRE. Other key characteristics of the target group are way above average intelligence and dedication to proving something everybody before them and currently living didn’t find or thought of.
It is our belief that by eliminating the need for workarounds, by offering easy to use foolproof functionalities with smart workflows we are serving the interest of both the users as the organizations. The smart workflows help to take responsibility and provide demonstrable proof of correct behaviour.
In the growing population of users, there are some who not only have the skills to find ‘alternative’ ways, but are more than willing to, or even eager, to use them on the Azure DRE. We believe that enlisting them in a White Hat Hacker Program is for the benefit of all.
Equally, as we are growing in the number of users, also the number of people with potentially malicious intent grow. Of course, starting from the design, we will eliminate as many ‘alternative’ ways as economically sound. That is why we also believe that the honeytraps and smart monitoring we will be creating, will be more effective than trying to eliminate all possible wrong ways.
Any euro spent not on the actual work, is in potential one euro too much. It is unlikely that unlikely events do not happen.
It is our belief that from an individual user point of view, the probability of something going wrong is virtually zero; be it a data leak, corrupt or lost machine, etc. For a reasonably sized organization, the probability translates into several incidents a year with damage and recovery costs ranging from several hundred to millions of euros. Reputation damage can even have a long-lasting deep impact. Prevention and demonstrable evidence of non-negligence are therefore provided from design to implementation.
However, with an ever-growing user base the likelihood of an unlikely event increases. That is why we believe that the best protection is through containment and isolation; from design to implementation.
Bad news travels faster than good news. Tell me how you measure me, and I’ll tell you how I behave.
It is our belief that a small portion of the user group will always do the right thing no matter what. Equally, there is a small portion of users that will be at least very tempted to do the wrong thing for various reasons. The majority of users sit widely spread in the middle. By making sure that what is needed is easily available (~carrot). That, especially correct, the behaviour of users is logged (~carrot: users can demonstrate correct behaviour and stick: no proof or logged ‘strange’ user actions). Together with users knowing that a platform-wide ban can be invoked (~stick), very few people will attempt to do the wrong thing on myDRE.