Overview

1. Plug and Play Push module eliminates the need to expose the Edge Devices to the public internet.
2. In case the Integrator needs direct access to Edge Device WebUI for troubleshooting reasons, we provide an option to create a secure, temporary proxy connection to the device.
3. Further lock-down options are available such as autogenerating strong passwords, blocking inbound connections, and others.

Security is a first-class citizen in our Cloud.

1. Every AWS Service where data lands provides Encryption at-rest and in-transit.
2. Full trail logs, application logs, metrics, and alerts are collected and can be provided upon request.
3. AWS Services, such as Guard Duty, provides us with continuous monitoring for malicious activity and unauthorized behavior.
4. We utilize Storage with eleven 9s of durability and each file has a unique signature (md5).
5. We heavily utilize AWS server-less architecture, where tasks are executed on demand. This eliminates the need to worry about servers, the underlying systems being unpatched, outdated, or other similar issues.
6. Long-lasting tasks are executed in a containerized,  virtual private cloud environment.
7. For the public sector, even more secure GovCloud is available.

For End-User security we provide:

1. 2 Factor Authentication.
2. HTTPS protocol mandatory everywhere.
3. Native UI without any add-ons.
4. The single code base for web UI and Mobile Apps – to reduce the attack surface.

The following is an outline of the main layers of security we utilize to ensure that all data is protected and always handled in accordance with the industry best practice policies.

The first layer of security is provided from Amazon AWS, here are some of the bullet points:

Cloud Infrastructure

1. Local Security utilizes AWS security services: Security, Identity, and Compliance on AWS
2. AWS WAF used as a firewall (only available for Local Security domains, extra charge is applied for white label domains).
3. AWS Certificate Manager to issue SSL certificates.
4. AWS GuardDuty is used to continuously monitor and detect malicious activity.
5. AWS SecretManager is used to store sensitive data in an encrypted fashion.
6. AWS IAM is used for Identity management, policy and roles.
7. Services are isolated based on docker containers.
8. Machines are located in VPCs.
9. Access to AWS resources for Containers controlled through IAM policies.
10. RDS (Database) access is controlled through IAM policies.
11. MFA required for all accounts. Access to AWS restricted by IAM policies.
12. RDS are located in their own VPC.
13. Streaming servers are in separate DMZ VPC.
14. All server logs are stored in AWS CloudWatch. Based on metrics generated alerts delivered to the support team.
15. All server-less infrastructure logs are stored in CloudTrail and CloudWatch. Based on metrics generated alerts delivered to the support team.
16. Logs are reviewed weekly using AWS Athena.
17. S3 provides 99.999999999% durability. Each file signed with an md5 signature.
18. Servers are always updated to the latest AMI.
19. Security Hotfixes are being propagated through the System Services Manager (SSM) at the scheduled update time.
20. Server-less architecture is always using the latest fully patched OS version.

The second layer is provided by our software development practices.

Software Development

1. Local Security exercises mandatory policy to move to new framework versions.
2. The latest updated libraries during the build process are used.
3. Best practices during the development process are followed.
4. Standard libraries and approaches to encryption, authentication and authorization are used.
5. Local Security performs load tests and code inspection on every new version build.
6. End-user UI (web/mobile) is checked against the common vectors of attacks. Extraneous content on the client is blocked using CSP headers.
7. Full logs of UI interactions are stored in AWS CloudWatch.
8. All communication is done over SSL.
9. Local Security offers pure HTML5 UI without any plugins, ActiveX, or other add-ons.

The third layer comes with our P&P technology.

Edge Devices

1. Local Security Push module is the most secure way and network-friendly method to connect an edge device to the cloud.
2. Local Security Push module will initiate outbound 443 TCP connection to a cloud on startup. To block such a connection requires blocking all Outbound HTTPS traffic on the firewall.
3. No public IP or ports need to be exposed to access and stream the edge device.
4. No changes to edge device firmware are performed to avoid introducing potential security holes. Local Security Push module is installed as an add-on on top of the firmware.
5. Auto-updater in the Local Security Push module is used to perform remote centralized updates without the need to go on-site.
6. Local Security Push module includes the option to fully lock-in a camera. In such a case the camera would be available only through the cloud and no local access to the camera would be possible.
7. Push Proxy server is available to generate a temporary URL to access edge device Web UI through a cloud for maintenance and troubleshooting.
8. With some camera manufacturers, there is an option to prevent removing the Local Security Push module even in case of camera firmware is change, a factory reset is performed, or any other unauthorized tampering is done to the camera.
9. Full access logs are stored in AWS CloudWatch.