Device Security Overview

document overview this document provides an overview of the data security of terso’s solutions while this document aims to proactively answer security related questions, any additional comments or questions are welcomed please contact terso technical support by dialing +1 888 376 0257 in the u s or +490 6227 789 3003 in europe support can also be contacted by visiting https //www tersosolutions com/support https //www tersosolutions com/support/ management commitment to security terso is committed to preserving the security of the data that our customers entrust to us our solutions are engineered with security as a top priority we ensure that our employees have the appropriate skills, training, and supervision so that they understand and follow our policies, processes, and procedures general description of solution terso produces a range of cabinets, refrigerators, freezers, and other solutions (collectively referred to as devices) that track valuable inventory using rfid tags attached to each item the devices communicate with jetstream®, terso’s cloud based data platform, over the internet using secure communication protocols customer data systems, such as hospital information systems (his), enterprise resource planning (erp) systems, and a wide array of other systems, can then be configured to query jetstream for information provided by the connected devices the following sections provide additional details device security the terso devices run a custom embedded linux distribution that has been hardened by removing or disabling all listening services except for the dynamic host configuration protocol (dhcp) client access to the device's operating system is only achieved by removing the protective cover from the device and then connecting to an on board serial based console port the firmware running on the devices allows for limited, local configuration by connecting to the external usb port secure socket shell (ssh) is disabled by default additionally, the firmware monitors for ssh and will disable the service if it is somehow found to be running since the devices are installed on a customer’s premises, the customer is responsible for the physical security of the device as well as its contents customers may implement network security controls as necessary to meet organizational security requirements without adversely affecting the device communication in most circumstances an alternative approach is to put the devices on isolated network segments or use a network access control solution terso devices are designed to always initiate the connection to the jetstream web services; no listening transmission control protocol (tcp) ports are required this allows the tcp three way handshake to occur so that port forwarding is not necessary on network hardware the device transmits various event data to jetstream data may include the rfid tag values, rfid access pass values, and status information such as temperature the data is sent as xml or json messages that are typically 10 kilobytes or less, with a maximum size of 100 kilobytes occasionally, maintenance files are downloaded by the device and range from 350 kilobytes to 15 megabytes the devices use the following tcp/ip protocols https (tcp port 443) – the devices send messages to jetstream via an api call made over https this may include the use of websockets ( https //en wikipedia org/wiki/websocket https //en wikipedia org/wiki/websocket ) to reduce bandwidth and latency dns (udp/tcp port 53) – devices will perform domain name lookups to resolve the ip addresses associated to jetstream jetstream security the jetstream servers are hosted by amazon web services ( https //aws amazon com/ https //aws amazon com/ ) aws provides the security for the servers administrative access to the servers is limited to a small team of operators within terso who are tasked with the maintenance and reliability of these systems these duties include uptime monitoring, patching, and scanning for vulnerabilities technical questions does the hardware work with a proxy server? terso devices do not support communication to the internet via active proxy server devices do support passive proxy (nat/pat) what dns servers can be utilized? any properly configured domain name server (dns) on the internet will be able to resolve or forward queries for jetstream domain names which public ip addresses does jetstream use for device communication? jetstream uses the following static wan ip addresses for device communication north america 75 2 101 220 99 83 145 141 europe 13 248 214 238 76 223 77 150 asia pacific 13 248 201 251 76 223 90 163 what are websockets? how do they work? a websocket is a full duplex communication protocol used by modern web services that need a persistent, full duplex communication channel it is a tcp protocol standardized by the internet engineering task force (ietf) operating according to the specifications defined in rfc 6455 ( https //tools ietf org/html/rfc6455 https //tools ietf org/html/rfc6455 ) how do terso devices use websockets? terso devices are designed to use the standard implementation of websockets in this scenario, the device makes a request to the server to create a websocket connection the server will send a periodic “keep alive” over the websocket connection to keep the connection up the connection will remain up until either the device or server terminates it all traffic over the connection is encrypted how is the device os hardened? devices use a linux based embedded operating system that has minimal libraries and processes running it does not have any listening tcp/ip ports to minimize potential network attacks is data encrypted at rest and in motion? data is encrypted when in transit to protect its integrity encryption is accomplished via transport layer security (tls) the data is encrypted at rest in the jetstream databases but not on the device itself where is the device data hosted? terso utilizes amazon web services (aws) to host rfid device data aws is iso 27001 certified confirming their commitment to the security, confidentiality, and availability of their servers more information is available by visiting https //aws amazon com/compliance/iso 27001 faqs/ https //aws amazon com/compliance/iso 27001 faqs/ aws also makes system & organization control (soc) reports available the soc reports can be obtained by visiting https //aws amazon com/compliance/soc faqs/ https //aws amazon com/compliance/soc faqs/ what triggers a device to call home? there are various triggers, but all communications with jetstream originate from the device itself for example, manual triggers, such as opening and closing the door on a device, would trigger an event similarly, events for monitoring temperature or performing an inventory reconciliation are triggered by a configurable schedule how is lan communication established by the device? the device is designed to initiate all api calls (i e “call home”) all inbound traffic is in response to the device’s outbound session an inbound network communication does not initiate connection does the terso device use a vpn? although the solution is compatible with vpns, no vpn is necessary because data is transmitted over https how are devices updated in the field? the device is scheduled to periodically check if there is a pending firmware upgrade if this occurs, the device will download, validate, and install the new firmware firmware updates can also be performed locally by connecting to the usb port on the device itself does the terso device store or send any personal data? the data transmitted only contains the rfid values for the tags stored inside the device and the user pass id values no personal data is stored or available to the device what if the network security policy requires mac address filtering? if mac address filtering is in place, the network must recognize and permit the device’s nic to communicate contact terso technical support and request the mac address of the device being installed does terso have a business continuity plan? terso maintains important disaster recovery and business continuity plans that may be activated in the event of significant business disruption these plans include nightly backups, failover servers in multiple data centers, and other proactive measures terso’s plans contain details of a confidential and proprietary nature and thus cannot be distributed to the public please contact us http //support tersosolutions com/contact if you have any additional security questions or concerns