Evocon security overview

Introduction

Like all modern companies, Evocon faces challenges related to multi-tenancy, where multiple customers share the same infrastructure, the need for secure APIs to move data between systems, and the constant requirement to manage and mitigate evolving cyber threats.

This document aims to provide an in-depth overview of the security measures implemented by Evocon to protect its SaaS platform. It outlines the strategies and protocols in place to safeguard customer data, ensure regulatory compliance, and maintain service availability.

The primary audience for this document includes potential and current customers, IT security professionals, compliance officers, and auditors who are evaluating the security posture of Evocon.

Information security strategy

Evocon's security strategy is based on a risk assessment process, which is an integral part of our ISO 27001-certified Information Security Management System (ISMS).

We systematically identify, evaluate, and manage risks to our information assets. This process involves identifying potential threats and vulnerabilities, assessing the likelihood and impact of these risks, and implementing appropriate controls to mitigate them. Our risk assessment is regularly reviewed and updated to address new threats and changes in our operational environment, ensuring our security strategy remains effective and aligned with industry standards. Detailed documentation of our risk assessment process is available upon request.

We have implemented a multi-layered security architecture, including data encryption at rest and in transit, advanced user authentication methods for our employees and application users, continuous security monitoring, and a robust incident response plan that is being tested periodically.

Our Secure Development Policy ensures that security considerations are embedded in the architecture and coding practices, with regular code reviews and testing performed during the development process. We also use automated security tools to scan for vulnerabilities and enforce coding standards. Additionally, we conduct annual penetration testing and follow secure deployment practices to ensure that security remains a priority in our live environments.

Rather than having a separate internal security teams, we integrate security directly into everyday processes. This means that all team members are aware of and responsible for security within their respective roles and the approach is cross-functional. Tasks like threat intelligence, monitoring, and configuration being part of the routine work of individuals across different roles.

Architecture

Evocon is a Java application with a front end using Javascript and HTML that is provided to the customers as Software as a Service. Real-time updates to the Shift View are pushed using WebSocket technology. The data ingestion side of the application is developed to support both Evocon devices and receiving data from other data sources via API. Examples of other data sources include OPC-UA, Modbus, text files, SQL databases, machine connection protocols etc.

The solution's security is enforced at multiple layers, including network segmentation, application firewalls, data encryption, and secure API gateways. Each layer incorporates best practices for protecting against common and merging threats.

Architecture diagram of the Evocon service.

Data ownership

The customer owns the production data collected from their production site. Evocon does not share the data with third parties. Access to data is provided only to the authenticated users and Evocon's support personnel when a support ticket is created.

Data compliance

Evocon is using Amazon AWS as its cloud provider. Data is stored in the EU region data centres. As an EU-based company, we are fully committed to GDPR compliance.

• We have implemented all necessary measures to ensure the protection of personal data, including comprehensive privacy notices, Data Processing Agreements (DPAs), and Joint Controller Agreements (JCAs) where applicable.
• Our data handling practices are regularly audited as part of our Information Security Management System (ISMS), which is certified under ISO 27001.

While we have primarily focused on GDPR compliance, our ISMS is designed to be adaptable and responsive to various privacy laws and regulatory requirements across different jurisdictions.

We are prepared to make any necessary operational changes and updates to our ISMS and other compliance practices as required by privacy laws of other regions, such as the California Consumer Privacy Act (CCPA), the ePrivacy Directive, and other regional or sector-specific regulations if required. Our existing processes provide a solid foundation, allowing us to swiftly implement additional measures to comply with local and international privacy laws, ensuring we consistently maintain the highest standards of data protection.

Evocon has been certified as ISO/IEC 27001:2022 compliant by BM Certification. The certificate itself may be found here.

Data that is being collected

Below is a non-definite list of data that Evocon application stores:

• Product information - name, SKU, cycle time, production unit and alternative unit.
• User information - name, email, IP address, user type and system language.
• Operator information (optional) - name or badge number, this is connected to production data.
• Stop, speed loss and reject reasons - name, type, categorization.
• Checklists (metrics related to production) - targets, intervals, tolerances, historical outcome and parameters of the checks.
• Factories and stations (machines, lines) - names, groups, OEE targets
• Shifts - working times and schedules.
• Evocon device data - raw 24V or 0-10V signal data (quantity & timestamp) coming from Evocon devices, MAC address of the device, IP address of the device.
• Additional optional metrics - historical time series data about electricity usage, temperature values, humidity values, etc.

Data transmission and storage

All data transmitted between Evocon servers and users is encrypted using Transportation Layer Security (TLS) and sent using HTTPS, the same system that banks and large well-known IT corporations use for moving sensitive data across the Internet. All sensor data transmitted from Evocon devices is also encrypted. Evocon servers support HTTPS connections that use TLS version 1.2 or 1.3 with industry-standard AES algorithm and 128-bit or 256-bit keys to ensure that the data can not be intercepted or tampered with during transit.

All relational databases where customer data is stored are encrypted using AWS-provided built-in encryption means. Encryption keys are securely managed and rotated using the AWS KMS key management service, which can be accessed only by authorized personnel.

All databases are backed up daily and are recoverable point-in-time at 5-minute intervals. Backups are also encrypted using an industry-standard encryption algorithm. All logs, backups, and snapshots of databases are encrypted as well and replicated to multiple availability zones. Database recovery drills and larger disaster recovery drills are conducted regularly to ensure that data can be restored and responsible people know how to restore it quickly in the event of a disaster. Backups are kept for 90 days, and older backups are automatically deleted.

Evocon devices do not send any identifiable data. A data packet consists of the Evocon device id, input number, data timestamp and quantity of signals from the sensor. Machine name, order information or anything similar is not collected or forwarded by the devices.

Evocon devices do not require any ports in a firewall to be opened towards them from the internet. Only HTTPS access from inside the customer network towards known FQDN-s is required for using Evocon devices. More information about the devices can be found below.

Hardware - Evocon IIoT device 3.0 - Technical specification and user manual

Authentication

Evocon supports username-and-password-based user accounts as well as SSO using SAML2, Entra or Okta protocols. Two-factor authentication (2FA) is also supported.

As per best practice, Evocon has not built its own customer identity and access management solution. We use Amazon Cognito, a secure, scalable and widely used product by Amazon.

User access rights are based on roles. More about roles and their rights can be read from the corresponding support documentation.

Evocon employees are required to use 2FA where possible. Email, AWS and other critical systems require all users to have 2FA enabled.

Cloud security infrastructure

AWS provides a shared responsibility model where AWS secures the underlying infrastructure, and Evocon is responsible for securing the applications and data we deploy in the cloud. To maintain a secure environment and meet compliance requirements, we utilize a combination of AWS security services, third-party tools, and best practices.

Identity and Access Management (IAM) policies govern the access to the cloud and enforce least privilege access. User accounts are required to rotate passwords and use 2FA.

We rely on AWS's built-in encryption services such as KMS to securely manage the keys and rotation of the keys.

AWS CloudFront, Web Application Firewall (AWS WAF) and AWS Shield are used to protect against various attacks. Shield makes it possible to isolate and mitigate Distributed Denial of Service (DDoS) attacks. AWS WAF is deployed to protect our web applications from common exploits and attacks, such as SQL injection and cross-site scripting (XSS).

GuardDuty is deployed to continuously monitor for malicious or unauthorized behavior in our AWS environment. It analyzes data from various sources, including AWS CloudTrail logs, VPC Flow Logs, and DNS logs, to identify potential security threats. The findings of GuardDuty are sent to the internal messaging platform in real time.

AWS Cloudwatch is used for logging Evocon applications and infrastructure events. Automated alerts are configured based on logs or metrics pushed from various parts of the application and infrastructure.

AWS Config tracks and records AWS resource configurations, providing us with the visibility to monitor compliance with internal policies and industry standards.

Connections between internal servers and databases are made in the context of IPSec protected virtual private networks. Server nodes are divided into security groups that restrict access by protocol, IP and port. Access to the servers inside the virtual private cloud is only available for Evocon admins over an encrypted connection and from a small set of restricted IP addresses.

To govern the security posture, a Business Continuity and Recovery Action Plan to react in case of incidents has been implemented and tested as part of the ISO27001 certification process.

Code quality and security

Our QA process is designed to ensure high-quality software through a testing strategy and effective defect management. We implement unit tests with a target of 90% coverage, alongside integration and end-to-end tests to validate overall system behavior. Code quality is tracked continously via development processes and code reviews.

Testing is integrated into our CI/CD pipeline, allowing for early detection. Defects are tracked using an issue management system that is linked to our customer support platform, ensuring escalation and resolution of customer-reported problems.

SLAs and support

Technical support is provided via the following channels:

• Self-Service: Customers can access our comprehensive Evocon Self-Service page for troubleshooting and common queries.
• Email Support: Direct support inquiries can be sent to support@evocon.com.

Email support answers to the incoming requests based on severity of the issue.

User support: 1st level user and technical support are done by the Client internally. If the issues cannot be resolved by the 1st level support, the issue is forwarded to Evocon support.

Severity 1 - 48 hours: defined through system unavailability, security issues and/or critical errors that restrict the usage or cause inability to access one or several main functionalities (data collection, inserting production information).

Severity 2 - 72 hours: defined as major problems that restrict using one or several functionalities in the system (issues with the Dashboard, Factory Overview, Reporting or Settings) but does not affect the data collection.

Severity 3 - 96 hours: defined as minor problems related to bugs or features that do not restrict using the software and have minimal impact on the user and no impact on productivity.

Support is available Monday through Friday, from 9 a.m. to 5 p.m. EET/EEST (Eastern European Time), UTC/GMT +2/+3. All support is provided in English, with additional languages available as supported and indicated on our website.

Recovery Point Objective (RPO)

Represents the maximum age of information that we must recover from backup storage for normal operations to resume after a disaster. RPO for Evocon is 5 minutes.

Recovery Time Objective (RTO)

It's the targeted duration of time within which our systems must be restored after a disaster to avoid unacceptable consequences. RTO for Evocon is 4 hours.

Service availability

System availability in a calendar month is 99.5%, excluding during scheduled maintenance windows (Saturday 9 pm UTC until Sunday 5 am UTC).

In case of a need for unscheduled maintenance (e.g. updating the system due to a Severity 1 issue) that will affect the usage of the Evocon software, Evocon will notify clients promptly after internally identifying the root cause and required action plan to resolve the issue. Evocon makes every reasonable effort to provide the client with the following details via written and agreed communication channels.

Current status and uptime can be seen at status.evocon.com.

Additional materials