TimeTec pays serious attention to security issues, and investigates all reported vulnerabilities. This page explains TimeTec’s practice for addressing potential vulnerabilities in aspects of our cloud services.
ISO 27001
ISO 27001 is a security management standard that specifies security management best practices and comprehensive security controls following the ISO 27002 best practice guidance. The basis of this certification is the development and implementation of a rigorous security program, which includes the development and implementation of an Information Security Management System (ISMS) which defines how TimeTec perpetually manages security in a holistic, comprehensive manner. This widely-recognized international security standard specifies entities:
| • |
Systematically evaluate our information security risks, taking into account the impact of company threats and vulnerabilities. |
| |
|
| • |
Design and implement a comprehensive suite of information security controls and other forms of risk management to address company and architecture security risks. |
| |
|
| • |
Adopt an overarching management process to ensure that the information security controls meet our information security needs on an ongoing basis. |
The Company has successfully obtained the ISO/IEC Information Security Management System (ISMS) on 8th March 2018.
Using 2-Factor Authentication (2FA) in TimeTec
For increased security, we recommend that you configure 2-factor authentication (2FA) to help protect your TimeTec accounts. 2FA adds extra security because it requires users to enter a unique authentication code from an approved authentication device. Striving to provide our users peace of mind, we work with renowned third party provider - Google Authenticator to enhance the security level of your TimeTec account. This 2-factor authentication feature definitely improves security because signing in will require 2 things - a code generated by the Google Authenticator mobile app in addition to your account password.
HTTPS:
All communication in and out of our TimeTec cloud platform is done through https. "Hypertext Transfer Protocol Secure (HTTPS) is a communications protocol for secure communication over a computer network, with especially wide deployment on the Internet."
Amazon AWS:
In an effort to ensure all your data is kept secure we are using one of the best names in server and cloud computing, Amazon AWS PaaS, "Platform as a Service". Technically speaking, we secure our data with the following security services.
TimeTec utilizes AWS Services that are ISO 27001 and PCI DSS L1 Certified:
• Amazon Web Services Elastic Compute Cloud (EC2)
• Amazon Web Services Simple Storage Service (S3)
• Amazon Web Services Relational Database Service (RDS)
• Amazon Web Services Elastic Load Balancing (ELB)
• Amazon Web Services Identity and Access Management (IAM)
• Amazon Web Services Elastic Block Storage (EBS)
• Amazon Web Services Simple email service（SES）
• Amazon Web Services CloudFront
• Amazon Web Services Route 53
• Amazon Web Services CloudWatch + Amazon Simple Notification Service（SNS）
• Amazon Web Services VPC
• Amazon Web Services Shield Standard to defend against DDoS attacks
Vulnerability Reporting
Reporting Suspected Vulnerabilities
If you suspect that TimeTec resources are being used for suspicious activity, you can report it to us here.
So that we can effectively respond to your report, please provide any supporting material that would be useful in helping us understand the nature and severity of the vulnerability.
All information that you share with TimeTec as in this process is kept confidential within TimeTec team and will not be shared with third parties without obtaining your permission.
TimeTec will review the submitted report, we will then respond to you, acknowledging receipt of the report, and outline the next steps in the process.
Evaluation By TimeTec
TimeTec will work to validate the reported vulnerability, once the report is received. If additional information is required to validate or simulate the issue, TimeTec will work with you to obtain it. When the initial investigation is complete, results will be delivered to you along with a plan for resolution and public disclosure.
| Things to Note about TimeTec Evaluation Process: |
| 1. |
Third-Party Products - If the vulnerability is found to affect a third party product, TimeTec will notify the party involved. We will continue to coordinate between you and the third party; your identity will not be disclosed to the third party without your permission. |
| |
|
| 2. |
Confirmation of Non-Vulnerabilities - If the issue cannot be validated, or is not found to be a flaw in TimeTec product, we will share the information with you. |
| |
|
| |
TimeTec wants to keep you informed of our progress as we investigate and / or mitigate your reported security concern. You will receive a non-automated response to your initial contact within 24 hours, confirming receipt of your reported vulnerability. You will receive progress updates from us at least every five working days. |
Public Notification
If applicable, TimeTec will coordinate public notification of a validated vulnerability with you. We would prefer that our respective public disclosures be posted simultaneously.
In order to protect our customers, TimeTec requests your cooperation to not post or share any information about a potential vulnerability in any public setting until we have researched, responded to, and addressed the reported vulnerability and informed customers if needed.
We also respectfully ask from you to refrain from posting or sharing any data belonging to our customers. Addressing a valid reported vulnerability is a rather long process and it will vary based on the severity of the vulnerability and the affected systems.
