Cyber Security Tecnologies
Group Information Security reports to the Group COO and then to the General Manager.
The doValue Group has adopted a set of tools and technologies on the protection of personal data held by the Group, both as Processor and as Controller of the same:
- Firewalls: configured to filter inbound and outbound traffic. FWs are also equipped with other security capabilities such as IDS/IPS, url filtering or SSL inspection;
- Endpoint and server antivirus: based on signs and behavior analysis to detect and block possible threats;
- Information classification tool: allows users to classify the information based on its confidentiality;
- Data loss prevention tool: applies restrictions to the information, based on its confidentiality. For example, encrypting sensitive information or forbidding sharing internal information outside the company;
- Data base encryption tool: to encrypt sensitive information;
- Data discovery & data masking tool: allows to discover personal data stored in the applications of the company and masks these personal information on previous environments;
- Cookies management tool;
- MFA tools: enhances the applications’ authentication mechanisms. In addition to the typical user and password authentication, MFAs tools applies another authentication layer (usually an OTP token);
- Privilege Access Management tools: manages centrally privilege users and monitor their activities in order to detect abnormal behaviors that may lead to a data breach;
- Security Information Event Management tool: collects logs from different sources and applies different algorithms in order to detect abnormal behaviors that may lead to a data breach;
- Vulnerability scanners: scans the company’s applications and infrastructure in order to detect vulnerabilities. Classifies the vulnerabilities according to its criticality, based on CVSS standard;
- Web proxy: filters the users navigation, blocking malicious websites or sites that may damage the company;
- Network Access control tool: allows to implement access control policies on the company’s network to protect it from different threats;
- Email protection tool: analyses incoming and outcoming emails in order to block spam and malicious emails (such as phishing);
- Web application firewall capabilities: filters and monitors HTTP traffic to protect web applications;
- Training and awareness activities: such as attack simulations in order to raise awareness on the company’s users about how to detect and how to act in case of detecting an attack or possible threat;
- Secure Software Development activities: definition of security requirements for new developments to ensure the company’s applications have the security measures needed in order to correctly protect the information treated or stored in them;
- Information Security tests: execution of security tests, such as penetration tests, ethical hacking or source code audits to detect vulnerabilities or threats that may compromise the information treated or stored within the company’s applications;
- Definition of Information Security policies and controls: to ensure the company’s processes and activities are aligned with the security best practices (such as ISO27001) to protect the Client’s/ employees’ data.
