Secure Communication and Collaboration

Security is the backbone of all of NC4's secure communication and collaboration solutions. Raising the security bar to the highest level, NC4 has a highly secure operating environment that is built to rigorous U.S. Government standards for a Sensitive Compartment Information Facility (SCIF). NC4 solutions support diverse authentication methods, including identity federation, Two-factor and Public Key Infrastructure (PKI) through strict registration protocols, authorized management, a human revalidation processes, and solution activity monitoring and reporting. Moreover, NC4 maintains a full-cycle security approach to ensure security from the inside out and outside in.  This includes:

• Physical Security

To ensure the security and integrity of its systems, NC4’s cloud computing environment implements formidable physical security controls. Even the most highly sophisticated software, encryption, and authentication will not provide the full cycle of security if the system itself is not physically secure.

• SCIF Level Facilities: Data processing operations are conducted in Secure Operating Centers (SOCs) that meet or exceed the standards for U.S. Government Sensitive Compartmentalized Information Facilities (SCIF). These strict standards include perimeter protection, auditing, access control and intrusion alarms.
  
  
• Top Security Professionals: NC4 employs leading security experts as well as technical experts to assure the most disciplined security procedures.
  
  
• Secure Administrative Procedures: NC4 adheres to stringent administrative security procedures that meet or exceed Government requirements for sensitive data. These security procedures include documented policy, policy reviews, auditing and compliance oversight and reporting.
  
  
• Cleared Staff: All NC4 staff with access to customer systems maintain U.S. Government Security clearances. Employees receive ongoing security education and training.


• User/Administrator Awareness and Training: Often the most overlooked and important component of information security is training users. NC4's user base is trained to understand the solution environment, thereby ensuring compliance with current security policies.
  

Top of page

• User Security
  

A system is only as good as its weakest link. Therefore, all NC4 technology decisions focus on User Control to create a customizable, single sign-on interface for each client. Every solution incorporates a minimum of 128 bit-encrypted access to the applications (up to 256 bit-encryption). All the best authentication methods are supported, augmented by registration protocols, audited authorization management, human revalidation processes, activity monitoring, and reporting. NC4 solutions include the most advanced authentication techniques and are consistent with current government homeland security regulations. 

• PKI, RSA SecurID, Anakam (Equifax) “soft token” options − the option of integrating web-based biometric authentication can be provided as part of the customization process to meet the client's security requirements.
  
  
• Hard enforcement of lockouts − after a specified number of failed logins, the user is locked out of the system to prevent a brute force attack. The unsuccessful user is not notified that their account is locked so as not to alert a potential intruder that they are being monitored. NC4's Support Center receives notification when a user is locked out of the system and appropriate action is taken, whether assisting the user in getting into the system or notifying a security administrator that unauthorized login is being attempted.
  
  
• Enforced strong passwords − the systems can enforce strong passwords that meet or exceed U.S. Government standards. Password requirements are customized in accordance with the client's needs.
  
  
• Human in the loop − the Support Center is available to assist users with logon problems, system questions and username/password resets. Users must verify the security information they supplied during registration in order to have their account credentials reset. The Support Center does not send out authentication information via email or other non-secure channels that may be intercepted by an unwanted third party.

Top of page

• Hardened System Architecture
  

The proprietary hardened systems architecture is proactively managed on a 24x7 basis. NC4's cloud computing environment utilizes advanced systems architecture designed to defeat the most sophisticated intrusion techniques. These designs were developed utilizing the U.S. Government's Computer Emergency Response Team's (CERT) extensive database of successful intrusions on supposedly secure systems. CERT is located at the Carnegie Mellon's Software Engineering Institute and is one of the front line resources in managing data security. The NC4 cloud computing architecture includes:

• Multiple, in-line firewalls are enabled to accept only one protocol in (HTTPS) through only one open port. Each firewall uses a different technology such as packet filtering, proxy, stateful inspection, etc. Furthermore, each firewall is provided through a different manufacturer to defeat attacks that exploit known weakness by any one vendor.
  
  
• Code Demobilization constantly monitors the stream of data entering the system for any type of mobile code. The system isolates and prevents this code from taking any action. While tight control over this type of code blocks some non-essential functionality such as simple JavaScript, it greatly enhances system security. Comprehensive virus scanning is also used on file uploads to the web portal.
  
  
• Strong Encryption and Certification generate the strongest possible encryption, requiring an exponentially higher level of resource to crack. It is currently beyond the capability of any threat. Additionally, the crypto systems are easily upgradeable; so, as encryption attacks become a greater threat, it is a simple matter to increase the key length to thwart these attempts.
  
  
• State Theft Protection a common attack in any system is the attempt of a user to change the level of permissions within the system, thereby gaining access to data or resources not normally provided. NC4's cloud computing application and state management strategy prevent users from changing the level of permissions they have within the system. In addition, on each user request, information is compared to the last known state of the user to determine if this is the same person, or someone in a different location trying to impersonate them. The system audits anomalies and reports them to administrators for action.
  
  
• Proactive Monitoring utilizes multiple intrusion detection systems (IDS), front and back end monitoring, code integrity scanning, log file analysis, network status monitoring and application monitoring for the detection and tracing of suspicious probes back to their source.
  
  
• Information Protection uses compartmentalization to separate workspaces and enforce need-to-know controls to further protect access to information inside an established workspace.
  

Top of page