Gremlin is committed to providing a secure environment for our users to embrace the practice of Chaos Engineering (check out our recently launched security page). It is, after all, one of our core principles: Simple, Safe, Secure. In practice, security is a continual journey of improvement and we wanted to share a few milestones since we last blogged.
We’ve recently completed auditing for the Service Organization Control (SOC) 2 Type I report. Compiled by Peterson & Sullivan. The report documents how Gremlin’s information security practices, policies, and procedures are suitable to meet the SOC 2 trust principles criteria for security, availability, processing integrity, and confidentiality.
The goal of the report is to verify the existence of internal controls designed and implemented to meet the requirements for the security principles set forth in the Trust Services Principles and Criteria for Security. It provides a thorough review of how Gremlin’s internal controls affect the security, availability, processing integrity, and confidentiality of the systems it uses to process users’ data, and the confidentiality and privacy of the information processed by these systems. This independent validation of security controls is crucial for customers in highly regulated industries.
We will be pursuing the SOC II, Type II report over the coming months to service some of our biggest enterprise users. As companies increase their usage of outside vendors to perform activities that are core to their business operations and strategy, there is a need for the highest level of trust and transparency into service providers’ operations, processes, and results.
On the product side, we've recently added support for signature based authentication, utilizing certificates for the Gremlin client. This provides greater flexibility for deploying Gremlin into ephemeral environments such as AWS Lambda, allows for simple integrations with enterprise certificate and key management systems, and also makes it easier to distribute new credentials. The traditional way of authenticating a Gremlin client (using a shared secret entered via command line or stored in the environment) will continue to be available -- this change simply adds another way to authenticate.
On the subject of data protection, we've always encrypted all communications with our service using TLS 1.1 and 1.2, and we've always encrypted sensitive data we store using AES-256 (or in the case of passwords a randomly seeded SHA2 hash). Recently, however, we’ve updated our internal systems to encrypt all data that our service stores, regardless of the sensitivity level. We want to ensure our customers that Gremlin provides their data with the same level of protection or better than they would treat it themselves. You can rest easy knowing that we are treating even the most mundane details as if they were your most privileged information!
In addition to pursuing the SOC 2 Type II report over the coming months, we will be wrapping up another external audit and penetration testing round performed by our security partners at Bishop Fox. We really like having these external audits performed; they help confirm that what we're doing is effective, and we always learn about novel new attacks and ways to harden our systems against them. We look forward to sharing the final assessment results with our customers!
And last but not least, we're starting to improve service permissions that will include the addition of several new roles. This change will facilitate better segregation of duties among users, as well as better visibility into what privileges each user possesses. Customers can expect to see these changes reflected in the product by early 2019.