Information Security at Litmus

Effective from: April 26, 2022

Overview

Litmus Software, Inc. (“Litmus”) has established this Litmus Information Security Policy (the “Policy”) to provide management direction in accordance with business requirements and relevant laws and regulations. This Policy sets forth governance to protect the confidentiality, integrity and availability of information and information processing facilities of Litmus, and its customers and partners.

1. Scope

This Policy applies to all Litmus employees, contractors, consultants, agents, and affiliates (collectively referred to as “Litmus Personnel”).

2. Purpose

The purpose of this Policy is to protect information and information processing facilities of Litmus from unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction.

3. Organization of the Policy Document

This policy is comprised of the following components:

  • Information Steering Committee and other key stakeholders with defined roles and responsibilities.
  • A set of sub-policies specified in this document.

A description of the sub-policies follows

4. Acceptable Use Policy

The purpose of this sub-policy is to provide Litmus Personnel with guidelines regarding what is considered acceptable and unacceptable use of the assets and processes of Litmus.

4.1. Ownership and General Use

All proprietary information of Litmus (including without limitation information of its customers, vendors and licensors) stored in any form or format—including on electronic and computing devices, whether owned or leased by Litmus—that is accessed and/or used by Litmus Personnel is (as between Litmus and Litmus Personnel) the sole property of Litmus.

All internet/intranet/extranet-related systems—including but not limited to computer equipment, software, operating systems, storage media, and network accounts that provide electronic mail, internet browsing, and FTP—are the property of Litmus. These systems are to be used for business purposes in serving the interests of Litmus and our customers.

Litmus may monitor equipment, systems and network traffic for performance, security and network maintenance purposes.

Litmus Personnel must:

  1. Comply with this Policy, including without limitation Asset Management Policy and Access Management Standard for Mobile and Remote Computing, whenever connecting mobile and/or computing devices to any Litmus system.
  2. Secure all mobile devices with a password-protected (or similar functionality) screen-lock.
  3. Ensure that all system-level and user-level passwords comply with the Password Protection Policy.
  4. Secure all computing devices with a password-protected screensaver with the automatic activation feature set to 5 minutes or less.
  5. Lock the screen or log off when the device is unattended.
  6. Use extreme caution when opening email attachments received from unknown senders, which may contain malware.
  7. Follow all laws pertaining to the handling and disclosure of copyrighted or export controlled materials.
  8. Exercise good judgment while using any equipment, systems or networks of Litmus for occasional personal use (e.g., to check personal email); Litmus personnel is advised to consult with their supervisor if there is any uncertainty.
  9. Promptly report the theft or loss of, or unauthorized access to, any equipment, system or network of Litmus.
  10. NOT provide information about, or lists of, Litmus personnel to parties outside Litmus.
  11. NOT provide information about, or lists of, Litmus customers to parties outside of Litmus unless expressly authorized by senior management of Litmus.
  12. NOT make fraudulent offers of products, items, or services originating from any Litmus account.
  13. NOT make statements about warranty, expressly or implied, unless it is a part of normal job responsibilities. Individual’s manager should be consulted prior to making any statement that is in question.
  14. NOT engage in any activity that is illegal under applicable law while utilizing Litmus-owned resources.
  15. NOT violate the rights of any person or entity protected by copyright, trade secret, patent, or other intellectual property right, or similar laws or regulations, including but not limited to installing or distributing “pirated” or other software products that are not appropriately licensed for use by Litmus.
  16. NOT violate the privacy rights of any person protected by applicable laws or regulations.
  17. NOT copy any copyrighted material, such as digitizing and distributing photographs from magazines, books, or other copyrighted sources, copyrighted music, or installing any copyrighted software for which Litmus or the end user does not have an active license.
  18. NOT export software, technical information, encryption software or technology in violation of applicable export control laws. Senior management or the individual’s manager should be consulted prior to exporting any material that is in question.

4.2. Security of Proprietary Information

Litmus Personnel must:

  1. Access, use or share Litmus proprietary information only to the extent authorized and necessary to fulfill their assigned job responsibilities.
  2. Ensure that proprietary information is protected in accordance with all relevant laws and regulations.
  3. Promptly report the theft, loss or unauthorized disclosure of Litmus proprietary information.

4.3. Unacceptable Use of Litmus Assets

Unless the following activities are a part of the normal job responsibilities of the Litmus Personnel or a prior approval is obtained from a member of the Information Security Steering Committee, Litmus Personnel must:

System and Network Activities
  1. NOT disable network access or disrupting production services.
  2. NOT access Litmus data, server or accounts for any purpose other than conducting Litmus business.
  3. NOT inject malicious programs into a network or server, such as viruses, worms, Trojan horses or email bombs.
  4. NOT reveal personal account password to others or allowing use of individual account by others.
  5. NOT use a Litmus computing asset to actively procure or transmit material that are in violation of applicable law, including without limitation sexual harassment or hostile workplace laws in the local jurisdiction of the user.
  6. NOT cause or contribute to any security incident [2] or disrupt [3] network communication.
  7. NOT scan ports or Litmus networks.
  8. NOT circumvent user authentication or security of any host, network or account.
  9. NOT introduce honeypots, honeynets or similar technology on the Litmus network host.
Email and Communication Activities.

Please refer to Electronic Mail (Email) Policy for details.

Blogging and Social Media

Blogging and social media (e.g., Facebook, Twitter, Instagram, etc.) by Litmus personnel, whether using the property and systems of Litmus or personal property and systems, is also subject to the terms and restrictions set forth in this Policy. Limited and occasional use of the property and systems of Litmus to engage in social media is permissible, if it is done in a professional and responsible manner, does not otherwise violate the policies of Litmus, is not detrimental to the best interests, image, goodwill or reputation of Litmus, and does not interfere with the individual’s regular work duties. Social media postings made using the property or systems of Litmus are subject to monitoring.

Litmus personnel must:

  1. NOT reveal any confidential or proprietary information of Litmus when blogging or posting on social media.
  2. NOT engage in any social media activities that may harm or tarnish the image, reputation and/or goodwill of Litmus and/or any Litmus Personnel.
  3. NOT make any discriminatory, disparaging, defamatory or harassing comments when posting on social media or otherwise engaging in any conduct prohibited by Litmus policies, including the Non-Discrimination and Anti-Harassment policy.
  4. NOT attribute personal statements, opinions or beliefs to Litmus when engaged in social media. If any Litmus Personnel desires to express their beliefs and/or opinions, that individual may not, expressly or implicitly, represent that they are an employee or representative of Litmus. Litmus Personnel are solely responsible for any and all risk associated with their social media activities.
  5. NOT use the name, trademarks, logos or any other intellectual property of Litmus in the social media posts.

4.4. Off-site Removal of Information Systems, Computers and Network Devices

Information systems, computers and network devices must not be removed from Litmus offices unless prior written approval is obtained from the IT department.

In the case where Litmus Personnel are permitted to work remotely, the following controls apply:

  1. Equipment and media taken off-site must not be left unattended in public places or left in sight in a vehicle.
  2. Information should be protected against loss or compromise when working remotely.
  3. Care should be taken with the use of mobile devices such as laptops, mobile phones, smartphones and tablets.
  4. All devices must be password protected and disk encryption must be in-effect.
  5. Approved VPN software must be used while on any public network.
  6. Anti-virus/malware software must be installed, running and up to date.

5. Clean Desk and Clear Screen Policy

This sub-policy is a part of standard basic privacy controls. The purpose of this sub-policy is to ensure that all sensitive/proprietary materials are safeguarded by establishing the minimum requirements for maintaining a “clean desk and clear screen.”

5.1. Policy Components

When Litmus Personnel use shared space, they must:

  1. Ensure that all sensitive/proprietary information in hardcopy or electronic form is secure in their work area when they are expected to be away from their work area for an extended period of time and at the end of the work day.
  2. Lock their workstations or laptops when their workspace is unoccupied.
  3. Remove from their work area or securely store any restricted or sensitive information when their work area is unoccupied and at the end of the work day.
  4. Close and/or lock the file cabinets containing confidential or secret information.
  5. NOT leave the keys used to access confidential or secret information at an unattended desk.
  6. Promptly remove printouts containing confidential or secret information from shared printers and use secure print functionality where available.
  7. Shred confidential or secret documents using official shredder bins or deposit documents in official locked confidential disposal bins.
  8. Erase whiteboards containing confidential or secret information.
  9. Lock away portable computing devices, such as laptops and tablets.
  10. Treat mass storage devices, such as CDROM, DVD or USB drives, as sensitive and secure them in a locked drawer.

6. Application Security Policy

Web application vulnerabilities account for the largest portion of attack vectors outside of malware. It is crucial that the Litmus web-based application be assessed for vulnerabilities, and that these vulnerabilities be remediated prior to deploying the application in a production environment.

A brief description of the procedure Litmus uses to secure its applications follows.

6.1. Application-layer Testing

Applications are tested via the following methodologies based on the ISO 9001 standards:

  1. Code Reviews – Source code is reviewed for good coding principles and best practices before every release.
  2. Static and Dynamic Analysis – An approved 3rd party security tool conducts static and dynamic analysis of the source code and binary code continuously for the application. Findings are prioritized and remediated.
  3. Opensource Code Analysis – All opensource code used is analyzed for emerging CVEs (Common Vulnerability Enumerations) and CWEs (Common Weakness Enumerations).

6.2. Application-layer Assessment Process

The following guidance shall be adhered to when assessing the security of the Litmus web-based applications:

  1. New or Major Application Releases are subjected to a full assessment prior to approval of the change control documentation and/or release into the live environment.
  2. Point Releases are subjected to an appropriate assessment level based on the risk of the changes in the application functionality and/or architecture.
  3. Patch Releases are subjected to an appropriate assessment level based on the risk of the changes to the application functionality and/or architecture.
  4. Emergency Releases are allowed to forgo security assessments and carry the assumed risk until such time that a proper assessment can be carried out. Emergency releases are designated by the appropriate manager who has been delegated this authority.
  5. Third Party or Acquired Web Applications are subjected to full assessment after which it will be bound to policy requirements.

6.3. Risk Assessment Categories

All security issues that are discovered during assessments must be mitigated based upon the following risk levels. The risk levels are based on the OWASP Risk Rating Methodology [4]. Remediation validation testing will be required to validate fix and/or mitigation strategies for any discovered issues of medium [5] risk level or greater.

  1. High –Any high-risk issues are fixed immediately, or other mitigation strategies are put in place to limit exposure before deployment. Applications with high-risk issues are subject to being taken off-line or denied release into a live environment.
  2. Medium – Medium-risk issues are reviewed to determine what is required to mitigate and scheduled accordingly. Applications with medium-risk issues may be taken off-line or denied release into a live environment based on the number of issues and if multiple issues increase the risk to an unacceptable level. Issues are fixed in a patch/point release unless other mitigation strategies limit exposure.
  3. Low – Low-risk issues are reviewed to determine what is required to correct the issue and scheduled accordingly.

6.4. Risk Assessment Levels

The following security assessment levels are established by the Information Security organization (or such other designated organization that performs the assessment):

  1. Full – A full assessment is comprised of tests for all known web-application vulnerabilities using both automated and manual tools based on the OWASP Testing Guide. A full assessment will use manual penetration testing techniques to validate and determine the overall risk of any and all discovered vulnerabilities.
  2. Quick – A quick assessment consists of a (typically) automated scan of an application for the OWASP Top Ten web-application security risks at a minimum.
  3. Targeted – A targeted assessment is performed to verify vulnerability remediation changes or new application functionality.

6.5. Risk Assessment Tools

Litmus utilizes a combination of tools to assess risk. This includes tools specific to assessing risk in cloud infrastructure and relevant technical platforms

Other tools and/or techniques may be used depending upon what is found during the default assessment. The validity and risk are subject to the discretion of the Security and Engineering teams.

For an up-to-date list of web-application security assessment tools please contact the Litmus Security team.

7. Asset Management Policy

The purpose of this sub-policy is to maintain accurate records of the physical computer assets of Litmus. This sub-policy establishes procedures to ensure compliance with industry standards and to ensure accurate reporting of physical assets.

7.1. Asset Management

All IT assets purchased are recorded and maintained on a fixed asset register by the Litmus IT Department. To manage the register accurately and efficiently, all Litmus Personnel shall adhere to the following requirements. Litmus Personnel must:

  1. NOT remove IT assets—including without limitation laptop or tablet computers, personal digital assistants (PDAs) or smartphones—supplied by Litmus from company premises, except when the Litmus Personnel are teleworking or working outside the office on a Litmus assignment.
  2. Safeguard any IT assets they remove from the premises of Litmus, including keeping all assets under their direct physical control whenever possible, and physically securing the assets when they are not under the individual’s direct physical control.
  3. Immediately report the loss or theft of any assigned IT assets to the IT Department.
  4. NOT bring their own IT assets into work locations to connect to Litmus network or access Litmus data.

7.2. Media Handling

7.2.1. Management of Removable Media

Litmus Personnel do not have a need to use removable media, in general. They are permitted to take their laptops to remote locations for teleworking purposes. These laptops must be managed by the Litmus IT Department. That is, they must have end- point controls in effect. See Endpoint Protection Policy for additional details.

7.2.2. Disposal of Media

Disposal of IT assets, including the sale, transfer, donation, write off or sustainable disposal (recycling), must be done in adherence with all applicable laws and contractual obligations of Litmus. Computer hardware must have all software and information securely removed prior to disposal. Sensitive data must be deleted using secure methods as soon as such data is no longer required. Secure methods of removal mean the use of software that can be configured to overwrite the data at least three times and/or physical destruction of the hard drives to the extent it precludes any possible restoration of the data. The Litmus IT Department owns this responsibility.

7.2.3. Physical Media Transfer

Litmus Personnel do not use physical media. All transfers take place via cloud services or in an automated manner.

8. Change Management Policy

The primary goal of this sub-policy is to establish a process to deliver changes in an efficient and timely manner while minimizing risk. To enable our business to function smoothly, changes fall into one of the three change processes.

Some changes fall under a category of well-known repeated changes that require a prior pre-approval. These changes are implemented as needed and are tracked through standard issue tracking tools but are not in scope for the change management process.

The remaining bulk of our changes are managed through continuous integration or continuous delivery tools. These are tracked through an automated process that generally follows this pattern:

  1. Change Implementation – These changes are in code, either through an automation tool like Chef or Terraform or to actual software application code (such as services, APIs and front-end interfaces). These changes are always made to a branch and pushing to master directly is prohibited.
  2. Pull-Request – A pull-request (“PR”) is then opened, requesting permissions to merge to them master branch and deploy the change.
  3. Unit Testing – When a PR is opened, the software is run through an initial set of automated tests, as applicable.
  4. Code Review – All PR’s must be reviewed and approved by at least one other member of the team familiar with the code in question.
  5. Integration Tests – When the PR is approved, a full build is run and remaining tests are run, as applicable.
  6. Deployment – If the build and tests pass, the build is either queued for manual deployment or automatically deployed to production, depending on the service and the team.

A deployment typically incorporates a staging environment at some point in the process, but the implementation may vary.

Lastly, there are high-risk or heavily manual changes. These changes go through the following approval process:

    1. Change Request– Changes are filed through a specific template that requires (as a minimum) documentation of:
  1. When the change will happen
  2. What the justification for the change is
  3. What risks are present in the proposed change and what mitigating steps have been taken to address those risks
  4. A detailed description of the change itself and how it will be tested for success or failure afterward
  5. A detailed description of what steps to take to roll back the change (if possible) should anything go wrong
  1. Technical Review – All changes are then reviewed by another team member familiar with the affected systems.
  2. Stakeholder Review – Changes that affect customers are socialized with key stakeholders, along with the change window, to balance risk and customer impact with the justification for the change itself.
  3. Change Announcement – For changes that impact customers, the finalized window is announced to our partners and posted on status.litmus.com in advance of the change in accordance with our established partner agreement requirements.
  4. Change Implementation – The change is implemented according to the documented plan. Any unforeseen deviations from that plan are documented, and rollback steps are updated as needed. Any planned tests are run to verify the change is successful with no unanticipated side effects.
  5. Post-Change Review – After the change is complete, it is left open for a minimum of 24 hours.

Any outages caused by a change are noted, as well as whether the change failed, was rolled back or was successful. This data is leveraged to establish metrics for operational safety and performance.

9. Compliance and Security Audit Policy

The purpose of this sub-policy is to advise users of security scanning procedures and precautions used by Litmus to audit its network and systems. Other persons or entities, unless authorized, are prohibited from performing any such audits.

Audits may be conducted to:

  1. Ensure integrity, confidentiality and availability of information and resources.
  2. Investigate possible security incidents to ensure conformance to Litmus Information Security policies.
  3. Monitor user or system activity where appropriate.

Litmus will utilize auditing software to perform electronic scans of its networks, servers, switches/routers, firewalls, and/or any other systems used at Litmus. This audit also includes scans of any electronic communication and emails, regardless of the sender or recipient of the communications.

These audits may include:

  1. User and/or system-level access to any computing or communications device.
  2. Access to information that may be produced, transmitted or stored on Litmus equipment or premises.
  3. Access to work areas (such as offices, workstations, and storage areas).
  4. Access to interactively monitor and log traffic on Litmus networks.
  5. Penetration testing.
  6. Password Auditing.
  7. Scanning for personally identifiable information, including personal data.

Scheduled third-party audits of Litmus infrastructure, code and processes are conducted to maintain the highest level of confidentiality, integrity and availability of systems and data of Litmus and its customers and partners.

10. Disaster Recovery Policy

Litmus maintains Disaster Recovery plans that are regularly reviewed, tested, and updated. The purpose of this sub-policy is to establish the processes and procedures that will be followed to ensure the overall continuation of Litmus business operations during an outage event.

Hosting services on AWS gives Litmus the ability to remain resilient globally even if one location goes down. Litmus is a high availability platform built to scale and meet the demands of our customers. Litmus maintains a list of critical service providers and monitors those providers for performance and availability. In the event of an outage Litmus will work with critical services providers to restore or migrate services as quickly as possible.

The Information Security organization has the responsibility for establishing the incident response team that will be notified and activated in case of severe or high priority rated incidents. The Disaster Recovery team is composed of resources from many internal organizations including but not limited to: Information Security, Disaster Management, Technology, Finance, and Executive Management. Other teams may be brought in on a per incident basis as needed and appropriate.

Regardless of the category that the disaster falls into, Litmus handling of a disaster is broken down into the following steps:

  1. Disaster identification and declaration
  2. Disaster Recovery Plan activation
  3. Communicating the disaster
  4. Assessment of current, and prevention of further, damage
  5. Recover IT & Product operations
  6. Repair and rebuilding of primary facility (if necessary)

11. Electronic Mail (Email) Policy

Email is pervasively used in almost all industry verticals and is often the primary communication and awareness method within an organization. At the same time, misuse of email may pose many legal, privacy and security risks.

The purpose of this sub-policy is to provide governance on what Litmus considers acceptable or unacceptable use, best practices and compliance or non-compliance with this policy.

Therefore, it is important for Litmus personnel to understand the appropriate use of electronic communications and be aware of the following guidelines:

  1. All use of email must be consistent with Litmus policies and procedures, including those related to ethical conduct, safety and compliance with applicable laws and proper business practices.
  2. Litmus email accounts should be used primarily for Litmus business-related purposes; personal communication is permitted on a limited basis, but non-Litmus related commercial uses is prohibited.
  3. All Litmus data contained within an email message or an attachment must be secured according to applicable laws.
  4. Email that is identified as a Litmus business record shall be retained according to Litmus Record Retention Schedule.
  5. The Litmus email system shall not to be used for the creation or distribution of any disruptive or offensive messages, including without limitation: offensive comments about race, gender, physical appearance, disabilities, age, sexual orientation, pornography, religious beliefs and practice, political beliefs, or national origin. Litmus Personnel who receive any emails from other Litmus Personnel that contains any content that may be in violation of this policy should report the matter to their supervisor immediately.
  6. Users are prohibited from automatically forwarding Litmus email to a third-party email system. Individual messages that are forwarded by a user must not contain proprietary information of Litmus, including any sensitive information.
  7. Users are prohibited from using non-standard third-party email systems and storage servers to conduct Litmus business, to create or memorialize any binding transactions, or to store or retain email on behalf of Litmus. Such communications and transactions should be conducted through proper channels using Litmus- approved systems.
  8. Using a reasonable amount of Litmus resources for personal emails is acceptable, but non-work-related email shall be saved in a separate folder from work-related email. Sending chain letters, joke emails, Ponzi or other pyramid schemes from a Litmus email account is prohibited.
  9. Personal emails must not be used for forwarding Litmus’ customer related information.
  10. Litmus Personnel shall have no expectation of privacy in anything they store, send or receive via the Litmus email system.

Litmus may monitor messages without prior notice.

12. Endpoint Protection Policy

This section refers to the hardening, patching and protection of endpoints used by Litmus Personnel. Litmus utilizes several layers of protection for endpoints. Litmus enforces:

  1. AES 128-bit disk-level encryption on laptops/workstations.
  2. Anti-malware/virus scanning.
  3. Two-factor authentication for access to any Litmus applications when not on the Litmus network.

See the Litmus Asset Management Policy and Operations Controls – Malware Protection Policy for additional details.

13. Network Security Policy

Remote access to the Litmus network is essential to maintain business productivity. It is, however, likely that the remote access originates from networks that may already be compromised or are at a significantly lower security posture than the corporate network of Litmus.

Therefore, this sub-policy is established for the purpose of instituting the requirements that Litmus Personnel must follow when connecting with the Litmus network, in addition to abiding by the best practices specified in the Acceptable Use Policy. Litmus Personnel must:

  1. Use Virtual Private Networks (VPNs) and strong passphrases to connect with the Litmus (corporate) network.
  2. Secure their personal network (e.g., WIFI) with strong encryption and passphrase protection.
  3. NOT bridge the Litmus network with any personal networks (such as Hotspots).
  4. Get prior written approval for use of any external resources to conduct Litmus business from the Information Security Lead and appropriate business unit manager.
  5. Ensure that all hosts that are connected to Litmus internal networks via remote access technologies have the most up-to-date anti-virus software.

14. Password Protection Policy

This sub-policy provides technical guidelines to promote the secure implementation of the password management lifecycle, and to enable multi-factor authentication for Litmus IT services.

The guidelines follow. Litmus Personnel, especially and including the system administrators must:

14.1. Password Creation

  1. NOT use the same password for Litmus accounts for access to other non-Litmus accounts (example: personal ISP account, option trading, benefits, etc.). Use tools such as 1Password to facilitate maintenance of different passwords.
  2. Use a password [6] that is a combination of upper and lower case letters, and numeric and punctuation characters and have a minimum length of 12 characters.

14.2. Password Change

  1. Change all passwords on a quarterly basis, and follow the reminders sent by the Information Security Department.
  2. NOT re-use the previously used four passwords.

14.3. Password Protection

  1. Treat passwords as sensitive Litmus information. Therefore, Litmus Personnel must not share their passwords with anyone, including but not limited to administrative assistants, managers, co-workers or family members.
  2. NOT re-use the previously used four passwords.

15. Physical Security Policy

This sub-policy is established to limit access to physical environments with a purpose to protect information and information processing facilities from unauthorized physical access, electronic penetration through electronic emissions and environmental hazards. In case of any conflict between this policy and applicable law, applicable law shall prevail.

15.1. Secure Areas

A brief description of how Litmus ensures that physical security is in-effect follows.

15.1.1. Physical Security Perimeter

The building owners that host Litmus offices share the responsibility of providing physical security. They protect the reception, delivery and loading areas, and physically secure the perimeters. For the Cambridge. MA office of Litmus, there is also a guard posted at the entrance 24 hours a day, 7 days a week, and all visitor entries are logged by building reception. Litmus further adds another layer of physical protection by using electronic card access and video-monitoring at the entrances of the office.

For the San Mateo, CA office of Litmus, access is restricted by electronic card access or unique keycode, and all visitor entries are logged by Litmus personnel.

Remote workers share responsibility in protecting information and information processing facilities in their respective remote locations.

The data center owners provide and own the responsibility of securing the centers.

15.1.2. Physical Entry Controls

The electronic cards are assigned to only Litmus Personnel. A Litmus employee must always accompany all visitors, including the contractors and construction workers, while they are in the offices of Litmus.

15.1.3. Securing Officers, Rooms and Facilities

Physical security for office, rooms and facilities are in effect. Video-monitoring and electronic card-readers are used at the entrances of the offices. All rooms, including the conference rooms, offices and breakout rooms have doors with locks in case sensitive work needs to be carried out in these locations.

15.1.4. Working in Secure Areas

Litmus offices, rooms and facilities are secured by additional measures. There must be an access control to these areas and video monitoring is in place. The access controls will be reviewed once a year or when a change in employment occurs.

15.1.5. Delivery and Loading Areas

The building owners from whom Litmus leases office space share the risk and responsibility of protecting delivery and loading areas. They are responsible to help ensure that these locations do not become an entry point for unauthorized entry.

15.1.6. Removal of Assets

Litmus Personnel are permitted to work remotely and, therefore, are permitted to take their laptops or other assets along with them as needed to perform their work. Litmus also holds Litmus Personnel responsible for ensuring that the assets and the information in the assets remain protected at all times and all locations. The controls provided for end- point management, asset management and access controls detailed in this sub-policy under their respective sections add additional layers of protection.

15.1.7. Security of Equipment and Assets Off-Premises

Litmus Personnel are made aware of, and own, the responsibility of securing their equipment and assets off-premises. The controls provided for end-point management, asset management and access controls detailed in this sub-policy under the respective sections apply. In addition, other network controls specified in the Network Security Policy must be followed.

15.1.8. Secure Disposal or Re-Use of Equipment

Litmus Personnel and asset owners (such as the IT Department or authorized administrators) are made aware of the responsibility of protecting their equipment. Litmus provides additional protection by ensuring that the equipment is password-protected and that the disk encryption is in-effect.

16. Security Awareness Policy

This sub-policy is established for the purpose of ensuring that all activities undertaken by Litmus Personnel ensure that effective, risk-based decisions are made in the best interest of the organization, while protecting critical and sensitive information from being compromised.

All Litmus Personnel are required to take Security Awareness Training annually and/or within 30 days of onboarding. The training will be provided by a set of on-line video tutorials and or via electronic material. In-person training may also be provided when and where possible.

17. Security Event Logging and Monitoring Policy

This sub-policy is established to address the institution of event logging and monitoring infrastructure by Litmus to support monitoring of performance, security-related events and forensic investigations.

17.1. Types of Logs

The following are the examples of the logs aggregated and stored:

  1. Application-layer Logs – Web application-layer logs and Jira logs.
  2. System-layer and Network-layer Logs – DNS, VPN, RDS, NGINX and system security logs.
  3. Cloud-service Logs – Cloudtail logs, SSH access logs, and identity and access management logs.

17.2. Log Retention

Our current log aggregation keeps application logs for 30 days; however, logs may be persisted for a longer period on the application servers. Litmus is currently deploying an enhanced solution that will retain our critical application, system and security logs for a minimum of 90 days.

17.3. Privacy Compliance

Detailed documentation is maintained that describes who accesses logs and the use-cases for which the logs are accessed. In addition, (a) prior approval from the Information Security Lead is required before any logs are accessed, and (b) privacy management software is utilized for integrating workflows pertaining to log usage.

18. Vulnerability and Patch Management Policy

This sub-policy specifies the standards and procedures for the identification and remediation of Litmus system and software security vulnerabilities. It includes the following measures:

18.1. Vulnerability Assessment Framework

Litmus will maintain standard security configurations in line with sub-policy and vendor recommendations for all systems.

Vulnerabilities at all of the following layers are assessed and remediated:

  1. Application-layer Assessment – Please refer to the Application Security Policy.
  2. Operating-layer (OS) Assessment – Litmus uses Linux, Mac, and Windows OS and ensures that all its assets in data-centers, as well as those used by Litmus Personnel, are running currently supported versions of applicable OSes and patched for all “More Likely” or “Exploitation Detected” exploitable security updates which have a CVSSv3 score of 8.0 or higher.
  3. Network-layer Assessment – Litmus assets, as well as the data center scans, will be conducted periodically. The data center scans will comply with the supplier requirements.
  4. Default Configurations and Configuration Drifts – All opensource components will be assessed for security. The configuration drifts of repository buckets are periodically tested.

18.2. Vulnerability Validation, Triaging and Remediation

All the vulnerabilities shall be triaged as “CRITICAL,” HIGH,” “MEDIUM,” and “LOW.” The Critical and High vulnerabilities will be validated for true positives, and remediated. A report detailing the vulnerabilities and remediation approaches will also be generated.

18.3. Exceptions

Remediation efforts may be subject to delay when patches to be applied need to be developed in-house or tested to ensure that the production environment continues to operate correctly.

18.4. Going Forward

Litmus shall monitor US-CERT alerts, incorporate threat-intelligence reports from Open Source Intelligence and analyze opensource vulnerabilities.

19. Access Control Policy

This sub-policy ensures that only those individuals who are authorized and authenticated shall have access to the sensitive/confidential materials of Litmus. This sub-policy specifies operational controls, business requirements, user access management, user responsibilities and system and application access control requirements. Since Litmus uses cloud-based services, access controls provided by these cloud services are also leveraged.

19.1. Business Requirements

Access to the information and information processing facilities, networks and networks services identified as business-critical is limited. Access control rules, access rights and restrictions are in-place for these critical assets. The access controls are formalized with suppliers, and role-based access has been instituted.

19.2. User Access Management

Litmus ensures that only authorized users have access to systems and services. These controls include the following:

  1. User-registration and Deregistration to enable assignment of access rights.All users of systems or applications are supplied with a unique user ID related to the user’s identity, or other individually identifiable authentication method, to gain access to those systems. Unique user IDs enable users to be linked to, and held responsible for, their actions. To detect unauthorized access, logging and monitoring infrastructure is being set up. A formal user-registration and deregistration process has been established and implemented.
  2. Records of Authorized Users –A record of authorized users who have access to information and information facilities is maintained in our IdP
  3. User Access Provisioning – A formal user access provisioning process must be implemented to assign or revoke access rights for all users. People Operations, along with personnel managers, shall authorize users for membership to relevant groups. The membership to the group shall be granted by a member of the IT/Operations Department.
  4. Unique Use of User IDs – Each user having access to sensitive information is assigned a unique identification for authentication and authorization purposes.
  5. User ID Management – Only a limited number of users are provided privileged access rights, thereby limiting the use and access of these rights. These rights are reviewed by the senior management periodically.
  6. Management of Privileged Access Rights – All opensource components will be assessed for security. The configuration drifts of repository buckets are periodically tested.
  7. Management of Secret Authentication – Allocation of secret authentication of information (such as password to critical information) is managed by the IT department.
  8. Review of User Access Rights – User access rights are reviewed by the asset owners every year or when a change of employment or contract takes place.
  9. Removal or Adjustment of Access Rights – The access rights of all Litmus Personnel and external party users to information and information facilities are removed upon termination of employment, contract or engagement, or otherwise adjusted upon change in status.

19.3. User Responsibilities

Users will be made accountable for safeguarding their authentication information so that the information of Litmus, and its customers and suppliers, is protected and not divulged to any unauthorized person.

19.4. System and Application Access Control Requirements

This control limits unauthorized access to systems and applications and comprises the following aspects:

  1. Information Access Restriction –Access to systems are restricted in accordance to the access control policy. Access shall be reviewed when a person joins or leaves Litmus, or changes departments. For further elaboration, refer to the Access Control Policy.
  2. Secure Log-on Procedures – All systems are access-controlled via log-on procedures. Refer to the Access Control Policy and Password Protection Policy for further elaboration of the specific procedures.
  3. Password Management System – The Litmus password sub-policy is implemented to manage the passwords used for accessing sensitive/confidential information and information-processing facilities. Refer to the Password Protection Policy for further details.
  4. Use of Privileged Utility Programs – Access to privileged utility programs, such as operating system utilities, is restricted. In addition, logging and monitoring infrastructure is instituted to monitor the usage of these utility programs on critical information facilities.
  5. Access Control to Program Source code – Access to program source code and associated items (such as design specifications, validation and verification plans) is restricted. This control will prevent the introduction of unauthorized functionality to these critical resources.

20. Information Security in Development and Support Processes

20.1. Security Requirements of Information Systems

Information security requirements are recognized and integrated in the software development cycle. Information involved in application services passing over public networks must be protected from fraudulent activity, contract dispute and unauthorized disclosure and modification.

20.2. Security in Development and Support Processes

Litmus will separate testing environments from production environments. Segregation of duties is applied between testing functions (such as user acceptance, quality assurance, functionality, and information security) and production functions.

20.3. Protection of Test Data

Test data is protected and separated from production data. Production data will not be used for testing without prior authorization.

21. Access Management Standard for Mobile and Remote Computing

Litmus relies on, and permits, Litmus Personnel to work remotely. Therefore, Litmus uses and enforces security controls for mobile and remote computing.

21.1. Mobile Device Security

Litmus-issued computing devices have (a) antimalware solution, (b) disk-encryption, and (c) mobile device management (MDM) on Mac laptops. Media card usage is not permitted.

These devices can be remotely erased/wiped and managed by the Litmus IT administrators in the event they get stolen or misplaced.

21.1.1. Use of Cell Phones and Personal Device Assistance (PDAs)

Litmus Personnel typically bring their own mobile devices. These devices can be used for checking official business emails. Litmus relies on the mobile operating systems and applications to ensure that the container-level partition exists. Mobile device management solutions are being considered.

21.1.2. Use of USB Memory

Litmus Personnel must not use USB memory for storing customer, and system production or test data.

21.1.3. Use of Storage and Tape

Litmus Personnel must not use any storage devices or tape for storing customer, and system production or test data.

21.2. Secure Computer Image

Disk encryption via FileVault and anti-malware solutions via Bitdefender are provided for the Mac OS used by Litmus Personnel. Litmus Personnel are advised to use time- machine to take periodic secure images of their operating systems.

22. Supplier Management Policy

22.1. Information Security Policy for Suppliers

This sub-policy specifies information security requirements that suppliers must comply with when they access the assets, information, and information processing infrastructure of Litmus so that risks suppliers could introduce may be mitigated.

Following are the key aspects of managing information security aspects for suppliers:

  1. Addressing Security with Supplier Agreements – Litmus shall establish information security requirements and make each supplier agree to be legally bound to these requirements if the supplier’s employees, products or services access, store or process the data or access the information systems of Litmus or its customers.
  2. Contract Measures – Litmus has entered into a contract with its cloud service provider that specifies how personally identifiable information, including personal data and other sensitive information, if applicable, shall be protected in accordance with applicable laws.
  3. Information and Communication Technology Supply Chain – Litmus shall specify information security requirements in supplier agreements to ensure information security risks associated with information and communication technology supply chains are mitigated.
  4. Supplier Relationships – Third parties, including contractors and suppliers who access Litmus information or information processors, must comply with Litmus security requirements and controls.

22.2. Service Provider Assessment Policy

This sub-policy describes the internal procedures and requirements that Litmus follows when assessing suppliers and assets.

  1. IT Assessment – Prior to selecting and onboarding a supplier or asset, Litmus IT shall consider Litmus Policy and requirements when reviewing solutions.
  2. Security Assessment – Upon IT approval, Litmus Security will perform a supplier and asset risk assessment. This includes reviewing security and privacy documentation, verifying certifications, ensuring compliance with privacy policies, and recent publicly available information related to the supplier or asset. Suppliers and assets must meet or exceed Litmus security standards to be included in inventory.
  3. Review – Re-assessment of in-scope supplier risk shall be carried out annually or upon a material change in data classifications, the supplier relationship, or the supplier corporate structure. In addition, all suppliers are continuously tracked through privacy management software.

22.3. Supplier Service Delivery Management

Supplier service delivery will be managed via the following two activities:

  1. Monitoring and Review of Supplier Services – Litmus shall regularly monitor, review and audit supplier service delivery in accordance to the level of risk to Litmus.
  2. Managing Changes to Supplier Services –Re-assessment of supplier risk shall be carried out whenever supplier services and/or products change.

23. Information Security Incident Management Policy

Litmus has established policies and procedures to manage information security incidents.

  1. Communication – Litmus will alert affected parties within 48 hours of becoming aware of a security incident
  2. Investigation – Litmus will cooperate and participate in forensic investigations related to security incidents
  3. Reporting – User access reports are available within the Litmus platform and may be generated by account holders and administrators

24. Information Classification Policy

Information is a critical resource at Litmus. To ensure that Litmus meets customer, industry, regulatory, and privacy standards, and to reduce the risk that restricted or sensitive information is accidentally released to unauthorized parties, Litmus adheres to the following structured four-tier data classification system:

  1. Public – This information is approved for public release by our Marketing team. Disclosing this information would not be a problem for Litmus, its customers or business partners.
  2. Internal – This information is intended for use within Litmus, and in some cases with other affiliated organizations, such as business partners or vendors. Unauthorized disclosure of this information may be a violation of applicable law or contractual obligations, or may otherwise cause problems for Litmus, its customers or business partners.
  3. Confidential – This information is private or otherwise sensitive in nature and is restricted to those with a legitimate business need for access. Unauthorized disclosure of this information may be against applicable law or contractual obligations, or may cause significant problems for Litmus, its customers, or business partners.
  4. Secret – This information is the most private or otherwise sensitive and is always monitored and controlled. Unauthorized disclosure of this information to people without a legitimate business need for access may be against applicable law or contractual obligations, and will cause severe problems for Litmus, its customers or business partners.

25. Operational Security Policy

The purpose of this sub-policy is to specify the information security requirements that ensure secure operations of Litmus information systems and proper management of IT security program and technologies.

This sub-policy comprises the following components:

  1. Operational and Deployment Procedures and Responsibilities – Operating procedures and deployment procedures used by Litmus Personnel will be documented to ensure that systematic processes and information security procedures are followed during deployment.
  2. Change Management – All changes to operational software adhere to an agile methodology comprising of sprints. Jira is used to plan and manage changes. Refer to the Change Management Policy for further elaboration of the process.
  3. Separation of Development, Testing and Operational Environments – Litmus uses separate environments for development, testing and production, thereby reducing risks of unauthorized risks to the production/operational environment.

25.1. Protection Against Malware

Litmus uses anti-malware software to protect the software on Litmus-managed information processing assets. BitDefender is used as the anti-malware tool. The tool is updated hourly and completed scans are conducted bi-weekly. The scans include analyzing all the files as well as CD/DVD storage and USB.

25.2. Logging and Monitoring

A logging and monitoring infrastructure are being designed and prototyped for Litmus infrastructure. It is described in the Security Event Logging and Monitoring Policy.

25.3. Backup

25.3.1. Information Backup

The databases supporting the Litmus software and storage of information (for the testing, development and production environments) are backed up daily with transaction logs backed up every 5 minutes allowing for minimal data loss in the case backup restoration is required from a backup. Version Control backup is leveraged to ensure that the source code that Litmus uses is backed up.

The software or automation tool used for backup shall be tested every quarter to ensure that it is working properly.

25.3.2. Control and Logging of Data Restoration

When and if data is restored, the following must be logged: (a) the type of data restored, (b) who restores it, and (c) when the restoration took place.

25.3.3. Retention Period for Administrative Security Policy and Guidelines

Copies of the security policies, guidelines and procedures will be retained for 5 years, or such other period if required by applicable law or contractual obligations.

25.4. Control of Operational/Production Software

Installation of any software in an operational environment is conducted in accordance with the Change Management Policy.

25.5. Technical Vulnerability Management

An approved 3rd party security tool runs static and dynamic analysis on Litmus software. The scans from the analysis are provided to engineers so that critical risks are appropriately mitigated. Refer to Vulnerability and Patch Management Policy for a further description on the topic.

25.5.1. Infrastructure and Network Assessment Procedure

Litmus conducts network and infrastructures assessments (scans, penetration testing or red-teaming) once per year. These scans are conducted using enterprise-class scanning tools. Prior permission to scan the data-centers shall be obtained from the owners.

Data from scans shall be treated as sensitive information.

At the conclusion of an assessment, Critical vulnerabilities will be fully addressed within 30 calendar days of discovery. High vulnerabilities will be fully addressed within 60 calendar days of discovery. All other vulnerabilities will be assessed for business impact and will be prioritized accordingly.

25.5.2. Application Security Assessment Procedure

Refer to the Application Security Policy of this document for a detailed discussion on the topic.

25.5.3. External Security Assessments

External security assessments of the software, the architecture and systems that deploy the software, will be conducted once per year. The security assessment report will be reviewed and prioritized, and the vulnerabilities observed will be addressed.

26. Account Management Policy

26.1. Account Management Procedure

Litmus personnel are given access to computer/laptop accounts, and additional accounts required to perform job functions.

26.1.1. Litmus Computer/Laptop Accounts

The Litmus IT Department is responsible for managing IT accounts on the laptops or other computing devices used by Litmus Personnel. All new personnel are assigned accounts at the time they join Litmus, and the accounts are removed upon their termination, or amended if they change departments or job duties.

26.1.2. Infrastructure/Source Code/Version Control Accounts

Accounts that provide access to the Litmus infrastructure, source code, or version control are provided to employees on a need-to-have basis. The accounts are approved by the personnel’s manager. The Director of Technology Operations owns the responsibility of creating accounts that provide access to the Litmus infrastructure. Managers with a title of “Director” or above in the Engineering Department are authorized to create accounts that provide access to Source Code or Version Control.

26.1.3. Amendment/Deletion of Accounts.

When Litmus personnel leaves Litmus, changes roles or groups within Litmus, or is terminated, their accounts are deleted and access is deprovisioned. The manager of the Litmus Personnel, in collaboration with the IT Department, ensures that accounts are amended or deleted. Deprovision of access typically takes place within 24 hours of an event.

At no point shall redundant or duplicate accounts exist for any individual within Litmus.

26.1.4. Account Characteristics

All accounts are:

  1. Attributable to an individual.
  2. Characterized by a unique identifier (e.g., employee ID and email) and password.

27. Policy Compliance

27.1. Compliance Measurement

The Information Security team will verify compliance with this Policy and the associated sub-policies through various methods, including but not limited to, business tool reports, and internal and external audits.

27.2. Exceptions

Any exception to this Policy must be approved by the Information Security team.

27.3. Non-Compliance/Corrective Disciplinary Action

Any violation of the Acceptable Use Policy or the associated policies set forth in this Policy document may be subject to corrective disciplinary action, up to and including termination of employment. People Operations and the individual’s manager will determine the level and severity of any disciplinary action.

28. Policy Reviews

This Policy and the associated sub-policies shall be reviewed once per year, or more frequently if a significant change takes place within or to Litmus.

Start using Litmus.

Sign up for a free account in 30 seconds.

See Plans and Pricing
Email marketing made better