Nozomi Networks Trust Center

Personnel Security

Nozomi Networks places a strong emphasis on personnel security to ensure the protection of its information assets.

Policies

The company has developed a comprehensive set of security policies that cover a wide range of topics. These policies are shared with and made available to all employees and contractors who have access to Nozomi Networks' information assets.

Training and Awareness

One of the key components of personnel security at Nozomi Networks is the Security Awareness Training program. All employees are required to attend this training upon hire and annually thereafter. Additionally, the Security team provides regular security awareness updates through various channels.

Background Checks

Employee vetting is another critical aspect of Nozomi Networks' personnel security practices. The company performs background checks on all new employees in accordance with local laws. These checks are also required for contractors and include criminal, education, and employment verification.

Non-Disclosure Agreements (NDAs)

All new hires are required to sign Non-Disclosure and Confidentiality agreements to protect sensitive information.

Onboarding and Offboarding Processes

Nozomi Networks has strict onboarding and offboarding requirements to ensure the appropriate access (and revocation) to information assets.

Corporate Security

Nozomi Networks is committed to ensuring the highest level of corporate IT security. Here's how we approach various aspects of IT security:

Endpoint Security

Strict controls are applied to endpoints connected to Nozomi Networks' systems, especially those with access to sensitive information. This is an integral part of the overall IT security framework.

Monitoring and Logging

Continuous monitoring logs all database access and ships the logs to a centralized system. Administrative access, use of privileged commands, and other access activities are logged and retained. Log information is protected against tampering and unauthorized access.

Malware Protection

Servers and endpoint devices such as laptops and desktops are protected and monitored from malware, malicious codes, and unsafe applications by deploying a set of protection tools.

Physical Security

Access to offices, computer rooms, and work areas containing sensitive information is physically restricted to authorized personnel only. Employees use access cards to enter offices and maintain a visitor log. Surveillance cameras and security measures are in place to monitor buildings. Physical security audits are conducted.

Access Control

Nozomi Networks ensures that users are only granted access to the network, systems, applications, and network services that they have been specifically authorized to use. Access to the system is audited, logged, and verified to maintain security and compliance.

To further reduce the risk of unauthorized access to data, Nozomi Networks' Access Control model is based on role-based access control (RBAC) to create separation of duties. The principles of least privilege are strictly enforced.

Nozomi Networks employs multi-factor authentication (MFA) for all access to systems containing client data. All employees are required to use an approved password manager. These password managers generate, store, and enter unique and complex passwords to prevent password reuse, phishing, and other password-related risks. An authentication tool is used to manage access to these accounts.

Supply Chain Management

Nozomi Networks is dedicated to maintaining a secure and reliable supply chain by continuously monitoring and assessing all sub-processors of data. We use a variety of metrics to evaluate and review the performance and compliance of our sub-processors.

As part of our operations, Nozomi Networks only partners with certified third-party sub-processors. Each vendor is thoroughly assessed through our Third Party Risk Management Program to ensure they comply with mandatory privacy regulations and adhere to best practices in security. The GRC Team conducts due diligence to evaluate each vendor's privacy, security, and confidentiality practices. This process includes executing a non-disclosure agreement to implement applicable obligations.

To ensure ongoing compliance and security, all critical suppliers are audited annually. We also utilize a vendor management platform as a central repository of information, allowing us to efficiently manage and monitor our supply chain. These measures help us maintain the highest standards of security and reliability in our operations.

Risk Management

Nozomi Networks takes a proactive approach to risk management to ensure the security and reliability of its services. Our team regularly conducts various risk assessments on the overall corporate structure, product, new projects, and proposed changes. Once a risk is identified, we follow a comprehensive process.

This structured approach allows Nozomi Networks to effectively manage and mitigate risks, ensuring the highest standards of security for our services.

Identify the Risk

We begin by identifying the risk and understanding how it relates to Nozomi Networks' services and corporation.

Evaluate the Risk

We then evaluate or rank the risk to gain a holistic view of potential exposure to the entire organization.

Treat the Risk

Based on the evaluation, we treat the risks according to the appropriate risk treatment process.

Monitor and Review

Finally, we continuously monitor and review risks to keep a close watch on all risk factors.

Data Encryption

Encryption in Transit

All communications with Vantage UI and APIs are encrypted via industry standard HTTPS/TLS (TLS 1.2 or higher).

Encryption at Rest

Service Data is encrypted at rest in AWS using AES-256 key encryption.

Application Security

Secure Code

The engineering processes used secure code principles, focusing on the OWASP Top 10 security risks.

Framework Security Controls

Nozomi Networks utilizes modern and secure open-source frameworks with built-in security controls to limit exposure to OWASP Top 10 security risks. These inherent controls help reduce the risk of SQL Injection (SQLi), Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), and other vulnerabilities.

Separate Environments

Testing and staging environments are logically separated from the production environment. No service data is used in development or test environments, maintaining a secure and controlled environment for testing purposes.

Vulnerability Management

Dynamic Vulnerability Scanning

Nozomi Networks employs third-party security tools to continuously and dynamically scan core applications against common web application security risks, including the OWASP Top 10 security risks.

Software Composition Analysis

Libraries and dependencies used in Nozomi Networks' products are scanned to identify and manage vulnerabilities, ensuring that all components are secure.

Third-Party Penetration Testing

In addition to extensive internal scanning and testing programs, Nozomi Networks engages third-party security experts to perform detailed annual penetration tests.

Data Hosting Locality

Nozomi Networks offers clients the flexibility to choose from multiple AWS datacenter locations based on their preferences and requirements.

This allows clients to select the most suitable datacenter location for their needs, ensuring optimal performance, compliance, and data sovereignty. By providing a range of options, Nozomi Networks empowers clients to make informed decisions about where their data is stored and processed, enhancing overall security and reliability.

Our Commitment to Privacy

Our privacy practices are designed to protect personal information across all aspects of our operations. This includes data related to employees, job applicants, suppliers, partners, website visitors, customers, and payors. We collect personal information only for specified, explicit, and legitimate purposes, ensuring that the data is accurate, complete, and up-to-date. We implement robust technical and organizational measures to safeguard personal information against unauthorized access, disclosure, alteration, or destruction. Regular audits and reviews are conducted to maintain data quality and integrity.

Transparency and Individual Rights

Transparency is a core value at Nozomi Networks. We provide individuals with clear and accessible information about how their personal information is collected, used, and protected. Our privacy policy and notices are readily available on our website and other relevant platforms. We also empower individuals to exercise their rights under applicable privacy laws, including the right to access, correct, delete, and restrict the processing of their personal data. Our commitment to transparency ensures that our customers can trust us with their most sensitive information.

By adhering to these principles and continuously improving our privacy practices, Nozomi Networks is committed to safeguarding personal information and ensuring compliance with the highest standards of data protection.

AI Governance

At Nozomi Networks, we are committed to the responsible and ethical development, implementation, and use of artificial intelligence (AI) and machine learning (ML) technologies. Our AI Policy provides comprehensive guidelines to ensure that our AI/ML systems are developed and deployed in compliance with regulatory standards, including the EU AI Act. Our Program applies to all AI/ML systems embedded in our software and services, as well as any third-party AI tools used within the organization.

Our approach aligns with our goals of enabling innovation, ensuring responsible conduct, and maintaining transparency and adherence to legal and regulatory compliance requirements.

Governance and Accountability

Nozomi Networks has established a robust governance structure to oversee our AI initiatives. We have defined roles and responsibilities for the oversight of AI policy requirements, involving engineering leadership, compliance, legal, and IT departments. Review boards or committees are in place to assess AI initiatives, ensuring that all AI projects undergo thorough risk assessments and comply with evolving regulations. Such as the EU AI Act.

Our commitment to governance and accountability ensures that our AI systems operate fairly, securely, and ethically, reinforcing our dedication to maintaining the trust of our stakeholders.