Security

Security

Below you can find a detailed list of the most frequently requested information by IT departments regarding the security of BIMcollab.
If you look at our pricing model you can start to understand that we cannot spend the time to fill in detailed assessments for all of our customers. So we kindly ask you to start with a self-assessment with the help of the list below. If you still miss anything or have additional questions, do not hesitate to contact your sales-contact.

Security - Legal

Certifications

  1. BIMcollab is ISO-27001 certified as of November 2022.
  2. BIMcollab is PCI-DSS certified. Therefore, the Payment Card Industry Data Security Standard (PCI-DSS) for protection of Payment Card Industry data is applicable.
  3. Security regulations and governance of relevant countries of the cloud service and data residency shall be applied.
  4. SOC 2 Audit Reports for SSAE 16 are not available.
  5. There are independent reviews and assessments planned at least annually.
  6. The client/corporation shall reserve the right of compliance audit for the security of systems and processes of the cloud service.
  7. BIMcollab uses the Tier 3++ datacenters of Interconnect, which is certificated on ISO9001, ISO14001, ISAE 3000, and SOC 2 type 2 reporting. They offer a very high standard of network infrastructure and energy efficient powering. This ensures an independent judgment about the quality principles: ‘security’ and ‘availability’ of the data center and cloud services.

Data storage - Location

  1. Data residency of the cloud service is restricted appropriately.
  2. All data is stored in The Netherlands unless when using an on-premise installation.

Data storage - Deleting data

  1. All data from client shall be securely erased from the cloud service upon service termination or at request.
  2. We have policies and procedures for the secure disposal and complete removal of data from all storage media. This ensures that data is not recoverable by any forensic means.
  3. We have policies for procedures and controls to protect the confidentiality and availability of the encryption keys.

Data storage - Protection

  1. The availability commitments of the service, including our ability to recover from outages can be found in our Software Level Agreement.

Privacy policy

  1. Production data shall not be replicated or used in non-production environments.
  2. All clients/corporation data stored or processed on the cloud services is owned by the client / corporation.
  3. Data use policy with regard to customer data of the cloud service is clearly defined to prevent unauthorized use of customer data.
  4. BIMcollab Zoom and the BCF Managers don't process personal data. To obtain the express consent of the data subjects (i.e. Personal Information Collection Statement) and comply in all aspects with the Personal Data Privacy Ordinance (PDPO), including data security assurance, retention period limited to such period as necessary etc., is not applicable.
  5. Read our full privacy statement.

Best Practices

  1. Business Continuity Plan is in place.

Terms of Use

  1. Terms of Use provided by customer shall not be included. BIMcollab provides its own terms of use. Only customers/ end-users who accept the Policy & Terms are allowed to use the application.

Service Level Agreements

  1. Service Level Agreement (SLA) is part of the Business Agreement and specifies the scope of our service.
  1. This information can be found in our Service Level Agreement.

Security - Physical

Physical security

  1. Our data center utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications, and internet connectivity) are secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions.
  2. Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) are implemented to safeguard sensitive data and information systems.

Information security

  1. Information security policies and procedures are in place as specified in ISO-27001.
  2. Policies and procedures are partly established regarding personnel security including background check, security awareness and termination.
  3. There is a daily backup of the customer data with retention period of at least 1 months. The backup is physically protected and encrypted.
  4. Our backups are geographically separated from our production environment to ensure data safety in case of a disaster.
  5. Our backups are immutable to protect against accidental and malicious data modification, encryption, corruption, and deletion. This also protects against malware, ransomware, viruses, and other attacks or data mishaps.
  6. The security incident response plan is documented. Any security breach affecting customer will be reported to customer responsible person as soon as possible.
  7. All expired components potentially containing data are professionally destroyed.
  8. A limited number of internal engineers have root access to the servers.
  9. Access can only be achieved from pre-approved IP-addresses.
  10. All communications is performed over encrypted communication lines.

Security - Technical

Protection - Access

  1. The system does not support ADFS Authentication. Support can be made available when using an on-premise installation.
  2. Access controls are enforced to ensure only authorized users can access the cloud service and data.
  3. Role-based access controls are implemented for segregation of duty. For more information on roles in the BIMcollab environment, consult the article Roles within the BIMcollab environment.
  4. The production and non-production environments are separated to prevent unauthorized access or changes to information assets.
  5. The multi-tenant organizationally-owned or managed (physical and virtual) applications, infrastructure system and network components, designed, developed, deployed, and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users. Every tenant has their own instance of the web application as well as their own database.
  6. The management environment is separated for unauthorized access by IP and also two-factor authentication.
  7. The data and service are separated from other consumers of the service. All customers run in their own spaces, completely separated from each other.
  8. The management of the service is kept separate from other costumers.
  9. A uniform message is displayed when a wrong combination of user/password is entered.

Protection - Password

  1. The system provides a secure mechanism for a user the reset their own password.
  2. The password is not stored in a one-way salted hash in the system.
  3. The password is securely stored in the database.
  4. The system can enforce strong passwords of at least 8 characters long and with a complex composition.
  5. The system enforces periodical change of password of user accounts.
  6. The system prevents brute-force password attacking.
  7. The system supports two-factor authentication.

Protection - Firewall

  1. The BIMcollab space is protected by a firewall which allows only necessary traffic from a trusted network.
  2. Spaces are protected by an IDS/IPS from untrusted networks.
  3. The space has mitigation against a DDoS attack.
  4. The servers are protected by antivirus software with real-time protection and a scheduled full scan.
  5. The web application is protected by a Web Application Firewall or periodically scanned by a web application scanner to make sure that there are no known web application vulnerabilities.
  6. The app is only reachable by IPv4 or IPv6.
  7. Open TCP/UDP ports are limited to a minimum, and all others are in stealth mode.
  8. SSL communication is enforced.
  9. A Web Application Firewall (white-listing) is in place for additional security.

Protection - Encryption

  1. Transmission of data is encrypted. Web access is encrypted by TLS 1.2 or above using strong cipher with Perfect Forward Secrecy (PFS). File transfer is encrypted by SFTP.
  2. When using an on-premise installation and the customer domain is used in the web access, the SSL/TLS certificate is provided by the customer or the certificate is provided by the system which is signed by industry trusted CA. This is entirely up to the customer.
  3. Data in transit is protected between the consumer’s end user device and the service.
  4. Personal data storage complies to GDPR.

Logging

  1. Security events of user account activities are logged and kept for 3 months.
  2. The network environments and virtual instances are designed and configured to restrict and monitor traffic between trusted and untrusted connections.
  3. Logging and notification of security events are available on request and enabled.

Best practices

  1. The servers are setup and hardened according to a secure configuration baseline.
  2. A threat and vulnerability management process is in place where security patches are installed on the OS, applications and network infrastructure regularly in a timely manner.
  3. Regular vulnerability scanning and penetration tests are being performed. The scan and test report with detailed results can be shared after signing an NDA agreement.
  4. Security audit logs are available to authorized staff of the client in case of security investigation.
  5. Formal risk assessments are performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks.
  6. Vulnerability- and patch-management is in place.
  7. Accounts and credentials specific to redundant equipment are deleted as soon as the equipment is taken out of commission, to reduce their value to an attacker.
  8. Potential new threats, vulnerabilities or exploitation techniques which could affect the service are assessed and corrective action is taken. All security updates are installed as soon as possible.
  9. The severity of threats and vulnerabilities is considered within the context of the service and this information is used to prioritize implementation of mitigations. All high severity risks are immediately acted upon.
  10. Known vulnerabilities within the service are logged and tracked within our tooling, until suitable mitigations have been deployed through a suitable change management process.

Security - Functional

Security - Supported

  1. There are no software version numbers of the webserver or application in the http headers.
  2. There are no software version numbers on the application page before login.
  3. Internal IP addresses, host names, domain names and other internal information are not visible to others.
  4. Default pages are removed or replaced.
  5. All error handling is caught with custom pages. (404, 500, etc.).
  6. No debug mode or elaborate error descriptions are used.
  7. Demo pages and documentation are removed from the server.
  8. Content is only in HTTPS and not mixed.
  9. We have our own solution against clickjacking.
  10. HTTP methods are restricted to a minimum (GET, POST).
  11. The sitemap.xml contains references to support pages such as 404 or 500 pages.
  12. Username and password are not saved in cookies.
  13. A SameSite (Secure of Lax) protection against Cross-Site Request Forgery (CSRF) -attacks is in place.
  14. Max age attributes are supported.
  15. Domain/path attributes are supported.
  16. (REST-)API's are protected to not give away unnecessary information.
  17. Code signing is used for the apps. The Mac applications are signed with our certificate, notarized by Apple. Our Windows applications are also signed with our trusted certificate.
  18. Crypto keys, passwords, and security settings are saved and protected in the apps. Our applications connect to an external API (BIMcollab), which requires user authentication and proxy settings. We remember user credentials, only when selected by the user, in obfuscated format in the filesystem/registry for user-friendlyness.
  19. Measures are taken to protect against reverse engineering and manipulation. Most of our code is compiled-code (C++), making it difficult to reverse-engineer to the original code. The part which is not compiled (C#, JS), is obfuscated.

Security - Not Supported

  1. A CSP header (no unsafe tags) and ‘report-url=’ tag is not included.
  2. X-Frame-Options are not used to prevent clickjacking, next to CSP header as “frame-ancestors”. We have our own solution against clickjacking.
  3. Web forms are not protected with CSRF tokens. We have our own solution.
  4. Rate-limiting is not activated on web forms.
  5. The HSTS header is not minimum 2 year (max-age=63072000; includeSubDomains; preload).
  6. Cipher Suites are not restricted.
  7. Secure flags are not supported.
  8. Used open-source components are analyzed astrustworthy by our best means: BIMcollab Nexus colophon and BIMcollab Zoom colophon.
  9. The app does not use certificate pinning for all network communications.

Protocol

  1. HTTP to HTTPS redirection (301) is supported.
  2. All communication with web forms is performed through HTTPS.
  3. Robots.txt file in website root is not supported (not applicable).
  4. No other versions then TLS version 1.2 or higher are used.

Best practices

  1. We inspect, account for, and work with our cloud supply-chain partners to correct data quality errors and associated risks.
  2. Controls are designed and implemented to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privilege access for all personnel.
  3. The used code and code libraries are up-to-date and contain no known vulnerabilities. This is periodically checked based on build reports. For web components, we run NPM audit.
  4. The web application always runs through HTTPS.
  5. No self-signed or untrusted CA certificates are used on external interfaces.
  6. The Application Programming Interface (API) is designed, developed, deployed, and tested in accordance with industry standards. We follow open standards defined by BuildingSmart.
  7. Older web browser are supported up to a reasonable limit. See our system requirements.
  8. Our web application does not contain cookie banners.