“How do I build trust with a cloud-based service?” This is the most common question Sumo Logic is asked, and we’ve got you covered. We built the service so it was not just an effortless choice for enterprise customers but the obvious one and building trust through a secure architecture was one of the first things we took care of.
Sumo Logic is SOC 2 Type 2 and HIPAA compliant. Sumo Logic also complies with the U.S. – E.U. Safe Harbor framework and will soon be PCI/DSS 3.0 compliant. No other cloud-based log analytics service can say this. For your company, this means you can safely get your logs into Sumo Logic – a service you can trust and a service that will protect your data just like you would.
These are no small accomplishments, and it takes an A-team to get it done. It all came together when we hired Joan Pepin, a phreak and a hacker by admission. Joan is our VP of Security and CISO. She was employee number 11 at Sumo Logic and her proficiency has helped shape our secure service.
Our secure architecture is also a perfect match for our “Customer First” policy and agile development culture. We make sure that we are quickly able to meet customer needs and to fix issues in real-time without compromising our secure software development processes. From network security to secure software development practices, we ensured that our developers are writing secure code in a peer-reviewed and process-driven fashion.
Sumo Logic was built from the ground up to be secure, reliable, fast, and compliant. Joan understands what it means to defend a system, keep tabs on it, watch it function live. Joan worked for the Department of Defense. She can’t actually talk about what she did when she was there, but we can confirm that she was there because the Department of Defense, as she puts it, “thought my real world experience would balance off the Ph.Ds.”
Joan learned the craft from Dr. Who, a member of the (http://en.wikipedia.org/wiki/Legion_of_Doom_(hacking)) Legion of Doom. (http://phrack.org/issues/31/5.html#article ) If hacker groups were rock and roll, the Legion of Doom would be Muddy Waters, Chuck Berry, Buddy Holly. They created the idea of a hacker group. They hacked into a number of state 911 systems and stole the documentation on them, distributing it throughout BBS’ in the United States. They were the original famous hacking group. Joan is no Jane-come-lately. She’s got the best resume you can have in this business.
We’re frequently asked about all the security procedures we adopt at Sumo Logic. Security is baked into every component of our service. Other than the various attestations I mentioned earlier, we also encrypt data at rest and in transit. Other security processes that are core to the Sumo Logic service include:
+ Centrally managed, FIPS-140 two-factor authentication devices for operations personnel
+ Biometric access controls
+ Whole-disk encryption
+ Thread-level access controls
+ Whitelisting of individual processes, users, ports and addresses
+ Strong AES-256-CBC encryption
+ Regular penetration tests and vulnerability scans
+ A strong Secure Development Life-Cycle (SDLC)
+ Threat intelligence and managed vulnerability feeds to stay current with the constantly evolving threatscape and security trends
If you’re still curious about the extent to which our teams have gone to keep your data safe, check out our white paper on the topic:
http://www.sumologic.com/_downloads/Sumo_Logic_Whitepaper_Securing_Logic_Service_060313.pdf
We use our own service to capture our logs, which has helped us accomplish our enviable security and compliance accomplishments. We’ve done the legwork so your data is secure and so you can use Sumo Logic to meet your unique security and compliance needs. We have been there done that with the Sumo Logic service and now it’s your turn.