Network Security Policy

This policy defines Tanqory’s network security principles, controls, and processes across cloud, data center, office, internal, and partner connectivity. It covers segmentation/zero trust, perimeter defense, access control, encryption, monitoring/IR, vulnerability and patch management, remote/third-party access, logging/audit, and business continuity to protect confidentiality, integrity, and availability. All employees, contractors, and authorized providers are bound by this policy. The English version governs; stricter enterprise terms are set in Order Forms/contract appendices.

1) Purpose & Scope

Establish minimum network security standards for all Tanqory environments: network devices (firewall/router/switch/load balancer), edge services (WAF, CDN, DDoS), detection (IDS/IPS), virtual networks (VPC/VNet), VPN/Zero Trust Network Access (ZTNA), inter-DC/cloud links, admin access, APIs/client-facing apps. Applies to Production/Staging/Test/Sandbox and partner links. Conflicts defer to the English version and the stricter of law or contract.

2) Design Principles & Segmentation

Follow Zero Trust and defense-in-depth: trust no connection by default. Segment into Public/DMZ, Application, Data, Management, and Non-Production zones with firewall/ACL/Security Group enforcement. Critical services use micro-segmentation to reduce attack surface. Inter-zone traffic requires authentication, policy enforcement, and audit logging. IP/CIDR plans avoid overlap and support growth. Apply least privilege to every flow; role/group-based entitlements are reviewed periodically to remove excess access.

3) Perimeter & Internet Connectivity

Use WAF, DDoS protection, bot management, and CDN per system criticality. Enforce TLS (latest) on internet edges; redirect HTTP→HTTPS and use HSTS on primary domains to prevent downgrade/MiTM. Default deny for ports/protocols; open only what is needed. Admin/bastion/jump/SSM services reside in a separate management zone with MFA and limited source IPs. DNS/Anycast and upstream routing follow best practices to prevent spoofing and cache poisoning.

4) Access Control & Authentication

All network/admin access requires MFA and SSO/Federation with strong password/credential policy. Admin/privileged accounts use RBAC and Segregation of Duties; apply least privilege and Just-In-Time (JIT) access for elevated tasks. Log and monitor all firewall/ACL/Security Group changes. Review firewall rules and privileged access at least quarterly or after major events to close unused paths. Device posture (e.g., EDR present, disk encryption, OS patch level) is required for admin access where supported.

5) Encryption & Key Management

Encrypt all traffic by default (TLS 1.2+; prefer 1.3). Use mTLS for sensitive service-to-service communications. Store keys in KMS/HSM with access logging and RBAC; rotate service keys 90–180 days (shorter for high-privilege keys) or on compromise. Prohibit weak protocols/ciphers (SSL/TLS 1.0/1.1, RC4, 3DES, export/NULL, SHA-1-based suites). Secrets (API keys/tokens) must be in approved secret management, not code/CI, with enforced rotation. Support perfect forward secrecy (ECDHE) and disable insecure renegotiation.

6) Monitoring, Logging, and Incident Response

Centralize and retain logs for critical events (authz/authn, firewall/ACL changes, admin actions, data access, config changes) into SIEM with 24/7 alerting. Use IDS/IPS plus behavior analytics for lateral movement. Maintain runbooks for network incidents (DDoS, intrusion, lateral movement) linked to the Incident Response Plan; honor contractual/legal notification timelines (e.g., 24–72h for major events). Conduct PIRs and tune rules/use-cases after incidents.

7) Vulnerability & Patch Management

Patch firmware/OS for network gear (firewall/router/switch/load balancer/WAF/IDS/IPS/VPN) per risk. Perform vulnerability scanning and penetration testing at least annually and after major changes. Rate findings with CVSS v3.1; remediate Critical/High immediately or within defined days; Medium/Low per standard cadence. Plan to upgrade/replace end-of-support devices to reduce exposure. Track SLOs and exceptions with compensating controls.

8) Remote Access & Third Parties

Remote admin/user access uses VPN or ZTNA with MFA, device posture, and policy-based access. Partner/third-party connections require risk assessment, defined scope, and dedicated segmented zones (partner VPC/VLAN/segmentation) with restricted ports/time and full logging. Cross-border data flows must meet legal requirements (e.g., SCCs/IDTA/DPAs), with routing/regions aligned to data residency commitments.

9) Backup & Business Continuity

Back up critical network configs (firewall/router/switch/WAF/load balancer) encrypted and stored separate from production; test restores per schedule and log results. Set RPO/RTO based on network criticality. For P1 disruptions, follow runbooks and communication SLAs (e.g., updates every 60–120 minutes). Enterprise binding numbers are in Order Forms/contract appendices.

10) Change & Configuration Management

All network changes follow Change Management with impact/risk assessment, approvals, and CMDB updates. Firewall/ACL/Security Group rules require peer review/approval and rationale. Production changes need tested rollback/validation. Emergency changes must be documented and post-reviewed to prevent misconfiguration. Use config management/IaC where feasible; enforce drift detection.

11) Testing & Audit

Regular exercises: network tabletop/simulations, DR drills, penetration tests, and Red/Purple Team where appropriate. Internal/external audits follow ISMS/SOC 2/PCI/customer requirements. Findings require remediation plans and tracking to closure. Provide evidence of access/change/incident handling during audits.

12) Recordkeeping, Retention, Updates

Retain access/change/incident/backup/audit/approval records at least 3–5 years or longer per law/contract, encrypted and least-privilege protected. Review this policy at least annually or upon architecture/legal/standard changes or major incidents. Material changes will be posted at https://legal.tanqory.com and/or emailed to registered stakeholders with effective date/version. English version controls.

---

Appendix A: Key Network Controls (Summary)

Appendix B: Regional/Industry-Specific Requirements (add when applicable)

• If subject to frameworks (e.g., US FedRAMP/HIPAA, EU NIS2/DORA, JP FISC, SG MAS TRM), include required network controls/evidence (SSP/ATO for FedRAMP; segmentation/logging for DORA; MAS TRM resilience) here when applicable.
• Data residency (examples; align to contract/Order Form):
  • APAC: Primary Singapore, DR Japan (Tokyo) — no failover outside APAC without written customer consent.
  • EU/EEA/UK: Primary Frankfurt, DR Paris — no failover outside EU/UK if contractually restricted.
  • US: Primary N. Virginia, DR Oregon — use US-only for US customers unless contract allows otherwise.
  • Add/override regions per Order Form; failover must not breach contractual residency.
• Crypto/Protocols: TLS 1.2+ (prefer 1.3), deprecate TLS 1.0/1.1, RC4/3DES/weak ciphers.
  • Allowed sample suites: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384.
  • Disallowed sample suites: RC4-based, 3DES, NULL/EXPORT, SHA-1-based suites.
  • Customer/country-specific crypto rules should be referenced here and updated per Order Form/contract.
• Crypto profiles by data type:
  • PCI/PHI/sensitive PII: enforce TLS 1.3 where supported; otherwise TLS 1.2 with AEAD GCM/ChaCha20 suites only; mTLS for service-to-service; HSTS enabled on public endpoints.
  • Admin/Management: require mTLS + MFA + device posture; SSH v2 with modern ciphers (no CBC/MD5/SHA-1).
• Binding SLA (unless stricter in Order Form):
  • Network edge/service uptime target: 99.9% monthly for shared edge; dedicated/VIP per contract.
  • Incident response: P1 engagement ≤15 minutes, containment start ≤1 hour; customer updates every 60–120 minutes until stable.
  • DDoS mitigation: initiate within 15 minutes of confirmed attack; status updates every 60 minutes during active mitigation.
• Testing cadence (unless stricter in Order Form/regulation):
  • Network penetration test: at least annually; semi-annual for PCI/finance tenants.
  • DR/Failover drill: at least annually for network edge and critical interconnects; DDoS tabletop/simulation annually.
  • Firewall/ACL review: quarterly; privileged access review: quarterly.
• Logging/retention:
  • Network/security logs retained hot for 365 days, archived 3–5 years or longer if law/contract requires.
  • Time sync via NTP/PTP; ensure log integrity (signing/hash) where applicable for audit chains.
• Industry mappings (when needed):
  • Financial (DORA/FFIEC/MAS TRM/FISC): segmentation/logging/incident SLAs/resilience, data path records, DR evidence.
  • Health (HIPAA/HITRUST): access/logging/encryption in transit/at rest, ePHI access logs, BAA where required.
  • Government/FedRAMP: SSP, continuous monitoring, ATO per agreed level, boundary protection/segmentation/logging per FedRAMP baselines.

Glossary

• ACL (Access Control List) Controls permitting/denying traffic.
• AES (Advanced Encryption Standard) Symmetric encryption standard.
• BCP/DR Business Continuity / Disaster Recovery.
• CDN (Content Delivery Network) Content distribution network.
• CMDB (Configuration Management Database) Configuration inventory.
• DDoS (Distributed Denial of Service) Attack disrupting service.
• DPA (Data Processing Agreement) Data processing contract.
• HSM (Hardware Security Module) Secure key management hardware.
• IDS/IPS (Intrusion Detection/Prevention System) Threat detection/prevention.
• IRP (Incident Response Plan) Incident handling plan.
• KMS (Key Management Service) Managed key service.
• RBAC (Role-Based Access Control) Role-based access controls.
• SIEM (Security Information and Event Management) Central log/alert platform.
• SSO (Single Sign-On) Single authentication for multiple systems.
• TLS (Transport Layer Security) Encryption protocol for data in transit.
• WAF (Web Application Firewall) Web application protection.
• ZTNA (Zero Trust Network Access) Zero trust-based access model.
• Mutual TLS Two-way certificate authentication.