Security White Paper

1. Introduction and Overview

Diri AS is a growing cybersecurity company with a strong foundation built on research from NTNU’s Department of Information Security and practical experience gained from NTNU IT’s digital security section. We offer a cutting-edge SaaS platform designed to help businesses efficiently manage cybersecurity risks, suppliers, information systems, and privacy compliance.

Our platform operates with a strong focus on scalability and security, leveraging Microsoft Azure Kubernetes as a flexible, cloud-based infrastructure, tailored to meet the needs of businesses of all sizes across Europe. We aim to empower our clients with an easy-to-use platform that balances security, risk management, and operational efficiency.

2. Security Framework

Diri AS actively strives to align with industry-standard security frameworks like ISO 27001 and NIST SP 800-53, which guide our security operations. Our main standard is ISO 27005 which our tool also supports.  While we are not yet certified, our practices adhere closely to these standards. Our long-term objective is certification, with ongoing improvements in our Information Security Management System (ISMS). We apply a risk-based approach, prioritizing having an overview of our vendors, IT systems, assets, and security controls based on potential impact and customer needs.

3. Infrastructure Overview

Our platform is hosted on Microsoft Azure Kubernetes Services (AKS), a scalable and secure environment. Key components of our infrastructure include:

• Key Vault: All sensitive data, including secrets, keys, and certificates, are securely stored using Azure Key Vault, ensuring robust encryption at rest.
• Azure Files (NFS): Secure storage is provided via Azure’s NFS service, offering high availability and redundancy. Azure Storage Accounts are encrypted using 256-bit AES by default
• Ingress Controller and App Gateway: This enables secure traffic routing to internal services over HTTPS (using TLS 1.3 as default), ensuring all data in transit is encrypted.

We operate separate Development/Test and Production environments with clearly defined roles, as visualized in the architecture diagram. This separation ensures that test data and production data are never mixed, reducing the risk of accidental data exposure.

Scalability: Our platform is built to scale with customer needs. Through AKS, we ensure our infrastructure auto-scales to handle increased traffic without sacrificing performance. This is complemented by Horizontal Pod Autoscaling (HPA) policies that automatically adjust resources to maintain performance, even during traffic spikes.

4. Data Protection

Data protection is at the core of our platform. Diri AS ensures that customer data is encrypted both at rest and in transit using AES-256 encryption. Our system uses the latest cryptographic protocols, including TLS 1.3, to secure all communications.

Data stored within Azure is protected by Azure Key Vault, with stringent access controls and encryption in place. This ensures that sensitive data such as personal identifiable information (PII) or authentication credentials are never exposed to unauthorized entities.

• Data Segregation: Diri AS ensures data segregation measures within our platform to prevent accidental or unauthorized access to customer data. Each customer's data is isolated, ensuring that it remains confidential and accessible only to authorized users within that specific organization.
• GDPR Compliance: Diri AS is committed to data privacy, ensuring that our platform adheres to the General Data Protection Regulation (GDPR). We process data strictly on behalf of the customer (as a Data Processor), while customers retain full ownership of their data (as Data Controllers). Diri AS practices data minimization and storage limitation principles.

5. Authentication and Authorization

We provide robust Identity and Access Management (IAM) through Microsoft EntraID (formerly Azure Active Directory) and Google Workspace Identity. This allows for:

• Single Sign-On (SSO) for easy access management.
• Multi-Factor Authentication (MFA) to enhance security using SSO.
• Role-Based Access Control (RBAC) to enforce least-privilege access policies, ensuring that users only have the access they need to perform their tasks.

All authentication and authorization events are logged, ensuring a comprehensive audit trail is available for any security investigations.

6. Application Security

Diri AS follows secure coding practices, as outlined in OWASP Top 10 guidelines. We regularly test our software for vulnerabilities and perform comprehensive code reviews. Using tools such as ESLint, Husky, Jest, etc., Diri AS makes sure code is checked before deployed together with well-tailored pipelines to prevent unwanted changes from going live. This ensures that security issues are detected and addressed early in the development lifecycle.

We also implement the following security measures:

• Web Application Firewall (WAF): We use Azure’s WAF to enforce OWASP best practices, mitigating common attacks like SQL injection, cross-site scripting (XSS), and request forgery.
• Automated Vulnerability Scanning: Our system undergoes continuous scanning to identify and address security vulnerabilities in real time. This ensures that all issues are patched as soon as possible.

7. Monitoring and Incident Response

Diri AS has implemented Microsoft Sentinel and Azure Monitor for real-time monitoring and alerting across our infrastructure. While both tools are available, we are in the process of optimizing their use to fully leverage their capabilities.

• Azure Monitor collects metrics and logs from our applications, providing visibility into performance and availability. While currently active, further configuration is needed to fully unlock its potential for proactive performance tuning and troubleshooting.
• Microsoft Sentinel serves as our cloud-native Security Information and Event Management (SIEM) system, enabling us to detect, investigate, and respond to potential security threats. We are in the process of fine-tuning alerts and integrating additional data sources to ensure comprehensive coverage across all environments.
• Continuous Log Monitoring: We capture and analyze logs from across the platform to detect any anomalous or suspicious behavior.

As we continue to improve our monitoring systems, we will be better equipped to identify anomalies, respond to incidents in real time, and maintain a robust security posture.

• Incident Response: We have predefined incident response roles to handle any potential security incidents swiftly and effectively. In the event of an incident, we follow predefined procedures to contain, mitigate, and recover from any disruptions.

In addition, we maintain:

• Immutable Logs: Audit logs are immutable, ensuring that no unauthorized changes can be made.
• Notification Policy: In case of any breach or incident, customers are notified without unnecessary delay, as part of our Incident Response Plan.

8. Compliance and Certifications

Although Diri AS has not yet achieved certification for ISO 27001, we are working diligently towards meeting these standards. Our security practices are aligned with these frameworks, and we perform regular internal audits and third-party reviews to validate our adherence to best practices.

Financial Stability: We have secured considerable funding from reputable organizations such as Innovation Norway, The Norwegian Research Council, SecurIT (EU Horizon), NTNU TTO, and Startuplab, supporting our long-term vision for sustainable growth.

9. Disaster Recovery and Business Continuity

Our disaster recovery (DR) planning leverages Azure’s global infrastructure, ensuring that any disruptions to service are minimized. We can recover from system failures with Recovery Time Objectives (RTO) of a few hours and Recovery Point Objectives (RPO) of one day.

10. API Security and Integration

Our platform’s APIs are protected by Bearer Token Authentication and use TLS 1.3 to secure all traffic. We implement strong rate-limiting and logging measures to detect any abuse of our APIs. Each API call is thoroughly logged for audit purposes.

Our platform also integrates smoothly with customer systems using standard protocols and provides comprehensive documentation for API integration.

11. Customer Data Ownership and Privacy

Diri AS ensures that all customer data remains under the control of the customer (Data Controller). We act solely as the Data Processor, adhering to strict GDPR guidelines and working closely with our clients to ensure data handling practices comply with the latest privacy laws.

Upon contract termination, we provide customers with secure data export and delete all stored customer data, certifying deletion with a signed statement.

12. Logging and Auditing

Diri AS ensures that all user actions are logged and auditable. Administrator accounts are personal, and no shared access is allowed. Audit logs are available to customers for their own auditing needs. All system activities, including access, modifications, and administrative actions, are securely logged, and those logs are stored in an immutable format.

13. Penetration Testing and Continuous Security Monitoring

We conduct annual third-party penetration tests to assess the security of our platform. Our last penetration test was conducted in May 2024, with all identified vulnerabilities promptly addressed. In addition to annual tests, we also implement continuous security monitoring of all internet-exposed services.

Diri AS documents its security posture using a Software Bill of Materials (SBOM), which is available upon request for customer review.

‍14. Personnel Security

At Diri AS, we ensure all personne handling customer data meet security standards.

• Background Checks: All employees undergo interviews and reference checks before employment.
• NDAs: All employees and subcontractors sign NDAs to maintain the confidentiality of customer data.
• Security Training: Employees receive regular security training.
• Access Controls: We enforce Role-Based Access Control (RBAC), granting minimal necessary access (following the principle of least privilege). Multi-Factor Authentication (MFA) is mandatory for all critical systems.
• Subcontractors: We work with subcontractors from NATO, EU, and EEA countries, all of whom are held to the same security standards.
• Incident Response: In case of a personnel-related incident, we immediately revoke access and investigate.