Introduction

Security is an essential part of infrastructure design, application development processes, and support. This document provides an overview of our security measures and processes.

Data Protection and Privacy

Encryption in Transit and at Rest

Production instances are configured to exclusively use TLS 1.2 SSL security for data in flight. This leverages AWS infrastructure capabilities at the load balancer.

All customer data resides in AWS RDS Aurora configured with AES-256 encryption, with keys managed by AWS KMS. Extensive documentation of RDS encryption at rest can be found on AWS Documentation.

Data Location

All customer data is stored within AWS RDS Aurora Multiple Availability Zone instances in the region hosting the customer instance. Currently supported customer AWS Regions are Virginia and Ireland. Real-time offsite backups are in place, and extensive documentation about this is available via AWS RDS Documentation.

Note that AWS RDS policies and mechanisms for physical and environmental security, media disposal and backup procedures are audited on a periodic basis. AWS SOC audit reports are available for customer review upon request.

Business Continuity

The application was designed to be inherently resilient and to maximize availability and to minimize downtime. Much of this resilience is owed to the hosting infrastructure, the Amazon Web Services (AWS) cloud. Further information regarding our approach to business continuity and disaster recovery are in this article:

Business Continuity and Disaster Recovery

Access Controls

All customer PROD MAIN superadmin support accounts are protected via MFA. Reviews of superadmin support accounts across all customer PROD MAIN instances are conducted on a quarterly basis.

Engineering access to hosting infrastructure requires MFA. Access for individuals is continuously monitored by our compliance monitoring platform (Drata) which is linked to IQVIA Human Resources and authorisation systems to verify that access is restricted to current team members.

Security Testing

Application Security Scanning

We use Detectify to perform OWASP 10 security scanning against each functional release build. The results of these scans are recorded and made available in the release Technical File.

Vulnerability scanning

We use intruder.io to perform monthly scheduled vulnerability scans on a representative set of application instances. The application engineering team receives notifications on any findings for follow up. intruder.io also performs proactive scans for emerging threat scans’ on an ad-hoc basis, and sends summaries to the engineering team for review. Scans of this tooling on specific PROD MAIN customer environments are only available upon request, coordinated via service desk ticket.

Manual Penetration Testing

On a yearly basis the ClinSpark web application, supporting applications (such as SparkPlug), and certain infrastructure components are subjected to manual penetration testing, conducted by an external vendor. A summary of findings from the pentest vendor is produced and reviewed by the product team. Findings are summarized into four classifications that are aligned with the OWASP Risk Rating Methodology. We take review and action based on the classifications.

• Critical = Address immediately

• High = Address in the current functional release in development

• Medium = Prioritized into the next functional release

• Low = Reviewed and considered for a functional release.

Security Code Reviews - SDLC

Application enhancement tickets are categorized by security risk, and appropriate reviews are conducted as part of our SDLC process. Evidence of this is provided in the release Technical File.

Secure Coding Practices Best Practices

Application development engineers adhere to actively maintained best practices for secure coding. Details of our standards and our internal review process are available upon request.

Security Incident Response

Infrastructure has been configured to enable automated incident alerting and rapid tool-assisted investigation.

Security Incident Customer Notification Policy

In the event of a security breach, prompt corrective action is taken to cure any such deficiencies, and any action pertaining to such unauthorized PHI disclosure required by applicable laws and regulations. We will notify the customer within one business day of our becoming aware of the event.

AWS Hosting Infrastructure

All application instances are hosted within an IQVIA AWS account.

Infrastructure as Code

Infrastructure as Code is used for build-outs of PROD Main instances. This ensures that key configurations such as TLS levels, load balancer settings, patching configurations and other security-related configurations are applied in a repeatable and secure fashion.

Centralized Security Infrastructure Monitoring

AWS Security Hub is configured to monitor and alert upon a wide variety of infrastructure security aspects. AWS GuardDuty provides active AI-driven real-time intrusion detection. AWS Macie constantly monitors the environment for PHI leaks or unusual privileged activity in AWS CloudTrail, which audits all AWS user activity. AWS Detective provides tool-assisted investigation capabilities for rapid root-cause analysis of potential security issues.

Alerting is configured to internal communication tooling for real-time notifications of security events.

Logging

Application Logs are centrally stored in AWS CloudWatch. VPC Flow Logs are stored in S3 to support investigation of security incidents as required.

Standard Managed Web Application Firewall

Customer PROD Main instances are protected by the AWS Managed Ruleset provided by Fortinet and include the ‘Complete OWASP Top 10’ by default.

Automated Security Patching

All server instances receive regular and automated security and bug-fix patching. This is done using AWS Patch Manager.

Malware

The application is deployed to an Amazon Linux image provided by Amazon Web Services for use on Amazon Elastic Compute Cloud (Amazon EC2).

As these Linux images are hardened, continuously and automatically patched, unreachable without an SSH connection and protected by a firewall, no additional anti-malware measures are installed.

Application Development and Support Staff

User Workstations

User workstations are provided by IQVIA. These machines are fully managed and monitored and equipped with regularly updated anti-malware measures.

Periodic Review of Access Privileges

Support ('Superadmin') access to customer environments is reviewed and documented quarterly.

Engineering access to the hosting infrastructure is reviewed periodically by management.

Periodic Security Training

All staff is periodically trained on security policies including data handling, and security topics such as recognizing social engineering. Evidence is available for review upon request.

Corporate Network

Our core workgroup business systems are externally hosted SaaS applications, managed by the respective vendor. Our corporate network, mail and file services are provided by IQVIA, and require VPN access, or similarly secure managed access, when remote working.