- source code repository
- project management system
- flle shares
- distribution lists
- knowledge database
- development and test servers
- physical access to areas
Plus we make sure we aid our physical security with the right level of technology, such as proximity cards, CCTVs, fire and other environment sensors, and making sure all these are in sync with our projects, and customer requirements. EPAM has security setup templates to cover the various needs of our customers, and we are making sure that every time a project gets imitated, we apply the necessary template for aiding it by the infrastructure.
And of course you need to have large enough and powerful enough dedicated staff who audits our compliance to our security policies and procedures, beyond having regular external audits too from ISO27k or from SAS70 stand-point of view.
With outsourcing becoming very popular, has your strategic focus changed from previous years?
Yes it changed, via becoming popular, outsourcing made certain technologies and services a commodity, so to be on the edge and to be able to deliver value added services, we had to move our technology, process and services focus, and address subjects, such as:
- SLA based services
- Agile Processes
- Web 2.0
- Service Oriented Architecture
- Open Source Component Usage/Open Source Licensing issues
- IP Protection
- Security Concerns
Beyond just following the standard advice of formulating your security requirements and including them in your due-diligence questionnaire and in the contract, go beyond that. Include the possibility of auditing the security regularly at the provider’s premises, request IDS (Intruder Detection System) installation and have the logs of it sent to you regularly, require usage of source code scanning software to detect IP rights infringements and select your outsourcing destination based on your regulatory and compliance requirements, outsourcing to EU and inside NATO for example provides a much higher regulatory and security compliance then to outsource to India for example, this is one of the reasons EPAM follows a geo-diverse growth strategy to be able to serve our clients in jurisdictions/geographies, which best suit their needs.
And before starting the first engagement, go and look for yourself, do the first audit, everything looks perfect on PowerPoint.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.