SDLC
Security is integral to Ziflow’s software development life cycle (SDLC). As part of that process, Ziflow incorporates threat modeling, attack surface analysis, security architecture analysis and continuous security training for its teams.

Encryption at rest
The Open Web Application Security Project (OWASP) is an online community that creates freely available articles, methodologies, documentation, tools, and technologies in the fields of web application security. It was started in 2001 as a nonprofit organization and since its foundation has contributed a wide range of publications. Ziflow has embraced the OWASP top 10 recommendations. Ziflow performs internal and third-party penetration testing on its products with an emphasis on OWASP top 10 security risks, and leverages code scanning to ensure Ziflow products are secure from known vulnerabilities.

Vulnerability management
Vulnerabilities are identified and classified based on our evaluation of their risk & impact on the confidentiality, integrity, and availability of the service and of customer data. The engineering team remediates identified vulnerabilities within predefined targets based on our Patch & Change Management Policies.

Penetration testing
Application penetration testing is performed at least quarterly by an independent third party, which include manual and automatic testing methods. In addition, our team regularly performs security audits and penetration testing for various features which require deep understanding of our internal security mechanisms and architecture. As part of our external and internal penetration testing, network scanning tools are also used against our production servers.