Security

Experience/Certifications

• Certified Expert Penetration Tester
• GIAC Web Application Penetration Tester
• Certified Ethical Hacker (CEH)
• GIAC Cyber Security Essentials Certification
• Certified Information Systems Auditor
• PCI Internal Security Assessor (ISA)
• Certified Information Systems Security
• Professional (CISSP)

Facilities Overview

• Dual data centers – primary and alternative data centers, designed to withstand a F-4 weather event, building-within-a-building construction
• Power grids – different for each data center
• ISP connections – primary data center has 2 ISP connections, alternative data center has
• 1 ISP connection
• SOC2 Type II Certified – annual audits
• ensure continued vigilance

Physical Security

• Key card badge access system – "least privilege"
• All access is logged to badge system database
• Door sensors installed and tied to monitoring system
• Security camera surveillance 24x7 at all entrance/exit doors
• Log book maintained at all locations

Hosting Redundancy & Fault Tolerance

• Redundant Power Feeds to Systems – Network Infrastructure Redundancy
  • Switches
  • Routers
  • Load Balancers
• Server Redundancy
  • Disk, Network, Storage
  • Virtual Server Environment – Database Servers
  • Active / Passive Cluster – Web Environment
  • Web Servers Load Balanced

Disaster Recovery Preparedness

• Back Up Process
• Alternate Data Center Configuration – Defined Disaster Recovery Plan
• Defined RTO/RPO

Threat Protection Measures

• Intrusion Prevention and Firewalls
• DDoS Detection and Mitigation
• Vulnerability / Penetration Testing
• Encryption Services
• Log Management (SIEM)

Encryption

• Encrypted Transmissions – TLS
• IPsec VPNs
• Encrypted Data
• Encrypt files on back up media

Tips for tax preparers on security