Linuxoft Logo

Security Policy

The Foundation of Reliability: Linuxoft's Security Framework

As a provider of Managed DevOps and Observability services, security, confidentiality, and integrity (the CIA triad) are our highest priorities. Our security policies are integrated into every stage of the software and service lifecycle (Security by Design).

Scope and Governance

  • Scope: This policy applies to all Linuxoft personnel, contractors, client data, and all infrastructure we manage (AWS, GCP, Azure, Argus).

  • Standards: Our security policies and practices are guided by industry best practices and control frameworks (e.g., principles derived from ISO 27001 and NIST).

Key Security Measures

1. Data Protection & Encryption

  • All data transmitted between Linuxoft, the client, and third-party systems is secured using SSL/TLS encryption.
  • Client data stored within our managed systems is protected by encryption at rest.
  • Argus Data: Data accessed via the client-server Argus installation is treated with the highest security. Access is strictly limited to the technical personnel required for service delivery.

2. Access Control

  • Principle of Least Privilege (PoLP): Access to all client environments (Cloud, systems, Argus data) is restricted to the minimum permissions necessary for personnel to perform their duties.
  • Mandatory use of Multi-Factor Authentication (MFA) for all Linuxoft internal systems and client access credentials.
  • Regular review and auditing of access permissions.

3. Infrastructure & Cloud Security

  • We leverage the native security features, compliance tools, and monitoring capabilities provided by AWS, GCP, and Microsoft Azure.
  • Infrastructure deployments utilize Infrastructure-as-Code (IaC) templates to enforce secure, repeatable, and consistent configuration management.
  • Dedicated network segmentation and firewall rules are implemented for all managed environments.

4. Vulnerability & Incident Management

  • Systems are subject to regular patching, security updates, and vulnerability scanning.
  • We maintain a defined Incident Response Plan with clear protocols for detection, containment, investigation, and client notification in the event of a security breach.

Employee Security Awareness

All Linuxoft personnel are required to complete mandatory, regular security awareness training covering best practices for data handling, phishing prevention, and system access procedures.