Snare’s Commitment to Security
In light of recent malicious activities by foreign actors, we seek to ensure our Snare customers, partners, and prospects that we are are committed to providing the most secure platform we can based on the primary pillars of cybersecurity:
C. Confidentiality.
I. Integrity.
A. Availability.
Our customers must authenticate to get their software and license downloads – we do not issue software. The software is downloaded over encrypted channels after the customer has authenticated to the customer portal.
We harden the software stack for the Snare Agents and Snare Central software so they do what they need to and nothing else.
We do not use third party software such as .Net or Java in the agent software to minimize its footprint to potential vulnerabilities.
We contain our own micro web server in the agents that only does what it needs to do, as they don’t need a full stack web server.
We use separation of duties – The Security admin can control the agent and Snare Central policy, not the SysAdmin, to ensure that policies are set and logs are collected.
We watch the watcher – Snare Agents audit and log local user changes and activity to customers’ systems and the Snare software itself.
We have independent third party verification being Veracode Verified status for our Snare Windows Agent and Snare Agent Manager.
We mask sensitive data via the Snare reflector and our Snare Database Activity Monitoring (DAM) solutions to ensure that the logging system is not storing sensitive data when there are regional PII related compliance needs.
We provide over the wire encryption using TLS for web access, for sending logs, and mutual authentication options when both ends need to be validated to ensure that the log data is kept private on the network.
We provide destination failover using options like DNS updates to change the destination logs are being sent to.
We are committed to providing you the most secure platform possible. Share with us your ideas.
