Security Policy

Orbit is committed to the responsible management, use and protection of your personal data. Every process that we design is based on our foundational security principles.

Defense in Depth

We have implemented the Defense in Depth strategy by creating a multi-layered security approach. We strategically placed network firewalls, access controls, and encryption mechanisms at various points across our network and infrastructure. This ensured that even if one layer was breached, there were additional barriers to halt unauthorized access. The result was a comprehensive defense strategy that provided robust protection against a range of potential threats.

Continuous Monitoring

Through advanced monitoring tools, we have established a Continuous Monitoring process. We set up real-time tracking of network activities, system performance, and user behavior. Any unusual patterns or deviations triggered alerts, prompting immediate analysis. This proactive approach allowed us to swiftly identify and respond to emerging threats, thereby maintaining the integrity of our systems and data.

Security by Design

In our product development lifecycle, the company embraced Security by Design principles. During the design and building stages of systems and applications, we incorporated security considerations as a fundamental aspect. This involved conducting thorough threat modeling and risk assessments and integrating security controls from the outset. By adhering to this approach, the company ensured that its solutions were inherently resilient to potential exploits and vulnerabilities.

Risk Assessment and Management

Orbit has adopted a robust Risk Assessment and Management process. The company meticulously evaluated its assets, identified vulnerabilities, and assessed potential threats. By prioritizing risks based on their potential impact and likelihood, Orbit developed and implemented mitigation strategies. This approach allowed the company to proactively address vulnerabilities and dynamically adjust its security measures in response to evolving threat landscapes.

Encryption

Data security is paramount in our approach. Encryption measures stand as a stalwart safeguard, diligently shielding sensitive data during its journey and while at rest. Data at rest is encrypted using managed keys. This data is stored on entire Azure disks, storage accounts or managed databases. Data in transit uses TLS 1.2 minimum.

Authentication and Authorization

Through robust authentication mechanisms, we verify user identities with precision, allowing access only to authorized personnel. Simultaneously, our meticulous authorization controls create digital boundaries, ensuring that resources are accessible only to those with the appropriate permissions. All user access is managed through a centralized identity management tool and RBAC is utilized at each level.

User Awareness Training

Our employees have undergone comprehensive training, enhancing their awareness of potential security risks, best practices, and recognizing social engineering tactics. By equipping our team with this vital expertise, we bolster our collective ability to safeguard against evolving threats.

Access Control Policy

Our Access Control Policy defines a meticulous set of rules for the provision and oversight of access to systems, data, and resources. Aligned with distinct roles and responsibilities, this policy ensures that access is granted only to those with legitimate need, enhancing the integrity and confidentiality of our systems.

Data Classification Policy

Our Data Classification Policy establishes clear guidelines, meticulously categorizing data based on its sensitivity. By recognizing and addressing the unique requirements of various data, we institute measures to handle and protect each type appropriately. Critical data are stored in separate storage accounts.

Data Retention and Destruction Policy

Our Data Retention and Destruction Policy underscores our diligence in adhering to legal and regulatory mandates. Detailed guidelines are meticulously formulated, governing the retention, archiving, and secure disposal of data.

Utilizing DevSecOps

We’ve embraced the transformative approach of DevSecOps. This methodology seamlessly merges development, security, and operations, forging an integrated ecosystem where security is not an afterthought but an integral part of the entire lifecycle.

Patch Management

We adhere to a rigorous regimen of regular updates and patches. By promptly addressing known vulnerabilities, we ensure that our digital landscape remains fortified, safeguarding against potential threats.

Incident Response Policy

Our Incident Response Policy outlines a well-defined sequence of actions for security breaches—from initial detection, through notification and containment, to investigation and recovery—minimizing potential damage and restoring normal operations.

These principles and policies provide a strong foundation for building a comprehensive and effective security framework within our organization.