Security and Operational Procedures

·Security and Operational Procedures

·DigitalOcean follows a multitude of standardized procedures to maintain platform stability, including; but, not limited to, the following:

• ·Access and Authentication: Employee access to system information is protected by authentication and authorization mechanisms defined in detailed policies, which are audited annually. These policies also formalize the procedures and systems which facilitate the provisioning and deprovisioning of employee access (e.g. All access to sensitive systems must be approved by a direct supervisor or software owner).
• ·System Monitoring: Logging and monitoring tools analyze, identify, and report possible or actual security vulnerabilities or malicious activities on production hosts in real time. These tools are configured to alert the appropriate team once predefined thresholds are exceeded.
• ·Penetration Testing: Independent security professionals perform penetration tests at least annually basis to identify security vulnerabilities. These vulnerabilities are triaged by the security team and monitored through resolution as appropriate.
• ·Bug Bounty Program: DigitalOcean partners with Intigriti to maintain a paid bug bounty program, which provides a safe, structured method for security researchers to report potential issues to the security team.
• ·Encryption and Anti-Malware: Web communication sessions are encrypted and encrypted VPNs are used for remote access. Anti-malware software is installed on workstations to scan endpoints in real time.
• ·Incident Response: A dedicated security team manages incident response through a formalized process of identification, containment, remediation, and documentation.
• ·Change Management: DigitalOcean uses an automated deployment tool to support a continuous integration and deployment (CI/CD) model for managing infrastructure as code. A production pipeline is configured within the automated deployment tool for each added product or service. Once a pipeline build is created within the automated deployment tool, changes made within the software development platform undergo the configured steps included in the build. The ability to make changes to high-severity pipeline builds is restricted to authorized personnel and requires automated validation testing.
• ·Business Continuity: The engineering team meets weekly to review incident trends, post-incident reviews (PIR), and action items associated with PIRs. Action items consider the time to detect, severity, root cause, impact to availability, and customer impact of incidents. The team also conducts annual tabletop exercises to test disaster recovery plans.
• ·Media Destruction: Third-party vendors are contracted to destroy physical hardware at collocated data centers and provide certificates of destruction to evidence destruction services.
• ·Vendor Due Diligence: Security personnel perform due diligence on vendors by reviewing third-party compliance reports or requiring completed security questionnaires. Ongoing relationships are re-evaluated during the contract renewal process.