ISO Certifications - Information Security
UCi2i have developed and implemented an ISO27001:2013 Information Security Management System (ISMS) environment to ensure that the provision of all services to its clients is provided under the specific control of a dynamic management system for the effective and continual provision of information security.
This is a globally recognised standards certification. The Technical Director and Senior Management Team are committed to the implementation and ongoing management and maintenance of the ISMS in order to ensure and support the key objectives of the business of:
- Maintaining continued provision of services to clients in accordance with contractual requirements and identified performance indicators
- The secure storage, protection and access of all UCi2i data including that data stored in respect of clients
- Provision and maintenance of a secure and safe working environment for all UCi2i operations and activities
- Risk Minimised Supply Chain
- Continual improvement of the ISMS controls
The management and maintenance of our System Security Policy is undertaken to mitigate ongoing risk and is supported by the operational reviews and appraisals of conformance, evaluation or overall compliance and the process of continual improvement undertaken by the business in respect of maintaining its requirement of operating specific and appropriate information security management in accordance with ISO 27001.
Policies and procedures are put in place to ensure the protection of all information being received by external systems. In doing so, we make no assumptions as to the quality of security used by any third party but always request confirmation of levels of security maintained by those third parties. Where levels of security are found to be inadequate, alternative ways of sending data is used.
Our current certificate can be viewed by clicking the attachment at the bottom of this article.
Video encryption methodologies used
The backplane (the link between the Management Node and a Conferencing Node, or between two Conferencing Nodes) uses an IPsec transport with the following settings:
- 256-bit AES-CBC for encryption
- SHA 512 hashing for integrity checking
- A 4096 bit Diffie-Hellman modulus for key exchange.
No other ciphers, hashes or moduli are permitted.
These settings apply to both the initial channel set up for key exchange (ISAKMP) and the secondary channel over which application data is transported (ESP).
Encrypted connections between UCi2i Video Cloud and endpoints use:
- AES 128-bit encryption for media
- TLS for SIP call control
- SRTP for SIP media
- H.235 for H.323 media
VC-Connect (web/desktop/mobile) clients use:
- HTTPS TLS for signalling
- DTLS and SRTMP (encrypted RTMP) for media