Secure Code Training |
Workiva has mandatory security education training for anyone with access to Workiva systems. Training is required at the initial time of access and on an annual basis thereafter. Training includes policies, standards, confidentiality and privacy, physical security, system security, acceptable use, social engineering and other items. |
Quality Assurance |
Workiva's detailed change control process dictated by the Information Security Policy applies to all changes to the environment, including configuration, operating system, and application updates. New versions of Wdesk, or updates designated for release, are moved from the development environment and staged within a mirrored production environment where our Quality Assurance Team performs rigorous system, integration, regression, and acceptance testing. This environment is also where ongoing penetration testing and vulnerability scanning is performed.
Security is part of all phases of product development. Code pertaining to session management, access control, APIs that perform cross-platform calls, authentication, input validation, output encoding, secure transmission, audit logging, file uploads, XSS/CSRF protection, or encryption/hashing has security review either by the InfoSec team or developers trained and authorized in security review. Code changes and additions are tracked, reviewed, and approved by security production release. The Information Security Team utilizes OWASP Top 10 among other industry standards for secure coding.
Great care is taken during the design and prototyping phases of any feature set to identify architecture and implementation that may require security consideration. New feature sets requiring security consideration are subject to code review and approval prior to production release.
|