Security
Ibex employs a hardened security infrastructure built on globally recognized standards, ensuring robust enterprise-grade posture and resilience against evolving threats.
Endpoint Protection
- Centrally managed endpoints
- Patch management in place
- Anti malware and encryption is enforced on all laptops
Network & Cloud Security
- Ibex environment is hosted on AWS using a Virtual Private Cloud (VPC), utilizing its extensive security features and standards
- Traffic is filtered, monitored and blocked using web application firewall (WAF)
Encryption
- Data is encrypted both in transit (using TLS 1.2 or higher) and at rest (using AES-256)
- Encryption keys are protected and accessed by authorized personnel only
Governance & Compliance
- Formal policies and procedures are established to govern the necessary processes, ensuring compliance with security and privacy standards
- Policies and procedures are reviewed on an annual basis or when a material change has been made
Application Security
- Development is done based on SSDLC methodology
- Integrated security checks throughout the CI/CD pipeline
- Our code undergoes scanning using SAST (Static Application Security Testing) and SCA (Software Composition Analysis) tools
- Penetration tests are conducted on our code and application at least annually
Third-Party Risk Management (TPRM)
- Vendors undergo risk-based assessment to make sure proper security controls are in place when sensitive information (PII and PHI) are being transmitted and processed
- Vendors are reassessed on changed intervals according to their risk level
Operational Security
- A formal Business Continuity (BC), Disaster Recovery (DR), and Incident Response (IR) are in place, reviewed and tested at least annually
- Backups are performed regularly, and are tested on an ongoing basis
- Our cloud infrastructure leverages AWS, utilizing multiple regions and availability zones to ensure high availability and robust disaster recovery capabilities