About the Client
Spiral Technology is a Boston-based leader in augmented reality for industrial inspections. Their forward-thinking platform integrates augmented reality to optimize inspection processes. Committed to top-tier security and compliance, Spiral Technology partnered with Gart for expert guidance in ISO 27001 audits and cloud infrastructure design.
Challenge
Spiral Technology, an augmented reality platform for industrial inspections, faced the critical challenge of preparing for ISO 27001 audits while concurrently launching a product for a significant customer. The complexity of aligning DevOps tasks, ensuring compliance, and migrating cloud infrastructure needed outside expertise.
Solution
Spiral Technology found Gart through an online search. A team of 2 engineers closed more than 55 open ISO 27001 compliance tasks, reviewed the DevOps setup and migrated the platform from Google Cloud Platform (GCP) to Azure with Terraform and automation tools.
The 55 pending ISO 27001 compliance tasks were categorized into three levels: Infrastructure and Cloud Security, Personal Security, and Code Security.
Cloud Security
In cloud security, the initial assessment of the Google Cloud Platform (GCP) revealed open configurations. Gart’s experts configured security groups and firewalls to restrict public access to services. Single Sign-On (SSO) through Google Workspace centralized access control and enforced Multi-Factor Authentication (MFA) for all GCP access.
The client’s code repository, hosted on GitLab, underwent similar enhancements. MFA was enforced, and access levels were configured based on roles, distinguishing between developers and administrators.
Infrastructure Security
Addressing infrastructure security, data encryption was implemented, securing the database. External access to all application endpoints was restricted, permitting entry only through a virtual private network (VPN). Database backups were set up, and a Backup and Disaster Recovery plan was written and tested, with failure scenarios, response steps and a 40-minute recovery SLA.
Personal Security
ISO 27001 places a strong emphasis on personal security. A centralized system was established to manage and control devices used in development. A curated list of approved software for development was created, ensuring adherence to security standards.
Code Security
For code security, GitLab access was limited to the people who need it, branch protection was enforced, and Dynamic Application Security Testing (DAST) and vulnerability scans were added to the pipeline.
