Security Practices: Shared Responsibility Document – TUNE

This document refers to the collaborative effort between TUNE and its customers to protect data and systems in SaaS environments. While TUNE is responsible for the security of the applications and the infrastructure that hosts them, customers share the responsibility of securing their application instance, including the data in it, user access, and other risks that may emerge with customizations.

The Shared Responsibility Model includes proper and thorough implementation of access controls (Permissions & Lockouts), robust authentication mechanisms (2FA & SSO), and data encryption (SSL on Custom Domains), as well as regularly monitoring their systems (Data Audit Logs) for anomalies. Both parties contribute to maintaining a secure and resilient environment by understanding and fulfilling their respective roles.

Key Focus Areas (Customer Responsibility):

We have divided the TUNE Customer's Share of responsibilities into eight primary areas essential to ensuring a safer customer environment. Some of these might not apply to each customer; however, these are generally the focus areas.

IAM (Identity & Access Management)

IAM (Identity and Access Management) is a framework that manages and controls user identities and access to system resources. It includes:

Policies, processes, and technologies for user provisioning, Authentication, access controls, and authorization.
Streamlines user lifecycle management and adheres to the principle of least privilege.
Enhances security, enforces compliance, and mitigates unauthorized access risks and data breaches.

Administrators can apply the framework to the following areas of the application:

When responsibly implemented in the mentioned sections, these guides can help you strengthen your User Permissions, Other parties' (Partners and Advertisers) access and visibility, and management.

Enhancing Authentication:

Enhancing Authentication focuses on bolstering the security of user authentication processes by implementing additional measures and mechanisms to verify users' identities. It aims to strengthen the safeguards against unauthorized access and mitigate the risks associated with compromised credentials.

Currently, within the TUNE's environment, you can use three features to improve this area of security:

Account Lockout Function: Enforcing Account Lockout policies to automatically lock user accounts after a specified number of unsuccessful login attempts, mitigating brute-force and password-guessing attacks.
Two-Factor Authentication: Implementing Two-Factor Authentication (2FA) adds an extra layer of security by requiring users to provide two forms of identification during login.
Single Sign On (SSO): (Available as an add-on) Utilizing Single Sign-On (SSO) to streamline user authentication across multiple systems, reducing the need for multiple login credentials and enhancing user convenience while maintaining security.

Safeguarding Domain Integrity:

Safeguarding Domain Integrity involves several vital measures to ensure the security and integrity of a domain's infrastructure:

Platform-wide Support Email: Setting up your network's support email system is crucial.
Custom SMTP Setting: Implement a custom SMTP (Simple Mail Transfer Protocol) configuration to integrate your mailing server with TUNE. This allows you to exercise more control over your DMARC Policy and mailing in general while allowing your team to use TUNE's bulk mailing features.
Platform-wide Custom Domains: These Use Custom Tracking/Application domains, where CNAME records point domains to TUNE securely. However, they emphasize the importance of SSL/TLS (Secure Sockets Layer/Transport Layer Security) certificates in these domains to establish encrypted communication channels and protect the data transmitted.

Protecting Sensitive Information:

Protecting Sensitive Information includes the four API Keys in TUNE, i.e., Integrator Key, Network Key, Advertiser Key, and Partner Key (mentioned in chronological order as per their priority and sensitivity). Sop involves:

Using the IP whitelisting feature in TUNE for the Network APIs is essential for the "Security First" approach.
Employing robust encryption techniques to protect the confidentiality of the API keys during storage and transmission.
Implementing secure critical management practices, such as access controls (Referred to in IAM with employee permissions), to restrict access to authorized personnel only.
Monitor and audit API key usage regularly to detect suspicious activities or unauthorized access attempts. Use the Data Audit Logs available under Company > Data Audit Logs. If you are running relatively more significant operations, you can also request that the support team provide you with the Data Audit Logs.
Employing secure coding practices to prevent API key exposure in source code or configuration files.
Implementing multi-factor authentication and role-based access controls to ensure that only authorized individuals can access and utilize the sensitive API keys.

By implementing these protective measures, organizations can mitigate the risk of API key compromise and uphold the confidentiality and integrity of their sensitive information.

Minimizing Fraudulent Traffic:

Minimizing fraudulent website traffic refers to implementing measures and strategies to reduce the influx of unauthorized, malicious, or non-human visitors to a website. The goal is to prevent fraudulent activities such as click fraud, bot traffic, spamming, and other deceptive practices and ensure the integrity and accuracy of website traffic data.

TUNE helps you fight Traffic Fraud in multiple ways:

Proactive Click Fraud Protection: Traffic Fraud Reports provide visibility into suspicious click traffic aggregated by partners, enabling you to monitor and address potentially fraudulent activities. The Time-to-Action report helps detect click injection and click spamming fraud by visualizing patterns in the time gap between conversions and corresponding clicks.
Advertiser Security Token: Secure against postback fraud with advertiser security tokens for Authentication, encrypted conversion tracking to mask offer IDs, and IP whitelisting to restrict postbacks from unauthorized sources.
Offer Whitelist
Encrypt Conversion Tracking URLs: TUNE's comprehensive fraud prevention features help you minimize fraudulent traffic, protect your partner program, and maintain clean, compliant traffic.

SPAM Protection:

Spam protection refers to implementing measures and technologies to prevent the influx of unsolicited, unwanted, or malicious messages, often sent in bulk, to protect users and systems from potential harm.

TUNE helps you in implementing SPAM protection (on the sign-up pages) in 2 separate ways:

Captcha on Sign up: Spam protection on a sign-up page using CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) involves implementing mechanisms to prevent automated spam submissions and ensure genuine user registrations.
Fake Leads Protection powered by E-Hawk: TUNE offers automated applicant validation and scoring to reject high-risk applicants before they become partners, minimizing fraudulent profiles in your platform.

Fortifying Custom Code:

TUNE allows you to add custom code in multiple places across the applications, which means that the developers who write the code are responsible for secure and ethical code.
Currently, TUNE does not provide tools to ensure 100% safety on this front.

Privacy Policy:

A Privacy Policy is a legal document that outlines how an organization collects, uses, discloses, and protects personal information gathered from individuals. It explains the types of data collected, the purpose of data processing, the rights of individuals over their data, and the measures in place to ensure data security. Privacy Policies typically cover data retention, data sharing with third parties, cookies, analytics, and user consent. They inform users about their privacy rights and provide transparency on how the organization handles their personal information.

We help our clients implement their policies on our platform and, if necessary, assist them in tracking related aspects, such as Customizing Network Terms and Conditions, the Email Suppression List, and IP Address Obfuscation.

Further Information on Add-on features:

Integrator API: The integrator API is an add-on feature used to integrate certain parts of the TUNE (e.g., reporting, stats) to a 3rd party system without hard coding the API Keys into the system. This portion of the document will explain some of the security responsibilities that are inherited when customers opt to use this feature:

Access Control: Ensure the "least privilege" principle is followed while allowing the controllers and methods to the integrator API.
Credentials Management: Ensure that the Auth0 credentials are stored securely and that access is limited.
Secure Transmission: Ensure that the integrator API's request and Tokens are always encrypted in transit to prevent MITM attacks.
Rate Limiting: To ensure integrator APIs' security, TUNE uses Rate limiting and Short-lived tokens.

Firehose

Firehose is an add-on primarily used for sending Event and Adjustment data from TUNE directly to the customer's AWS (Amazon Web Services) Account, reducing the latency of high and redundant segregation for consumers with relatively high traffic. Security Responsibilities on TUNE client for this piece of add-on are:

Secure Coding: Ensuring that secure coding is implemented.

AWS Best Practices: Customers should consider and follow AWS's Security Best Practices guide for their services. Some of the most common services used in conjunction with Firehose are: