1. Security & Architecture
NetSuite’s
Security & Architecture
Kevin Brown
© Copyright NetSuite Inc., All Rights Reserved.

2. Security and Architecture
Introduction
Security
Confidentiality
Integrity
Availability
SLC (Service Level Commitment)
Architecture
Compliance
FAQ’s

3. Security

4. Security: Confidentiality
Internet Firewalls
Block unauthorized attempts to access our data center.
Port scans are run regularly to identify any vulnerabilities within our network.
128-bit secure socket layer data encryption
All data passed back and forth is encrypted
Application-only Access
System divided into layers that separate data from the application. Login gives access to the application layer…prevents malicious altering of data
Role Level Access, Idle Disconnect and Account Lockout
User has roles with access restrictions related to their job
Detects idle connections and locks IE Window
Two-Factor Authentication (Strong Authentication)
Scheduled for phased release (9/07 – 11/07)
One-time key entered to log into NetSuite
IP Address Restriction Avail

5. Security: Integrity Data Integrity
We will not view or access records without the customer’s permission
We do not store passwords (sha-256 encrypted version of password, so we have no access to your password)
Passwords can now managed in the application
Two Phase commit and our structure ensures Integrity
Use Oracle DB capabilities (two phase commit) to ensure transactional integrity
A completed transaction is put on two individual sets of RAID array (double redundancy)
Redundant Array of Inexpensive Drives provides for increased data reliability
What does all of this mean?
When a transaction is submitted, if the page returns, the data is there

6. Security: Availability
Back-Up
Nightly tape back-ups
Remote archives of tape
Hot Back-ups
Disaster Recovery
Currently we leverage Level(3)’s disaster recovery program and facilities
Data restored from tape
Redundancy
Power
Hardware
Internet (We’ve got a back up!)
Talk to upgraded DR avail

7. SLC Service Level Commitment (SLC) / Uptime
99.5% target uptime for each month
First company to guarantee uptime
Wait…We are the only company to guarantee uptime (at least in our market)
Scheduled Maintenance Windows
5 hour period every Friday and Saturday starting at 10 p.m. Pacific Time
Where possible targeted to local time
URL for NetSuite monitoring

8. Architecture

9. Architecture Three-tier architecture Fault-tolerant session fail over
the data delivery layer
the application layer
the database layer
Fault-tolerant session fail over
if one server fails, your connection is seamlessly handed over to another server
Redundancy
Power
Hardware
Internet (we’ve got a back up)
This level of Architecture means security!

10. Architecture Continued

11. Performance / Storage Performance High Performance/Usage companies
Load-Balancing
ability to shift connections among servers to spread the load evenly
Internet connection
to the two major Internet backbone providers
ensures that there are no data transmission bottlenecks to our data center
High Performance/Usage companies
Minimum GAAP and a fee for the server
Numbers below are guidelines…check Sales Tools for details
Tier Three
GAAP $40,000 Server Fee $40,000 annually
Tier Two
GAAP $150,000 Server Fee $75,000 annually
Tier One
GAAP $225,000 Server Fee $100,000 annually
Current Customers 10,000 transactions a day
They do not own the hardware
Does not ensure better application performance
Still share application server (DB may respond better)
Does provide more control

12. Compliance

13. Compliance: SAS 70 SAS 70 Report NDA required to release report
Type II report (vs. Type I report)
Type II more detailed / thorough
Results:
No Material Exceptions were noted
Areas Audited
Systems Development and Change Management
System Data Back up Procedures
Logical Security
Physical Security
Environmental Security

14. Compliance: PCI PCI Compliant (Payment Card Industry)
Our Report on Compliance was accepted by both Ambiron TrustWave (highly respected PCI auditing service) and Visa
Encrypted Credit Card View
Users (except Administrator and Full Access) will not see unmasked credit card numbers except when entering a new Card
Password requirements
Certain Roles must change password every 90 days
Seven (7) characters
Sign release to be able to see un-encrypted cards
To verify certification see Visa website

15. FAQ’s
Who owns the data?
The customer, they can export it through CSV (individual reports and full csv export), Web Services and ODBC.
What happens if my ISP goes down?
Call us and we’ll provide dial up instructions to reach our service (temporary solution).
How Scalable is NS?
We use load balancers to keep load consistent across the farm. We maintain the farm such that peak usage is within our acceptable range. The acceptable range is low enough to accommodate surges and spikes without performance degradation
We also use our application so the appropriate level of management on the operations side can get visibility into future demand, therefore we have machines configured and ready to go before we need them.
How often do we back up the data
Nightly
Where are the tapes stored
The Tapes are archived at a remote location over 100 miles from the data center.
Are Audit trails available?
Yes, Login Audit trail and a Transaction Audit Trail.