NetSuite application and operation security exists to prevent unauthorised network and service connections. It is able to distinguish between these and customer connections to ensure access to NetSuite is legitimate and safe. It starts with robust encryption, strong password policies and role-based access controls. Additional layers include:
- Multifactor and end-user authentication
- Token-based application authentication
NetSuite benefits from 24/7 monitoring from a dedicated, tenured security team. These people use the most advanced tools, control and policies for maximum operational data centre security. You can trust Oracle NetSuite to deliver the certifications, tools and advice to meet your regulatory and compliance challenges.
Below, we’ll take a look and some of the main security features of NetSuite
Role-based Access
All end users can be assigned designated roles with specific permissions to ensure they can only access the data and features they need for their jobs. This goes right down to the field level. There will always be a complete audit trail for every transaction based on user login details, with accurate timestamps for every single change.
Encryption
All transmissions of user details and exchanged data are subject to industry-standard encryption protocols and cipher suites. NetSuite facilitates custom attribute encryption and has encryption APIs. Token-based authentication of applications is applied alongside multi-factor end-user authentication.
Multi-factor authentication (MFA)
As mentioned, MFA plays a key role in securing user access to NetSuite. This means a username and password as well as configuring roles with an additional protective step wherein a verification code is sent out. This can be obtained from an authenticator app or via a message sent to a mobile phone.
Passwords
Granular password configurations are applied, such as defining minimum password length or implementing a policy of password expiration. Users can establish strict rules to ensure old passwords cannot be re-used and require them to be complex combinations of letters, numbers and special characters. After several unsuccessful attempts, an account will be automatically locked out.
Separation of duties
To supplement mandatory employee background checks at every level of the organisation, NetSuite follows the Principle of Least Authority. This means employees only receive the privileges they need to do their jobs.
Continuous monitoring
NetSuite makes use of both server- and network-based Intrusion Detection Systems (IDS). These will identify any malicious traffic that attempts to gain access to its systems. Detailed logs and security alerts will be immediately sent to a system for security information and event management to monitor the situation and facilitate a response, where necessary, by an experienced security team.
The dedicated security team
NetSuite has an international security team with the purpose of monitoring alerts, enforcing security policies and investigating system behavior that is identified as anomalous. This includes unauthorised attempts to connect and malware. Monitoring is close to real-time and operates 24/7 with the capability to respond anywhere in the world. The security team reviews and approves all access to production systems.
Performance audits
NetSuite uses auditing controls that are suitable for SOC 1 Type II, SOC 2 Type II, PCI and ISO 27001 compliance. A robust risk management procedure is employed, modeled on the ISO 27000 series of standards and the National Institute of Standards and Technology’s special publication 800-30.
With periodic audits, the following things consistently meet or exceed industry standards:
- Personnel performance
- Equipment serviceability
- Procedural compliance
- Updated authorisation records
- Key inventory rounds
Privacy certifications
Oracle NetSuite undertakes reviews and annual audits. It also conducts privacy risk management and oversees a range of other privacy-related things.
- It has extended ISO 27001 to include the ISO 27018 control set for maximum protection of personal information as a Public Cloud Hosting Provider.
- Adherence to the EU Cloud Code of Conduct is verified and published in accordance with the monitoring body’s general requirements for cloud service providers to meet GDPR guarantees.
- Oracle Corporate has EU/EEA-wide authorisation from relevant data protection authorities for its Binding Corporate Rules for Processors. This enables customers to meet their own privacy and security requirements.
Security certifications
Oracle NetSuite completes regular SOC 1 Type II and SOC 2 Type II audits and issues regular reports. It has certification for ISO 27001:2013 and PCI DSS.
- NetSuite has a defined information security management system complying with ISO 27000 and NIST 800-53 standards.
- All SOC 1 Type II and SOC 2 Type II audits are carried out by independent third-party auditors. These audits meet the reporting regulations of Section 404 of Sarbanes-Oxley and report on controls relating to security and availability in services organisations.
- The PCI DSS ensures companies store, process and transmit payment card information with maximum security.
The bottom line
With a robust, comprehensive list of security features and processes, you will not find a more secure solution than NetSuite when it comes to customer data. Not only is NetSuite incredibly secure, it also boasts near perfect up-time.
With enterprise-grade redundant infrastructure and proven processes, the uptime averages 99.96% in recent years. This is backed by a strong Service Level Commitment. The availability of NetSuite is maximised via its multiple geographically separate data centres which employ data replication and disaster recovery protocols to ensure NetSuite remains available at all times.
Oracle NetSuite spares no expense and cuts no corners in terms of offering unparalleled security and consistent up-time. Feel free to explore the reports and audits relating to security and privacy practices over the years and review the company’s 99.7% Service Level Commitment for proof of their outstanding efforts to provide the best possible service for customers.
Why choose Eventura to deliver your NetSuite Project?
As an official NetSuite partner, we have successfully delivered countless NetSuite implementations. Our expert team of business analysts, developers, consultants, technicians and support staff can guide you through your entire project, from initial scoping through to implementation and on-going support.
If you would like to speak to one of our NetSuite experts, you can request a free call back here.
