Gladstone Cloud Platform Security and Operational Resilience FAQ

Problem

Users, IT staff, and compliance teams often have questions regarding the security controls, monitoring, authentication options, and operational resilience features of the Gladstone Cloud platform. This article addresses frequently asked questions on these topics, including penetration testing, platform monitoring, authentication methods (MFA/SSO), uptime objectives, disaster recovery targets, and security protections.

Resolution

  1. Penetration Testing

    • Gladstone performs regular penetration testing against the platform.
    • Continuous penetration testing is being introduced for faster response to new CVEs.
    • Testing is completed at least annually. Results are available on request.

  2. Platform Monitoring

    • The platform is actively monitored in partnership with multiple providers.
    • AI-driven monitoring is used to detect suspicious activities.
    • Gladstone is a member of the Cyber Security Council for up-to-date best practices.
    • Details of specific monitoring providers can be provided on request.

  3. Architecture Documentation

    • Internal infrastructure is fully documented but not shared externally due to sensitivity.
    • Basic network diagrams with general traffic flow are available on request.

  4. Protection Against Cyber Attacks

    • Continuous security testing is conducted during development and on live infrastructure.
    • Gladstone and Cloudflare provide enhanced protection, including:
      • DDoS protection
      • Bot management
      • End-to-end encryption
    • By default, external traffic from outside the UK is blocked. Customers can request exceptions.
    • A dedicated Cyber Security Manager oversees security patches and threat monitoring.

  5. Multi-Factor Authentication (MFA/2FA)

    • MFA/2FA is available for Plus2 deployments.
    • Customers manage the secondary authentication method (e.g., phone or email).
    • MFA/2FA for GladstoneGo and 360 is in development.
    • MFA/2FA is opt-in, but will become opt-out.
    • Contact the Gladstone sales team to enable MFA/2FA.

  6. Single Sign-On (SSO)

    • SSO is available for GladstoneGo, Gladstone360, and Gladstone Reports.
    • Contact the Gladstone sales team for further information.

  7. Gladstone Staff Access

    • The least-privileged access model is followed.
    • Only a limited number of staff, mainly within the Infrastructure team, have data access.

  8. Platform Scalability

    • The platform is monitored for performance and security.
    • Automation enables dynamic scaling to meet demand.
    • Hosted in Azure, allowing rapid resource scaling.

  9. Performance Management

    • Platform and database performance is managed by Gladstone.
    • Customers do not need to manage local SQL servers or infrastructure updates.
    • AI-driven optimisation is used for continuous database tuning.
    • Manual and specialist tuning available when needed.

  10. High Availability

    • The platform is designed for high availability across three availability zones.

  11. Uptime SLA

    • 99.9% uptime objective, measured over a rolling 90-day period.
    • Platform status is available on a public status page.
    • Customers can subscribe to notifications and RCA updates.

  12. Disaster Recovery (RTO/RPO)

    • Disaster recovery exercises are performed at least every six months.
    • Detailed recovery time objective (RTO) and recovery point objective (RPO) values are not published in this public FAQ. Contact Gladstone for the most current disaster recovery information.

  13. TLS Versions Supported

    • TLS 1.2 and above are supported.
    • Over 90% of traffic is upgraded to TLS 1.3 where possible.

  14. Web Application Firewall (WAF)

    • A WAF is in place as part of Gladstone’s layered security.
    • Default rules help protect environments and data.

  15. Whitelisting

    • The 360 platform is whitelisted by default.
    • Geo-whitelisting restricts non-UK traffic by default. Adjustments can be requested.

  16. Password Policies

    • Expiry settings are configurable and can be as strict as needed.
    • Highest security mode is enabled by default.
    • Customers can configure expiry periods and force changes.
    • Retaining the default policy is recommended.

  17. Cookie Usage

    • No third-party tracking cookies are used by default.
    • Additional cookies may be used only for custom deployments.
    • Default cookies:
      • __AntiXsrfToken: Prevents cross-site scripting (signature products)
      • ApplicationCulture: Stores language and culture preferences (Connect)
      • ASP.NET_SessionId: Secures ASP.NET sessions (signature products)
      • INGRESSCOOKIE: Used for load balancing (Go application suite)
      • AspNetCore.Antiforgery: Used for authentication in the Go application suite

Notes

This page as markdown · All pages · llms.txt