---
title: IRIS+™ Security Overview
slug: iris-plus-documentation/iristm-security-overview
docTags: 
createdAt: 2024-08-20T13:59:25.487Z
---

Cybersecurity is a field dedicated to protecting systems, networks, and data from digital attacks, damage, or unauthorized access. Here’s a broad overview of the key concepts and components involved in protecting IRIS+™ application and system:

![](https://api.archbee.com/api/optimize/0qwUIPTrS6-vWLcHFHOFA-x1YDc0qoYPpUBjdooXixl-20240820-145446.png)

## IRIS+™ Endpoints

### Secured Endpoints

- All endpoint communication based on HTTPS / WSS
- Certificate issued by a well-known CA (LetsEncrypt)

### Data Encryption

- Data transfer from/to the IRIS+™ Core is encrypted (TLS 1.3)
- Sensitive configuration data is encrypted (SHA-256)

### Data Validation

- Input data is serialized to well-known structured types
- Input data validation to avoid injections



## IRIS+™ Cluster Security

### Isolated Containers

- Each service in the system is packed as an isolated container image hosted by the orchestrator (Kubernetes)

### Namespaces

- Services in the cluster run as pods in different namespaces to comply with multi-tier application architecture:

                1\. App – all stateless services processing data in memory

                2\. Data – all stateful services holding data (DB, Messaging, Streaming)

- Kubernetes provides internal DNS and firewall rules to restrict communication across namespaces

### Nodes Tagging

- Nodes are tagged according to the logical namespace to ensure nodes are assigned to a specific namespace
- Customers may restrict traffic across nodes (physical/virtual) using an external firewall

## IRIS+™ Application Security

### Authentication

- Every IRIS+™ user is authenticated using a login/password
- Users can enable TOTP-based second-factor
- Password must comply with a strict password policy

### Authorization (RBAC)

- Users are authorized to use their roles to access and perform actions on the data

### Access Restriction

- Access to the system requires a valid API Key (to identify the system) and Access Token (to identify the user/service account) with specific access to resources 

### Session Timeout

- Sessions (identified by Access Token) are restricted to 20 minutes of Idle time

### Audit Log

- Any user/service account action is logged in the audit log and kept for 24 months.



## IRIS+™ Edge Security

### Isolated Containers

- Each service running in the edge is packed as an isolated container image hosted by the orchestrator (Kubernetes) or Docker CE engine

### Host Machine Hardening

- The host OS runs the minimal set of daemons required to run Kubernetes or Docker CE
- Access to the network configuration page is protected by Edge Credentials
- Access to the device configuration page is protected by the registered IRIS+™ user credentials

### ISO Certifications

[ISO/IEC 27001:2022](https://uk.connect.amtivo.com/cert/amtivocert10002.asp?c=269255\&v=v117v14dsn\&e=23701)

::Image[]{src="https://app.archbee.com/api/optimize/JzHznijrWxPLJLDUaV5A1/-RgdJ4j8pLeIRQIdD-8rw_27001-cmyk-black.jpg" size="18" width="1890" height="1890" position="flex-start" darkWidth="1890" darkHeight="1890" showCaption="false"}

[ISO 9001:2015](https://uk.connect.amtivo.com/cert/amtivocert10002.asp?c=268640\&v=hvn9kd3497\&e=23702)

::Image[]{src="https://app.archbee.com/api/optimize/JzHznijrWxPLJLDUaV5A1/lK8Ihl-bn-MxgvUjvXt3B_9001-cmyk-black.jpg" size="18" width="1890" height="1890" position="flex-start" darkWidth="1890" darkHeight="1890" showCaption="false"}

**For more information please contact Irisity customer support**


***For enterprise solutions***
E-mail [technicalsupport@irisity.com](mailto\:technicalsupport@irisity.com)
Phone: Not supported

***For central monitoring services***
Email: [support@irisity.com](https://support@irisity.com)
Phone: +46 771 41 11 00