CloudSuite Industrial Cloud Security Architecture

Identity and Access Management Security

0 SSO, OAuth2 API authentication, and role-based access control (RBAC) that spans the Infor OS platform and CloudSuite applications. The security model enforces least-privilege access through CSI's form-level and field-level security configuration, where administrators grant permissions to named security groups that map to IFS roles. AC (Identity Management and Access Control) and CIS Control 6 (Access Control Management).

• SAML 2.0 SSO integration with corporate IdP enforcing centralized authentication policies and MFA requirements (NIST PR.AC-1)
• OAuth2 client credentials for API access with scoped tokens limiting external system permissions (NIST PR.AC-7)
• CSI form-level security restricts access to specific forms and functions based on named security groups (CIS Control 6.8)
• Field-level security hides sensitive data elements (cost, margin, salary) from unauthorized users within accessible forms
• Quarterly access certification reviews supported by Infor OS audit reports for compliance with SOX Section 404

Data Protection and Encryption

CSI implements encryption at rest and in transit across all data layers. Data at rest in RDS databases and S3 storage is encrypted using AES-256 with AWS KMS-managed keys (or customer-managed keys in ST deployments). 2+ for all API communications, inter-service traffic, and database connections.

Backup encryption ensures data protection extends to disaster recovery copies. DS (Data Security) and CIS Control 3 (Data Protection).

• AES-256 encryption at rest for all RDS database volumes, S3 object storage, and EBS volumes (NIST PR.DS-1)
• TLS 1.2+ enforced on all HTTPS endpoints including ION API Gateway, IFS authentication, and inter-service traffic (NIST PR.DS-2)
• AWS KMS key management with automatic key rotation every 365 days for data encryption keys (CIS Control 3.11)
• Customer-managed encryption keys (CMK) available in single-tenant deployments for organizations requiring key custody
• Encrypted database backups with point-in-time recovery capability and cross-region replication for DR compliance

Network Security and Threat Detection

CSI's network security uses AWS VPC isolation with security groups, network ACLs, and AWS WAF rules protecting the application perimeter. Infor's Security Operations Center (SOC) monitors all CloudSuite environments 24/7 using AWS GuardDuty for threat detection, CloudTrail for API audit logging, and custom SIEM integration for security event correlation. DDoS protection is provided by AWS Shield Advanced on all CloudSuite endpoints.

CM (Security Continuous Monitoring).

• AWS VPC isolation with security groups restricting inbound traffic to HTTPS (443) and VPN (IPSec) ports only (CIS Control 12.2)
• AWS WAF rules on CloudSuite ALBs protecting against OWASP Top 10 including SQL injection and XSS (NIST PR.PT-3)
• AWS GuardDuty continuous threat detection with automated alerting to Infor SOC for suspicious API calls and network activity
• CloudTrail API logging capturing all management and data events for forensic analysis and compliance audit trails (NIST DE.CM-1)
• AWS Shield Advanced DDoS protection with automatic traffic scrubbing and Infor SOC escalation for volumetric attacks