Visual Cadence – Security & Privacy 2017-12-15T16:08:36+00:00

Visual Cadence Security & Privacy

Visual Cadence is a cloud first managed service built on Azure’s Platform as a Service (PaaS) infrastructure. Security by design is a core principle throughout the entire software delivery process. The following security and privacy sections detail the steps we take to secure and respect your data.

Service Security

Visual Studio Team Services Extension
The VSTS extension will allow a VSTS administrator to provide the necessary information for Visual Cadence to provision account specific cloud infrastructure and extract and process data. This will also give the administrator control over where your data can be accessed.

The administrator will need to provide:

  • Personal Access Token (PAT) for access to VSTS APIs

  • Username and password to create read only user for reporting database

  • Azure SQL Inbound Firewall IP Range

Communication from the VSTS extension to Visual Cadence services in Azure is secured to only allow communication from the VSTS extension and no third-party calls.

Data Collector and Data Processor

Azure Functions

Visual Cadence takes advantage of Azure Functions to monitor, collect, and process data. The free and basic tiers share multi-tenant infrastructure for the functions that make up the core service. Each execution of a function runs in its own isolated process to extract or transform data and no data is permanently stored in the function execution environment.

Azure Storage Accounts

All Azure Storage Accounts are configured to use Storage Service Encryption to encrypt data at rest and require secure transfer.
The free and basic tiers share multi-tenant storage to house core service data in tables and queues.

Azure Table Storage

Visual Cadence uses Azure tables to store required data to run the service which includes some customer metadata.
Example customer specific information currently required to run the service includes:

  • Account Name: Visual Studio Team Services account name (GUID and Name)

  • Team Project: Each team project in the give account (GUID and Name)

  • Data Collector metadata: Execution timestamps, watermarks, etc.

  • Data Processor metadata: Execution timestamps

Azure Queue Storage

The data collectors and data processors are triggered off Azure Queues so some customer metadata needs to flow between functions. No information deemed as sensitive is ever passed through queues.

Example customer specific information in queues includes:

  • Account Name: Visual Studio Team Services account name (GUID and Name)

  • Team Project: Each team project in the give account (GUID and Name)

  • Data Collector metadata: Watermarks, continuation tokens, etc.

  • Data Processor metadata: Blob paths which correlate back to account, team project, and data collector

Azure Blob Storage

Blob storage houses the raw VSTS data extracted by the Data Collector before it is transformed by the Data Processor and inserted into an Azure SQL Database.

All tiers of the service use an isolated storage account per VSTS account.

Azure SQL Database

The Azure SQL Database is the result of the extraction and transformation processes. It houses VSTS DevOps data in a reportable schema and is updated incrementally by Visual Cadence.

All tiers of the service use an isolated Azure SQL Database per VSTS account. The free and basic tiers are deployed in an Azure SQL Elastic Pool which shares overall compute resources.

Network connectivity to the Azure SQL Database is restricted by inbound firewall rules which only allow traffic from Azure services including Visual Cadence and Power BI, and customer provided IP ranges.

Each Azure SQL Database will have Transparent Data Encryption enabled, which performs real-time encryption and decryption of the database, associated backups, and transaction log files at rest.

Azure Key Vault

Azure Key Vault houses the keys and secrets used by Visual Cadence. Key Vault Managed Storage Accounts automatically rotate access keys and utilize time-limited Shared Access Signatures (SAS) for all access to account storage accounts.

For more information about Key Vault, see “What is Key Vault?”.

Restricted Access to Production Environment

All changes to production environments go through auditable processes. New code is only deployed by an automated release pipeline within VSTS. All code changes go through code review processes and approvals to reach production environments.

The production Azure resources are locked down and only accessed on an as needed basis to diagnose an issue or maintain the service. Users are granted least required privilege access to production environments and must authenticate using multi-factor authentication with a dedicated admin account. Any production changes are logged using Azure’s built in audit logging.

Data Privacy

Visual Cadence aggregates data that is strictly concerned with DevOps. Visual Cadence will not extract data from fields that often contain more sensitive information and have no use for aggregated reporting without explicit customer opt-in, e.g., Test Steps, Repro Steps, Description. Future artificial intelligence and machine learning functionality in Visual Cadence will benefit from raw unstructured data so customers will have the opportunity to opt-in to extraction and processing of these potentially sensitive data sources.

Raw data is gathered from VSTS using a PAT for authentication. This PAT is created and managed by the VSTS administrator so permissions and expiration are completely controlled by the VC customer. At any point, the VC customer can revoke the PAT to remove the services ability to extract and process data.

Payment Card Industry Data Security Standards (PCI DSS)

Before installing Visual Cadence, it should be verified that VSTS does not contain any customer payment information. As it is not standard practice to store sensitive information like this in VSTS, there should not be an issue complying with the PCI DSS.

Personally Identifiable Information (PII)

The data collected by Visual Cadence is strictly related to software development processes, and restricted to the VSTS APIs. Therefore, organizations with an information security management system (ISMS) in place, such as those with Safe Harbor status, generally should not have to change any practices or architecture to remain compliant.

Sarbanes-Oxley Act of 2002 (SOX)

Visual Cadence does not require write access to VSTS, nor will it require access to any financial data. Again, it should be verified that proper ISMS measures are adhered to before installation of Visual Cadence

Intellectual Property (IP)

At no time will Northwest Cadence (NWC) employees (including the Visual Cadence team) divulge identifiable customer information without the consent of said customer. NWC does however intend to use anonymized data in aggregate for the purposes of education and instruction. The anonymous data will be used to gain a broader understanding of software development metrics and provide more insightful reports.

Authentication & Authorization

Visual Cadence is a Visual Studio Team Services extension and requires customers to provide a personal access token for the account that the extension is installed on. Once installed, the extracted VSTS data will be available to customers using SQL Authentication on an Azure SQL Database.

Personal Access Token

The PAT provided to Visual Cadence must be authorized to the specific scopes that your pricing tier supports. Additionally, a PAT can be limited further than your pricing tier if you do not want specific data to be available for reporting.

The following scopes are required to support specific pricing tiers (items in bold are required to support the basic functionality of the service):

Free Tier

  • Project and team (read)

  • Work items (read)

Basic Tier

  • Build (read)

  • Code (read)

  • Project and team (read)

  • Release (read)

  • Test Management (read)

  • Work Items (read)

FREE eBook
Modern Applications Guidebook

Get great ideas into your users’ hands quickly, while controlling costs and reducing the demands on operations and infrastructure.

Get the eBook