Service Overview
Radware's Cloud Web Application Firewall (CWAF) Service protects the Controller’s web applications and APIs (the “Protected Assets”) against Web application layer attacks.
The Service is provided through a global network of distributed Points of Presence (“PoPs”), using an optimized and highly available architecture, securing the customer's Protected Assets from multiple PoP locations, to ensure that they are fully protected.
The Service’s PoPs are located at major traffic hubs with connections to tier-1 ISPs, striving for low latency and minimal impact on Protected Assets’ performance.
The Service features a Service Portal, which provides visibility and self-service management of the Service elements.
The Service’s PoPs are located at major traffic hubs with connections to tier-1 ISPs, striving for low latency and minimal impact on web applications’ performance.
The Service features a Service Portal which provides visibility and self-service management of the Service elements.
Purpose of the Processing
Processing is performed to protect the Customer’s Protected Assets from web application attacks, and/or other type of attacks; all pursuant to and for the limited purpose of performing Radware’s obligations set out in the Principal Agreement (as defined in the DPA).
Processing of Data in Transit
The Service processes traffic (legitimate and malicious) targeted at the Protected Assets through a Radware PoP located in the same region as the Protected Assets. However, in case of a large DDoS attack, traffic load balancing, or Service failure (redundancy), attack traffic may be processed at a Radware PoP closer to the attack source.
Data in transit may include all categories of Personal Data. Only application data of malicious activity and malicious actors is decrypted, analyzed, and stored by the Service. Note that, in order to inspect SSL traffic, the Service requires securely uploading SSL keys onto the Service Portal.
Processing of Data in Transit
The Service does not store any information that can directly identify a natural person.
The Service only stores information on malicious actor activity (including malicious source IP addresses and malicious headers), alongside aggregated non-identifiable statistics about legitimate users. Furthermore, the Service allows encryption of malicious source IP values prior to storage.
Soon within our roadmap, the Service will allow storing all Protected Assets data in a location selected by the Customer.
Items of Data at Rest stored by the Service
|
Category
|
Data Description
|
Retention Period
|
|
Protected Assets Data
|
Security event metadata for the purpose of presenting status and statistics to the Customer through the Service portal, generating reports and managing the Service.
The following security alerts information is stored:
Attacker/malicious actor information:
- Source IP
- Source country
- User-agent
- Session and cookie data
Attack/malicious activity information:
- OWASP category
- Attack category
- Attacked URL
- Request headers
- Response headers
- Attack payload
- Action taken
|
3 months
|
|
Audit Log
|
The following operations are stored as part of the Audit Log (resulting from user action or API invocation).
User Activity:
- Login
- Logout
- Failed login attempts
- User creation, modification, and deletion
Application Configuration Changes:
- Application provisioning and deletion
- Network configuration changes
- Security policy modification
Account Configuration Changes:
- Account provisioning and deletion
- Account settings modifications
|
2 years
(3 months available for review through Service Portal)
|
|
Account Information
|
Data related to the account protected by the service.
Subscription:
- Account name
- Subscription period
- Service plan
- Contact information
- Users
|
Stored as long as the Customer account is active. Deleted once Customer stops using the service.
|
The above data is stored in virtual private cloud (VPC) environments based in the United States (AWS). This data is only accessed by the Customer (and whomever the Customer gives permission to, e.g., a service provider) and by the Radware ERT team (for the purpose of providing the managed Service). The Customer may receive alerts of blocked attacks or view status via the online Service Portal.
Data Subjects
Individuals about whom data is provided to Processor through or in connection with the Service by (or at the direction of) the Customer or by the Customer’s end-users, which may include any natural person who accesses the Customer’s Protected Assets as well as employees, agents or advisors of the Customer.
Duration of the Processing
The duration of the processing is determined by the Principal Agreement or until deletion of all Customer’s Personal Data in accordance with the DPA and the “Retention Period” set forth in the table above.
Processing Locations
|
Approved Sub- Processor/Affiliate (Company Name)
|
Company
address
|
Approved
scope of work
|
Approved Service Locations
|
Approved Service Locations - Address
|
|
Radware
|
Raoul Wallenberg Street 22, Tel Aviv-Yafo, Israel
|
Cloud WAF POP
|
Frankfurt (FRA)
|
Weissmuellerstr. 13, 60314 Frankfurt, Germany
|
|
London (LON)
|
352 Buckingham Avenue, Slough, SL1 4NB, United Kingdom
|
|
Ashburn (ASH)
|
21715 Filigree Ct, Ashburn, VA 20147, USA
|
|
Singapore (SIN)
|
IBM-SL / Digital Reality - 29A International Business Park, Jurong East, Singapore 609934
|
|
San Jose (SJC)
|
IBM San Jose
|
|
Tokyo (TKO)
|
I2B, 3-4-1 Inukura, Miyamae-ku, Kawasaki-shi, Kanagawa 216-0011 - Japan
|
|
Hong Kong (HKG)
|
ROYALE INTERNATIONAL COURIERS LTD, 585-609 CASTLE PEAK ROAD 3RD FLOOR GOODMAN KWAI CHUNG LOGIST HK
|
|
Sydney (SYD-SL)
|
273 Pyrmont St Ultimo, Sydney NSW 2007, Australia
|
|
Sydney (SYD2)
|
C/639 Gardeners Rd, Mascot NSW 2020, Australia
|
|
Johannesburg (JNB)
|
5 Brewery Street, Isando, Johannesburg, South Africa
|
|
Tel Aviv (TLV)
|
Ha-Sivim St 49, Petah Tikva, Israel
|
|
Chennai (MAA)
|
IBM Chennai
|
|
Sao Paolo (SAO)
|
IBM Sao Paolo
|
|
Chicago (ORD)
|
2200 Busse Rd, Elk Grove Village, IL 60007, USA
|
|
Toronto (YYZ)
|
45 Parliament St, Toronto, ON M5A 2Y5, Canada
|
|
Amazon Web Services (AWS)
|
|
Operate Cloud Portal
|
US– East
|
VA, USA
|
|
Microsoft Azure
|
|
Network Points of Presence (PoPs)
|
US East
|
VA, USA
|
|
US North Central
|
IL, USA
|
|
EU North
|
Dublin, Ireland
|
|
EU France Central
|
Paris, France
|
Industry Standard Certificates
Radware’s Cloud WAF Service complies with the following standards for cybersecurity and privacy:
· ISO 27001 Information Security Management Systems
· ISO 27032 Security Techniques -- Guidelines for Cybersecurity
· ISO 27017 Information Security for Cloud Services
· ISO 27018 Information Security Protection of Personally identifiable information (PII) in public clouds
· HIPAA Health Insurance Portability and Accountability Act
· PCI-DSS Payment Card Industry Data Security Standard – Service Provider Schedule D
Radware is compliant with ISO 28000 Specification for Security Management Systems for the Supply Chain.
Compliance with these standards is audited annually by third party auditors.
Customers may find Radware’s latest cybersecurity and privacy certifications and attestations at https://www.radware.com/newsroom/certificationsindustry/
An annual SOC2 type II report is being prepared for Radware’s Cloud Services.