WORKDAY SECURITY
How we protect your data.
我们致力于保护您的数据和美军陆军nicating transparently. We employ rigorous measures across our people, processes and technology to ensure that your data, applications and infrastructure remain safe.
Leadership and employees.
Leadershipprioritises security at every level of our organisation. All Workmates are responsible for the protection of our customers’ data and receive security, privacy and compliance training from day one. Our dedicated Information Security team provides ongoing security training to minimise risk, while Workday Security Champions evangelise security best practices through employee engagement andfun.
Customers.
Our customers have full control of the data they enter into Workday, as well as all setup and configurations. Workday offers training, specialised support, detailed documentation, timely communication and a peer community to help you safeguard your data and make the most of our robust security tools.
“With Workday, we reduced 262 systems down to a few overarching applications – while increasing security, gaining functionality and pressing forward with innovation.”
– Chief Information Officer
Processes for continuous protection.
To continuously protect your data, Workday has detailed operating policies, procedures and processes for our data centres, network and applications.
Workday applications are hosted in state-of-the-art data centres with fully redundant subsystems and compartmentalised security zones. The data centres adhere to the strictest physical and environmental security measures. The facilities require multiple levels of authentication to access critical infrastructure.
Camera surveillance systems are located at critical internal and external entry points, while security personnel monitor the data centres 24/7. The data centres have implemented redundant environmental safeguards and backup power management systems including fire suppression, power management, heating, ventilation and air-conditioning, set up in a minimum N+1 redundancy.
We secure our network through proven policies, procedures and processes, such as perimeter defence, threat prevention and threat detection tools that monitor for atypical network patterns in the customer environment as well as traffic between tiers and services. We also maintain a global Security Operations Centre 24/7/365.
Multiple external vulnerability assessments conducted by third-party experts scan all internet-facing assets, including firewalls, routers and web servers, to prevent unauthorised access. In addition, we use an authenticated internal vulnerability network and system assessment to identify potential weaknesses and inconsistencies with general system security policies.
Every step in our application development, testing and deployment process is designed to ensure security in our products. Our Product and Technology teams employ enterprise Secure Software Development Life Cycle (SSDLC) as well as DevSecOps accountability practices. Our development process includes an in-depth security risk assessment and review of Workday features. Static and dynamic source code analyses help integrate enterprise security into the development lifecycle. The development process is further enhanced by application security training for developers and penetration testing of the application.
Prior to each major release, a leading third-party security firm performs an application-level security vulnerability assessment of our web and mobile application to identify potential vulnerabilities. The third-party firm performs testing procedures to identify standard and advanced web application security vulnerabilities.
Technology built to be secure.
Our technology, from architecture to applications, prioritises your data security and provides configurable tools to meet the security needs of every customer, including the most risk averse.
We use powerful encryption technologies to protect customer data at rest and in transit. Workday relies on the Advanced Encryption Standard (AES) algorithm with a key size of 256 bits for encryption at rest.
Transport Layer Security (TLS) protects user access via the internet, helping to secure network traffic from passive eavesdropping, active tampering or message forgery. File-based integrations can be encrypted via PGP or a public/private key pair generated by Workday, using a customer-generated certificate. WS-Security is also supported for web services integrations to the Workday API.
The Workday Key Management Service (KMS) covers the full lifecycle management of cryptographic keys used to encrypt and decrypt customer data at rest. Additionally, customers have the option to implement bring-your-own-key capability to retain full control of their root encryption keys.
Workday provides an extensive set of reports available to auditors and administrators on how their users are using the Workday tenant. The audit trail, user activity logs, and sign-on reports are favourites among Workday customers and auditors. Workday allows you to monitor all your business transactions and easily see your historical data and configuration changes.
Authentication.
Workday authenticates every user or system accessing the platform. Workday allows customers to create end-user identities within Workday or integrate them into Workday from external systems, such as active directory. Workday security access is role-based, supporting SAML for single sign-on and x509 certificate authentication for both user and web services integrations.
Single-sign-on support.
SAML allows for a seamless, single-sign-on experience between the customer’s internal web portal and Workday. Workday also supports OpenID Connect.
Workday native login.
Our native login for Workday Enterprise Products only stores the password in the form of a secure hash as opposed to the password itself. Unsuccessful login attempts and successful log in/log out activities are logged for audit purposes. Inactive user sessions are automatically timed out after a specified time, which is customer configurable by user.
Customer configurable password rules include length, complexity, expiration and forgotten password challenge questions.
Configurable security.
你的工作日安全管理员可以控制what data users can access and the actions they can perform in your customer tenant. Tools such as roles, security groups and business process configurations allow administrators to implement your company’s security policies and update them as you scale.