Commend Defense In-Depth-Strategy

Commend Defense In-Depth-Strategy is based on the principle of ensuring IT security in all areas (environments, design, implementation and integration) to eliminate vulnerabilities and attack vectors. In practice, this means:

• IEC ISO 27001:2013 certified, company-wide information management system (Learn more)
   
• World’s first Intercom company certified to IEC 62443:
  • Tested and certified by globally recognized cyber security certification service provider TÜV SÜD
  • Commend development teams develop and implement secure communication and automation solutions in accordance with the IEC 62443 Part 4-1 (Learn more)
     
• Use of secure standard Internet protocols:
  • TLS and SSH data transfer security for HTTP and MQTT
  • Secured SIP network access via 802.1x auth and 802.1q VLAN connections
     
• Use of secure cryptography by default:
  • Encrypted, login-protected communication via Commend signed device certificates
  • Commend Public Key Infrastructure (PKI) as a basic ‘Root of Trust’ (for generating and signing of device and application certificates) to ensure mutually login-protected, encrypted communication
     
• Security-focussed development processes:
  • Multi-level monitoring and testing
  • Regular test cycles before product releases and after updates 
     
• Vulnerability monitoring and disclosure policy:
  • Pen tests by external security testing bodies or ethical hackers
  • Coordinated processes for reporting and disclosing vulnerabilities
  • Commend Security Advisory Program: summaries of notifications, affected products, software updates, workarounds or mitigation, change log, etc.