ESET PROTECT Cloud Sicherheit

1 Introduction

The purpose of this document is to summarize the security practices and security controls applied within ESET PROTECT Cloud. Security practices and controls are designed to protect the confidentiality, integrity, and availability of customer information. Please note that security practices and controls may change.


2 Scope

The scope of this document is to summarize security practices and security controls for ESET PROTECT Cloud infrastructure, ESET Business account (hereinafter referred to as “EBA”), and ESET MSP Administrator (hereinafter referred to as "EMA") infrastructure, organization, personnel, and operational processes. Security practices and controls include:

Information security policies

Organization of information security

Human resource security

Asset management

Access control


Physical and environmental security

Operations security

Communications security

System acquisition, development, and maintenance

Supplier relationship

Information security incident management

Information security aspects of business continuity management


3 Terms and abbreviations

Term or abbreviation



ESET Business Account


ESET MSP Administrator


4 Security concept

ESET s.r.o. company is ISO 27001:2013 certified with integrated management system scope explicitly covering ESET PROTECT Cloud, EMA, and EBA services. Therefore, the concept of information security uses the ISO 27001 framework to implement a layered defense security strategy when applying security controls on the layer of the network, operating systems, databases, applications, personnel, and operating processes. Applied security controls and security practices are intended to overlap and complement each other.


5 Security controls

5.1 Information security policies

ESET uses information security policies to cover all aspects of the ISO 27001 standard, including information security governance and security controls and practices. Policies are reviewed annually and updated upon significant change to ensure their continuing suitability, adequacy, and effectiveness.

ESET performs annual reviews of this policy and internal security checks to ensure consistency with this policy. Non-compliance with information security policies is subject to disciplinary actions for ESET employees or contractual penalties up to contract termination for suppliers.


5.2 Organization of information security

The organization of information security for ESET PROTECT Cloud consists of multiple teams and individuals involved in information security and IT, including:

ESET executive management

ESET Internal security teams

Business applications IT teams

Other supporting teams

Information security responsibilities are allocated in-line with information security policies in place. Internal processes are identified and assessed for any risk of unauthorized or unintentional modification or misuse of ESET assets. Risky or sensitive activities of internal processes adopt the segregation of duties principle to mitigate the risk.

The ESET legal team is responsible for contacts with authorities including, Slovak regulators on cybersecurity and personal data protection. The ESET Internal Security team is responsible for contact with special interest groups like ISACA. The ESET Research lab team is responsible for contact with other security companies and the greater cyber security community.

Information security is accounted for in project management using the applied project management framework from conception to completion of a project.

Remote work and telecommuting are covered through the use of a policy implemented on mobile devices that include the use of strong cryptographic data protection on mobile devices while traveling through untrusted networks. Security controls on mobile devices are designed to work independently of ESET internal networks and internal systems.


5.3 Human resource security

ESET uses standard human resource practices, including policies designed to uphold information security. These practices cover the whole employee life-cycle, and they apply to all teams that access the ESET PROTECT Cloud environment.

5.4 Asset management

The ESET PROTECT Cloud infrastructure is included in ESET asset inventories with strict ownership and rules applied according to asset type and sensitivity. ESET has an internal classification scheme defined. All ESET PROTECT Cloud data and ESET PROTECT Cloud configurations are classified as confidential.

5.5 Access control

All access in ESET PROTECT Cloud is governed by ESET's Access control policy. Access control is set on the infrastructure, network services, operating system, database, and application level. Whole user access management on the application level is autonomous. ESET PROTECT Cloud and EBA single sign-on is governed by a central identity provider, which ensures that a user can access the authorized tenant only. The application uses standard ESET Protect permissions to enforce role-based access control for the tenant.

ESET backend access is strictly limited to authorized individuals and roles. Standard ESET processes for user (de)registration, (de)provisioning, privilege management, and review of user access rights are used to manage ESET employee access to ESET PROTECT Cloud and EBA infrastructure and networks. Strong authentication is used to protect access to all ESET PROTECT Cloud data.

5.6 Cryptography

To protect ESET PROTECT Cloud data, strong cryptography is used to encrypt data at rest and in transit. Generally trusted certificate authority is used to issue certificates for public services. Internal ESET public key infrastructure is used to manage keys within the ESET PROTECT Cloud infrastructure. Data stored in the database is protected by cloud-generated encryption keys. All backup data are protected by ESET managed keys.

5.7 Physical and environmental security

Because ESET PROTECT Cloud and EBA are cloud-based, we rely on Microsoft Azure for physical and environmental security. Azure uses certified data centers with robust physical security measures. The physical location of the data center depends on customer region choice. Strong cryptography is used to protect customer data during transport off-site from the cloud environment (for example, in transit to a physical backup data storage).

5.8 Operations security

The ESET PROTECT Cloud service is operated via automated means based on strict operational procedures and configuration templates. All changes, including configuration changes and new package deployment, are approved and tested in a dedicated testing environment before deployment to production. Development, test, and production environments are segregated from each other. ESET PROTECT Cloud data is located only in the production environment.

The ESET PROTECT Cloud environment is supervised using operational monitoring to swiftly identify problems and provide sufficient capacity to all services on the network and host levels.

All configuration data is stored in our regularly backed-up repositories to allow for automated recovery of an environment’s configuration. ESET PROTECT Cloud data backups are stored both on-site and offsite. Backups are encrypted and regularly tested for recoverability as a part of business continuity testing.

Auditing on systems is performed according to internal standards and guidelines. Logs and events from the infrastructure, operating system, database, application servers, and security controls are collected on a continuous basis. The logs are further processed by IT and internal security teams to identify operational and security anomalies and information security incidents.

ESET uses a general technical vulnerability management process to handle the occurrence of vulnerabilities in ESET infrastructure, including ESET PROTECT Cloud and other ESET products. This process includes proactive vulnerability scanning of infrastructure and repeated penetration testing of infrastructure, products, and applications.

ESET states internal guidelines for the security of internal infrastructure, networks, operating systems, databases, application servers, and applications. These guidelines are checked via technical compliance monitoring and our internal information security audit program.

5.9 Communications security

The ESET PROTECT Cloud environment is segmented via native cloud segmentation with network access limited only to necessary services among network segments. The availability of network services is achieved via native cloud controls like availability zones, load-balancing, and redundancy. Dedicated load-balancing components are deployed to provide specific endpoints for ESET PROTECT Cloud instance routing that enforce authorization of traffic and load-balancing. Network traffic is continuously monitored for operational and security anomalies. Potential attacks can be resolved through the use of native cloud controls or deployed security solutions. All network communication is encrypted via generally available techniques, including IPsec and TLS.

5.10 System acquisition, development, and maintenance

Development of ESET PROTECT Cloud systems is performed in accordance with the ESET secure software development policy. Internal security teams are included in the ESET PROTECT Cloud development project from the initial phase and overlook all development and maintenance activities. The internal security team defines and checks the fulfillment of security requirements in various stages of software development. The security of all services, including newly developed ones, is tested starting upon release on a continuous basis.

5.11 Supplier relationship

A relevant supplier relationship is covered according to valid ESET guidelines, which cover whole relationship management and contractual requirements from the point of information security and privacy. The quality and security of services provided by the critical service provider are assessed regularly. Furthermore, ESET utilizes the principle of portability for ESET PROTECT Cloud to avoid supplier lockout.

5.12 Information security incident management

Information security incident management in ESET PROTECT Cloud is performed in the same way as for any other part of ESET infrastructure and relies on defined incident response procedures. Roles within incident response are defined and allocated across multiple teams, including IT, security, legal, human resources, public relations, and executive management. The incident response team for an incident is established based on incident triage by the internal security team. That team will provide further coordination of other teams handling the incident. The internal security team is also responsible for evidence collection and lessons learned. Incident occurrence and resolution are communicated to affected parties. ESET legal team is responsible to notify regulatory bodies if needed according to the General Data Protection Regulation (GDPR) and Cybersecurity Act transposing Network and information security directive (NIS).

5.13 Information security aspects of business continuity management

Business continuity of the ESET PROTECT Cloud service is coded in the robust architecture used to maximize the availability of the provided services. Full restoration from offsite backup and configuration data is possible in the event of a catastrophic failure of all redundant nodes for ESET PROTECT Cloud components or the ESET PROTECT Cloud service. The restoration process is regularly tested.

5.14 Compliance

Compliance with the regulatory and contractual requirements of ESET PROTECT Cloud is regularly assessed and reviewed similarly to other infrastructure and processes of ESET, and necessary steps are taken to provide compliance on a continuous basis. ESET is registered as a digital service provider for Cloud Computing digital service covering multiple ESET services, including ESET PROTECT Cloud. Please note that ESET compliance activities do not necessarily mean that the overall compliance requirements of customers are satisfied as such.