Security

Multiple developers vet code for a project before it enters the production pipeline. All code is reviewed by peers using a “pull request” so that it has multiple checks before merges.

Developers do not save or transfer passwords or sensitive key strings in plaintext. Our team leverages a secure password application for all password management.

Each Mediacurrent team member is given access only to the systems they need to perform their specific role on a project.

Backups provide data resiliency. Our team recommends hosting partners that have sound, well-documented archiving and disaster recovery processes in place.

Mediacurrent configures project-specific chatops channels to respond to development events so that unexpected activity does not go unnoticed.

Medicurrent has an internal team leading security-related efforts with experience in site-hardening, developing security policies and responding to breaches.

Development environments are secured through the following methods:

• HTTP authentication: Development sites are password protected at the root level in their server configuration.
• IP Whitelisting: IP Whitelisting used when required to ensure only allowed IPs can access staging/development sites.

Our IT team deploys a variety of tools to secure our team’s machines including the following:

• JAMF for policy enforcement, remote data wipe, and machine lock
• Trend Micro enterprise security
• Third-party password management for secure password sharing
• Google Security Apps for spam and phishing attacks

Mediacurrent partners with hosting companies that have established themselves as leaders in hosting security. These companies offer a variety of security measures including firewalls, threat monitoring,  24/7 coverage and high availability SLA’s:

1. Pantheon - https://pantheon.io/security
2. Acquia - https://docs.acquia.com/acquia-cloud/arch/security

Mediacurrent follows industry best practices to comply with the Administrative Safeguards of HIPAA Privacy, to secure and maintain the confidentiality of Protected Health Information, maintain sensitive organizational information at Mediacurrent and prevent and detect inappropriate and illegal uses and disclosures. This is done via training provided to employees involved with projects that may have potential exposure to PHI. 

Mediacurrent also has specific policies we enforce via our System Management software JAMF to ensure the requirements of the HIPAA Security Rule “Workstation Security” Standard 164.310(c) are met.

• Mediacurrent - HIPAA IT Security Workstation Policy
• Mediacurrent - HIPAA Privacy Policy 
• Mediacurrent - PHI Risk Management Plan
• Mediacurrent - Security Incident Response Form
• Mediacurrent - HIPAA Audit Compliance Plan

Mediacurrent follows industry best practices by adhering to a formal incident response process. Our team emphasizes open and transparent communication between Mediacurrent personnel, clients, and related hosting partners. 

The key components of this process are outlined below. Further detail can be supplied to clients or prospects upon request:

1. Preparation
2. Detection and Identification
3. Containment
4. Eradication
5. Recovery
6. Lessons Learned