THE SOFTWARE, SERVICES AND DELIVERABLES ARE PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 1E OR ITS AFFILIATES BE LIABLE FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
1E Verified
Disclaimer:
Other recommendations:
Prior to deploying content from the 1E Exchange to production machines, as with deploying any new software or application, we recommend using testing machines first to ensure you achieve the intended outcome, prior to deploying to your production devices.
What does the 1E verified flag on the Exchange signify?
DEX Pack’s that are published on the Exchange with the 1E verified go through due diligence in terms of validating functionality, performance impact, security and scalability. We want to ensure customers download high quality packs that are ready to deploy in their environments. The following are the key areas of verification and improvement:
Quality Assurance:
Each DEX Pack and its constituents (instructions, policies, embedded resources such as PowerShell scripts, utilities, etc) are analysed in terms of expected functionality. Test cases are created and executed based on this functionality by a dedicated team within 1E. This analysis and testing also includes interaction between the instructions and external system components, dependent applications, and target Operating Systems.
As typical to a quality assurance process in software development, tests on instruction execution and logical robustness across supported platforms are carried out. In addition to this there are other functional tests depending on varying operational scenarios introduced due to interactions with external system components. The following are examples of the types of test that may be conducted:
-
- Windows Services: If the instruction deals with the functionality of windows services, then test cases related to windows services such as checking and fixing availability, status, and start-up type of the service in concern will be carried out
- Windows Registry: If the instruction deals with the functionality of windows registries, then test cases such as checking the existence or changing values of the target registries will be a carried out along with checking if the instruction runs.
- Application(s) Installed: If the instruction deals with the presence or functionality of a Windows, 1E or third-party application, then tests related to the functionality of the application in context are carried out as well.
- Resources in Use: Oftentimes resources such as PowerShell scripts, batch files, external libraries etc are attached to the instruction to complete or extend functionality. In these cases, these resources are vetted by the 1E security team and functional tests are carried out separately as well in combination with the instruction.
How is the integrity of product packs safe-guarded?
Each DEX Pack and its constituents are signed by certificates from an air gapped HSM. Rights to this certificate are heavily restricted. DEX Packs on the Exchange are all signed by this certificate that 1E officially supports. 1E strongly advises against running any instruction that does not contain this certificate. It is easy to check for the 1E Exchange certificate by opening the instruction in TIMS and checking for the following info message:
Managed hosting and Security:
All DEX Packs are hosted on a separated layer from the frontend on dedicated servers on Azure managed by 1E. A dedicated intrusion detection tool prevents known and unknown malware to be installed on this server. Moreover, a vulnerability assessment tool provides the industry’s most comprehensive vulnerability coverage with the ability to predict which security issues to remediate first.
