Secure DXP

Optimizely’s Digital Experience Platform (DXP) is managed by an information security management system certified to ISO 27001. Best practice architecture and development, secure data centers, global support, and CDN or WAF services combine to ensure safe, secure solutions that support Optimizely customers.

Security and privacy are built into the Azure platform, and any feature that Optimizely develops must meet the highest quality standards. This is ensured by various coding guidelines that must be met before the code is considered for inclusion in the platform.

Guidelines include performance considerations, security concerns, and globalization and localization aspects. Optimizely bases much of its platform-related security efforts on the Open Web Application Security Project (OWASP).

The Optimizely platform is tested against:

Optimizely has a continuous release cycle with weekly releases. Releases include features and fixes, and you can upgrade your solution at a cadence that makes sense for your business.

Optimizely DXP is deployed on Microsoft Azure security hardened systems. Availability and performance monitoring are provided, and performance is supported by elastically scaling Web Apps that cater to seasonal traffic peaks and intraday spikes.

Data-in-transit is encrypted through HTTPs/TLS. The provided Content Delivery NetworkContent Delivery Network (CDN) protects origin servers, and together with the built-in Web Application FirewallWeb Application Firewall (WAF), it provides DDoS mitigation and state-of-the-art protection against unusual and malicious traffic. See DXP cloud services for technical details about the service architecture.

Optimizely DXP leverages the Microsoft Azure platform. The underlying infrastructure follows Microsoft Azure compliance standards, certifications, and supporting processes.

DXP uses Azure Web Apps to run Optimizely applications and thus aligns with the Microsoft patch release cycle. Microsoft is responsible for patch management. Optimizely works closely with Microsoft for any edge cases involving patching.

Azure Web Apps do not use the traditional version of Microsoft Windows but rather a purpose-built version with a smaller attack surface and reduced vulnerability. Each customer solution uses isolated resources with independent databases and Web Apps.

Optimizely DXP runs on secure Microsoft Azure datacenters. Each facility is designed to run 24x7x365 with protection from power failure, physical intrusion, and network outages. Perimeter fencing, cameras, and biometric safeguards protect entry points. Azure datacenters are certified to 90+ compliance standards, including, for example, ISO 27001, FedRAMP, and SSAE 18 SOC 2.

A limited subset of employees can access customer applications based on the principle of least privilege. Access is through feature-limited portals, over encrypted connections with multi-factor authentication, and access is logged. Providing access to a subset of employees provides effective customer support, troubleshoots potential problems, and detects and responds to security incidents. See the Data Processing Agreement (DPA).

Optimizely solutions are built by established teams focused on building highly scalable, performant, and secure systems. Optimizely’s Secure Product Development Lifecycle (SDL) uses an agile methodology based on the Kanban approach, with the primary function of ensuring quality and security is a part of every product delivered.

Methodologies and standards include Test Driven Development, OWASP, NIST, and BSIMM, with mandatory coding guidelines and code reviews. Code changes require at least three approvals before integration into the main source code branch.  Code is reviewed concerning best practices, including prevention techniques for SQL and XPath/XSLT injection, cross-site scripting, broken session management, and cross-site request forgery through static and dynamic vulnerability testing.

The Optimizely Digital Experience Platform provides up to 99.9% SLA at the website application level. Customers can register to receive incident updates and view information about platform-wide planned maintenance on the service dashboard. Customers are notified directly of incidents regarding their specific applications and are updated on the progress of the incident.

App Service instances run on Azure and are aligned with Microsoft’s Azure patch release cycle. The Optimizely Content Management System (CMS) and Optimizely Customized Commerce code follow a continuous release cycle with new releases on a weekly basis. Releases include features and fixes, and customers can upgrade their solutions at a cadence that makes sense for their particular business.

Optimizely provides the following monitoring as part of DXP:

Services are protected with Transport Layer Security (TLS) version 1.2 or higher with full support for TLS 1.3.

Secure Sockets Layer (SSL) is commonly used for encrypted integration and communication with other services through REST and web service APIs. Domains in DXP are protected by SSL by default. SSL termination is at the CDN for editorial or administrative views and on the public website. Optimizely Commerce (PaaS) packages include SSL termination at the CDN for Commerce Manager.

The strength of an SSL/TLS connection can be improved by not allowing weaker ciphers. For incoming traffic to a site in the DXP solution, this is done at the CDN.

Virtual Private Network (VPN) can allow a secure connection to an internal corporate resource. Note that communication is one-way to the on-premises system.

Optimizely supports using a VPN for secure connections to internal corporate resources. VPN connections are most commonly used for application-to-application integrations with a customer’s on-premise systems, if needed or appropriate. Supported VPNs are Azure compliant, IPSEC IKE v2, and route-based.

Azure Web Apps do not use the traditional version of Microsoft Windows, but rather a purpose-built version with a smaller attack surface and reduced vulnerability. Each customer solution uses isolated resources with independent databases and Web Apps.

A Web Application Firewall (WAF) sits in front of web applications to filter out malicious traffic at the application layer (Layer 7 of the Open Systems Interconnection (OSI) Model, including HTTPS and HTTP traffic). A WAF stops attacks at the network edge, protecting your website from common web threats and specialized attacks before they reach your servers.

WAF is included in the Optimizely DXP; see Web Application FirewallWeb Application Firewall for details.

Distributed Denial of Service (DDoS) attacks are common and complex, and traditional on-premises solutions cannot handle these. Optimizely DXP offers advanced protection at the network edge through its CDN provider, including UDP and ICMP protocols, DNS amplification, Layer 7 and 3/4, SYN/ACK, and SMURF (see information on the Internet for this terminology). The provided CDN is rated at over 30 Tbps throughput, more than 15x the size of the largest recorded DDoS attack.

Microsoft Azure also protects against attacks generated from outside and inside the platform.

Optimizely, DXP relies on Microsoft's standard approach for Azure anti-malware to provide real-time protection and content scanning.

Files saved to the app's local temporary storage are automatically deleted when the app restarts. To improve security and save space, delete any temporary files your app creates after they are no longer needed, instead of relying on automatic deletion. For long-term storage, use Azure Blob Storage.

DXP uses Azure Web Apps to run Optimizely applications and thus aligns with the Microsoft patch release cycle. Microsoft is responsible for patch management. Optimizely works closely with Microsoft for any edge cases involving patching.

Optimizely has a continuous release cycle with releases every week. Releases include features and fixes, and you can upgrade your solution at a cadence that makes sense for your business.

Optimizely DXP leverages the Microsoft Azure platform. The underlying infrastructure follows Microsoft Azure compliance standards, certifications, and supporting processes.

Vulnerability management responsibilities are shared:

Optimizely conducts weekly vulnerability testing against DXP and performs annual external audits. Microsoft also regularly tests the underlying Azure infrastructuretests the underlying Azure infrastructure.

Customers can run WVS and penetration tests using tools and third-party services. You should follow documented guidance for testing against Azure-based services. Customers can alternatively contract for WVS.

Microsoft and their Red Team regularly provide a penetration test to the underlying infrastructure of DXP. The Optimizely platform is also subject to regular penetration tests by customers and partners.

However, any implementation on the Optimizely platform could unexpectedly introduce a security hole. You need to ensure that your solution is thoroughly tested before going live.

You can conduct your tests using tools or security services.

If you plan to perform your penetration tests, you need to notify Optimizely at least 10 business days before the planned testing.

To notify Optimizely about your test, submit a ticket to Optimizely with your test plan including:

While the outbound IP addresses of a DXP environment can stay static for extended periods, there is no guarantee that they will. They can change anytime, and Optimizely cannot monitor this or proactively inform customers of a potential change.

Optimizely strongly discourages using the outbound IP addresses for security purposes because important site functionality may break at any time when the outbound IP addresses change.

Instead, you should use other methods of securing the traffic, like certificate/key-based authentication or a VPN.

For information about CMS 11 security, see SecuritySecurity in the Optimizely Content Management System (CMS) Developer Guide.

Optimizely ensures that all system clocks across the cloud infrastructure are consistently synchronized to an accurate and authoritative time source. This is critical to maintaining the integrity of audit logs, security monitoring, and so on.

The Optimizely platform is hosted on Microsoft Azure, which provides built-in, infrastructure-level time synchronization. Azure uses industry-standard protocols, including the Network Time Protocol (NTP), to sync time.

All virtual machines, services, and underlying infrastructure components are automatically synchronized to Microsoft-managed time servers. These timestamps use Coordinated Universal Time (UTC) and are synchronized to authoritative time sources.

For more details, see Time sync for Linux VMs in Azure in the Microsoft documentation.

To ensure alignment between customer-managed systems and the Optimizely platform, you are encouraged to synchronize your local system clocks with a reliable time source such as UTC.

Recommended approaches include:

Maintaining synchronized clocks between customer environments and the Optimizely platform helps ensure accurate log correlation, troubleshooting, and security analysis.