Infrastructure Security

Infrastructure security is the foundation of maintaining secure cloud instances. This includes the physical data center security, networking components, and virtualization infrastructure. DigitalOcean’s infrastructure is continually maintained following internationally recognized security controls. Our infrastructure is monitored 24/7/365 and undergo third-party audits as well targeted testing annually. For physical security, each of our data center colocation providers maintain industry-recognized certifications and our networks are MANRS certified.

Networking

DigitalOcean networks are collections of servers connected by wires provided by an Internet Service Provider (ISP). We develop, document, and maintain a current baseline for all machines and network device hardware. The following list is an example of controls we maintain for network security:

• Update the baseline configuration for network devices at least annually or when a significant change occurs.

• Use the least privilege method when provisioning infrastructure components. Any unnecessary ports or protocols are disabled. Network scanning is performed to validate that any ports or protocols are in use as defined.

• Use industry standard transport protocols such as TLS between devices and DigitalOcean data centers, and within data centers themselves.

• Employ a defense in-depth strategy for boundary protection, including secure segmentation of network environments through several methods including VLAN segmentation, ACL restrictions, and encrypted communications for remote connectivity.

• Define, implement and evaluate processes, procedures, and defense-in-depth techniques for protection, detection, and timely response to network-based attacks.

• Establish procedures to synchronize servers and network devices in the DigitalOcean environment with NTP Pool Project servers that sync off of the Global Positioning System (GPS) satellites.

Servers

DigitalOcean servers are hardware connected by a network housed in a data center.  Every DigitalOcean data center implements controls that ensure physical access to the facilities, backup data, and other system components such as virtual systems and servers is restricted. The following list is an example of controls DigitalOcean and its data centers maintain for server security:

• Biometric, proximity card, and/or personal identification number (PIN) reader systems (varies by data center facility) used to restrict data center access to only those individuals provisioned with access; the systems are also used to monitor, log, and notify personnel of physical security alarms.

• Maintain monitoring mechanisms over infrastructure to check server performance, data, traffic, and load capacity.

• Detect and route issues experienced by hosts in real time and employ orchestration tooling that has the ability to regenerate hosts.

• Third parties provide a certificate of destruction upon destruction of physical production assets maintained in the collocated data centers.

• Documented logical access policies and procedures to guide personnel in information security practices that include, but are not limited to: password requirements, acceptable use, access provisioning, and access termination

For more information on our data center controls, please visit our Trust Platform.

Storage

DigitalOcean storage is the physical disk on the server that runs your Droplet. These devices are encrypted at rest based on industry standards. Our storage devices have the same physical security protections as our servers. The following list is an example of additional controls DigitalOcean maintains for storage security:

• DigitalOcean’s asset inventory includes serial number tracking for servers, disks, and other assets necessary to provide infrastructure for customers.

• Where full disk encryption is used, logical access is managed by FileVault for MacOS and BitLocker for Windows operating systems; Linux encryption occurs during the operating system build, alternatively the home directory is encrypted. Kollide reports on Linux configuration to ensure encryption is present.

• In-scope systems are configured to require at least one of the following authentication  requirements:

• Authorized user account and password

• MFA

• SSO

• SSH

Virtualization

Cloud hosting environments are broken down into two main parts: the virtual servers that apps and websites can be hosted on, and the physical hosts that manage the virtual servers.

Virtualization makes cloud hosting possible: the relationship between host and virtual server provides flexibility and scaling that are not available through other hosting methods. Virtualization allows multiple DigitalOcean customers to host their products on the same disk with inherent logical separation. The following list is an example of security measures we maintain for securing your virtualized instance:

• Initial permission definitions, and changes to permissions, associated with logical access roles of production-impacting systems are approved by authorized personnel.

• We maintain device configuration policies on security requirements for the configuration and management of devices connecting to corporate services. The policies also apply to infrastructure and virtual instances.

• Customer environments are isolated using numerous mechanisms, technologies, policies, processes, and architectural elements. Customer tenants and Virtual Machine deployments are kept logically separated. Customer data may be encrypted in-transit and at-rest through configurable and standards-based providers using a variety of protocols.