ProductsSolutions

Services

SupplyCare Hosting –cyber protection overview
Security measures that secure
your data

Facilitate your cybersecurity
compliance with a trusted partner:
Endress+Hauser ensures reliable
operation of process plants in facilities
worldwide.
Cyber security in industrial plants and theIndustrial Internet of Things is becoming
increasingly important.
To verify the protection measures of ourproducts, we have tested our systems
against some of the most well-known
security standards in the IT and OT
fields and obtained the corresponding
certification.

More details on SupplyCareContact
Please contact your local Endress+Hauser
location
www.addresses.endress.com

Security starts in productdevelopment
To best protect our customers’
production facilities,
Endress+Hauser considers
security from the very
beginning. We establish afoundation for secure operationin our offerings during theproduct design phase. Security
is also an importantconsideration during
development and testing.
To ensure consistently highquality and secure products,
we at Endress+Hauser Groupare proud that our Secure
Development Lifecycle
Processes are tested andcertified according to IEC
62443-4-1 by TÜV Rheinland.

Secure Implementation Our developers continuallyenhance their secure coding skills through regular training,
guidance from security coaches and use of a secure coding
platform. We adhere to the latest security advisories during
development, including but not limited to file upload/
download functionalities and password rules. Additionally,
we implement meticulous error handling and logging toprevent exposure of sensitive data. We use widely accepted
and rigorously tested libraries for cryptography in our
implementation to minimize errors and vulnerabilities.
Security Testing Our software, developed in linewith the latest secure coding standards, undergoes daily
automated scans using cutting-edge security scanners thatadhere to OWASP and SEI Cert standards. Our processincludes dedicated tests for security requirements identified
by common practices and threat modeling, ensuring theutmost quality and security of our products.
Customer data Our customers are the sole ownersof their data and can export it for re-use in other systems.
Your data is continuously backed up to support quick
recovery in case of problems. Endress+Hauser has acomprehensive disaster recovery plan in place to avoid lossof data.​After termination of the customer relationship,
Endress+Hauser deletes all customer data. This applies
to both Endress+Hauser and our sub-suppliers including
our cloud hosting partners which do not have access tocustomer data.
User information All customer data including userrelated data is treated with care in accordance with latest
GDPR guidelines. We only utilize user data, which isabsolutely necessary to fulfill the provided services andadhere to the principle of data economy.

www.addresses.endress.com

Passwords and Authentication - OAuth To ensure
personal information stays confidential, all applications
follow strict password policies. To facilitate secure logins,
we use state of the art cloud-based authentication service
to securely store passwords. In our Endress+Hauser user
management system we use a tokenized process to identify
users safely and reliably prior to software usage. User
passwords are transmitted only for token generation.
This prevents scamming attempts and guarantees a safe
authorization.
Server location All data is stored in redundant secure
servers in different locations in Europe to ensure continuityof customer business. These servers are operated under theprotection of European law and jurisdiction, so our customers
can be sure that their data is subject to one of the highest
data security standards worldwide.
Data interfaces State-of-the-art security mechanisms
protect the integrity of data communicated between
SupplyCare Hosting, the interfaces and data sources.
On the Endress+Hauser webserver and Hosting APIinterfaces, communication is done via HTTPS. All accessto data inside SupplyCare Hosting, as well as the executionof actions, requires authorization.
Processes The possibility of a security breach exists,even in the most secure environment. We have accordingly
established internal processes to enable us to react as
quickly as possible should such a breach occur. This
includes informing all affected parties so they can react
to and minimize their risk as soon as possible. Therefore
Endress+Hauser established an entity wide specialized
Product Security Incident Response Team.
Governance All activities and measures are taken toprotect SupplyCare and the data within SupplyCare as partof a bigger system, where all processes are governed bydetailed policies, standards, processes and instructions.
This holistic approach ensures that all parts of theinformation value chain are clearly identified and protected.

PU01587S/00/EN/01.24

Functions and features
We incorporated various security related measures and key
functions/features in our software to maintain highly
secure products and solutions: