t('Nextcloud understands the necessity to provide core principle baseline security requirements, as such Nextcloud 11 is built on these security principles to ultimately deliver a secure solution to their customers');?>
t('NCC Group');?>
t('Our customers care deeply about security and so do we. Nextcloud aligns with industry standards such as Clause 14 of ISO/IEC27001-2013 and related standards, guidance and security principles. Our solution is built around combined assurance layers consisting of rich security features, applied best practices governed by policy and the design itself validated by industry standard testing processes.');?>
; ?>/assets/img/whitepapers/ncc-thumbnail-banner.png)
t('New technology should fit into existing processes and infrastructure. Nextcloud enables you to leverage existing security investments.');?>
t('Existing storage and database technology');?>
t('Nextcloud supports any existing storage solution, including object store technologies, keeping data under control of trusted IT administrators and managed with established policies. Nextcloud works with industry standard SQL databases like PostgreSQL, MySQL and MariaDB for user and metadata storage.');?>
t('Existing security tools');?>
t('Nextcloud offers built in monitoring tools and integrates with existing MDM, DLP, event logging and backup tools, enabling existing tool chains to be used to monitor, back up and restore systems.');?>
t('Current security policies and processes');?>
t('Thanks to the on-premises nature of Nextcloud and its ability to leverage existing data storage and database technologies, current security policies and governance processes can continue to be used to manage, control and secure operations with Nextcloud. Nextcloud GmbH does at no point have access to your data and can not interfere with regulated processes, keeping your IT department in control.');?>
t('Nearly any authentication and provisioning mechanism works with Nextcloud, making it easy to fit with your user directory.');?>
LDAP / Active Directory
t('Nextcloud has extensive LDAP/Active Directory support with an easy installation wizard.');?>
SSO/SAML 2.0
t('Nextcloud supports Single Sign On (SSO) and provides native SAML 2.0 (and Shibboleth) authentication in its web front end.');?>
t('The native SAML integration negates the need for external software like Apache modules. Native SAML is compatible with all webservers and supports group memberships, flexible session management and app specific passwords. It can handle multiple Identity Providers and can authenticate to Samba servers with Kerberos.');?>
t('Authentication via environment variable');?>
t('Nextcloud can work with Kerberos and other authentication mechanisms like');?> OAuth2, OpenID Connect, JWT, CAS t('or Any SQL database mediated by Apache modules.');?>
t('Two-factor authentication');?>
t('Nextcloud includes Universal 2nd Factor (U2F) hardware tokens and Time-based One-Time Password (TOTP) as well as NFC and Gateway Signal/Telegram/SMS second factor support to increase the security of user login handling.');?>
t('Automated or manual provisioning');?>
t('Nextcloud offers an easy to use, REST based provisioning API to create and configure user accounts.');?>
t('Control is key to security. With Nextcloud, your IT department takes back control over its data, managed under its policies and procedures. Nextcloud integrates in the tooling you use in your data center like logging and intrusion detection and works with existing authentication mechanisms like SAML, Kerberos and LDAP. Nextcloud features:');?>
t('Logging and monitoring');?>
t('Nextcloud has built in monitoring and logging tools, compatible with industry standard tools like Splunk, Nagios and OpenNMS. It also offers a full, compliance-ready activity log for reporting and auditing purposes.');?>
t('Permission');?>
t('Administrators can set permissions on sharing and access to files using groups. Permissions of underlying storage, like Windows Network Drive access rights, are respected by Nextcloud');?>
t('Data Retention');?>
t('Define rules for data retention, allowing regular cleanup of files or ensurances that data stays put for a set amount of time.');?>
t('Finegrained File Access Control');?>
t('The powerful workflow tools in Nextcloud enable administrators to limit access to data in accordance to business and legal requirements and perform automatic actions like file conversion. Describe restrictions like "XLSX files from the HR department are not to be accessible outside company IP ranges" or "employees in the US shouldn\'t access customer data from European data centers" for Nextcloud to enforce.');?>
t('Encryption');?>
t('Nextcloud uses industry-standard SSL/TLS encryption for data in transfer. Additionally, data at rest in storage can be encrypted using a default military grade AES-256 encryption with server-based or custom key management. Also optionally and on a per-folder base data can be');?> t('end-to-end encrypted on the client with the server assisting in sharing and key management using a Zero-Knowledge model.');?>
t('Compliance');?>
t('Nextcloud puts all the pieces for compliance with regulations like HIPAA and GDRP at your fingertips. This goes from extensive documentation on our customer portal to specific apps for data requests as well as encryption and security capabilities in Nextcloud itself.
Learn more on our ');?>t('compliance site.');?>
t('For Nextcloud customers, securely exchanging data is key. Nextcloud offers industry standard protection mechanisms and adds innovative and unique capabilities like Video Verification.');?>
; ?>/assets/img/features/sharing_admin-nw.png)
t('Securing shared links');?>
t('Nextcloud features industry-leading protection for file shares.');?>
t('Administrators can set defaults or enforce these options.');?>
t('Learn more about sharing.');?>
t('Video Verification');?>
t('In situations where extreme security is warranted and the identity of a recipient has to be verified with absolute certainty before they are granted access, Nextcloud includes the industry-first implementation of Video Verification.');?>
t('Video Verification enforces a Nextcloud Talk video call before access is given to a share, making sure the identity of the recipient is properly checked. The call can be picked up through the Nextcloud Talk Mobile apps as well as the web interface.');?>
t('To help our system administrators assess the security of their private cloud server, we have developed the Private Cloud Security Scan.');?>
t('Check now');?>; ?>/assets/img/features/securityscan-nw.png)
t('Nextcloud development follows industry leading security processes. Security bugs are like technical debt: fixing them later is expensive. Our strategy is to prevent them from happening through a rigorous focus on security through the entire life cycle of our product and to get those which find their way through found and fixed as soon as possible.');?>
t('Click each step in the process to learn more');?>
; ?>/assets/img/security/training.svg)
; ?>/assets/img/security/requirements.svg)
; ?>/assets/img/security/implementation.svg)
; ?>/assets/img/security/verification.svg)
; ?>/assets/img/security/response.svg)
; ?>/assets/img/security/training2.png)
; ?>/assets/img/security/design2.png)
; ?>/assets/img/security/reviewprocess.png)
; ?>/assets/img/security/scan.png)
; ?>/assets/img/security/hacker-one-graph.png)
t('Nextcloud protects your security with an up to $ 5000 Security Bug Bounty program');?>
; ?>/assets/img/icons/virusscaning.svg){kind=icon}
t('HackerOne program');?>
t('We have partnered with the HackerOne platform because of its extraordinary popularity among IT security professionals. More than 3,000 hackers have reported over 24,000 bugs via the platform. Running a program on HackerOne allows us to quickly leverage the collective knowledge of a huge amount of these security experts.');?>
Nextcloud's commitment to responsiveness and putting security first puts them in the best position to attract top hacker talent to continue to supplement the good work their internal security team is doing to protect customers.
-- Michiel Prins, co-founder HackerOne.
t('Anyone reporting a security vulnerability in Nextcloud can earn up to $5000, making ours some of the highest security bug bounties in the open source industry. For more details, see our announcement, our update in 2017 and the HackerOne whitepaper in 2018');?>
Nextcloud’s lightning fast response times are impressive and make them a model for how to build an efficient bug bounty triage and response process.
-- Michiel Prins, co-founder HackerOne.
t('Find an example of RhinoSecurityLabs blogging about a security issue we dealt with here (HackerOne disclosure). Here is another example.');?>
t('Authentication is the first step in securing your data');?>
; ?>/assets/img/features/TOTP.png)
; ?>/assets/img/icons/kerberos.svg){kind=icon}
t('Extra security');?>
t('The Nextcloud authentication system supports pluggable authentication including Two-factor authentication and device specific passwords, complete with a list of connected browsers and devices on the users’ personal page. As extra protection, device specific password tokens can be denied access to the file system.');?>
t('Included are Universal 2nd Factor (U2F) and Time-based One-Time Password (TOTP) second factor apps, enabling users to use tools like Yubikeys or Google Authenticator to secure their accounts. NFC auth is also supported (Yubikey Neo). A gateway 2-factor provider is available which supports 2nd factors from secure messaging apps Telegram and Signal as well as a variety of SMS gateways.');?>
t('Active user sessions can be invalidated through a list, by removing the user in the admin settings or by changing passwords. Users can manage their own sessions and devices.');?>
t('We make securing your system as easy as possible');?>
; ?>/assets/img/features/security-warnings-nw.png)
; ?>/assets/img/icons/verified-security.svg){kind=icon}
t('Automated checks and tips');?>
t('Nextcloud detects issues with its installation and warns when it finds unknown or modified files. Administrators can find security tips and warnings in the configuration screen.');?>
t('Administrators can set password quality policies enforced by Nextcloud as well as limit or disable sharing, enforce expiration dates and passwords on shares, disable preview generation and more.');?>
t('You can find more information on hardening your Nextcloud installation in our extensive');?> t('hardening guide');?>
t('We provide the Nextcloud Security Scanner to check the security of your private cloud server.');?>
; ?>/assets/img/whitepapers/serverside-thumbnail-banner.png)
t('Employ encryption for the highest degree of privacy and security');?>
; ?>/assets/img/features/encryption-nw.png)
t('Encrypted data transfer');?>
t('Nextcloud employs industry-standard TLS to encrypt data in transfer. Usage of Object Storage like Amazon S3 or other external storage systems can be secured through Server Side Encryption.');?>
; ?>/assets/img/icons/vault.svg){kind=icon}
t('Encrypt data at rest');?>
t('Server Side Encryption can also be used on local storage. However, inherent to the concept of server side encryption, encryption keys will be present in memory of the Nextcloud server during the time a user is logged in and could be retrieved by a determined attacker. We take care to ensure keys are not stored unencrypted on permanent storage and at rest keys are encrypted using a strong cipher.');?>
; ?>/assets/img/icons/securitypolicies.svg){kind=icon}
t('Encrypt from client to client');?>
t('End-to-end Encryption client-side is available from Nextcloud 13 and newer as a folder-level option to keep extremely sensitive data fully secure even in case of a full server breach. The server facilitates key exchange for syncing between devices and sharing but has Zero Knowledge, that is, never has access to any of the data or keys in unencrypted form.');?> t('Learn more here.');?>
; ?>/assets/img/features/encryption-recovery.png)
; ?>/assets/img/icons/keys.svg){kind=icon}
t('Server-side encryption with flexible key handling');?>
t('Nextcloud supports pluggable encryption key handling. If you have an external key server or Hardware Security Module, these can be made to work with Nextcloud.');?>
t('Our default encryption key handling enables administrators to set a system wide recovery key for encrypted files,. This ensures that, even when users lose their password, files can always be decrypted. Encrypted files can be shared but after changing encryption settings, shares will have to be re-shared. Using our command line tools, data can be encrypted, decrypted or re-encrypted when needed.');?>
t('If you face a regulatory or compliance need to encrypt data at rest but do not need to actually secure this data, locally encrypting data using our built in key management may satisfy compliance requirements.');?>
t('Learn how to use server side encryption in our');?> t('documentation');?>
; ?>/assets/img/features/endtoend-android-nw.png)
t('Seamless End-to-end Encryption on the clients');?>
t('Nextcloud features an enterprise-grade, seamlessly integrated solution for end-to-end encryption. It enables users to pick one or more folders on their desktop or mobile client for end-to-end encryption. Folders can be shared with other users and synced between devices but are never readable by the server.');?>
t('This solution is easy to use yet extremely secure thanks to its Zero-Knowledge server design and Cryptographic Identity Protection. It does not compromise security by using a browser to encrypt or decrypt files with code coming from the server and is not an all-or-nothing affair: any number of folders can be end-to-end encrypted. Sharing is secure without a need to exchange passwords and files don\'t need to be re-encrypted and re-uploaded when access rights for other users are changed.');?>
t('Our solution is enterprise ready with support for a Hardware Security Module for issuing certificates, giving access to a full audit log and optionally allowing administrators to create an offline master recovery key.');?>
t('Learn about End-to-end Encryption in our clients ');?> t('on this page.');?>
t('Besides active security measures like authentication and encryption, Nextcloud protects your data without any need for administrator action');?>
; ?>/assets/img/icons/find-data.svg){kind=icon}
t('Brute Force Protection');?>
t('Brute Force Protection logs invalid login attempts and slows down multiple attempts from a single IP address (or IPv6 range). This feature is enabled by default and protects against an attacker who tries to guess a password from one or more users.');?>
t('Password reset tokens are invalidated when critical information like user email has been changed to protect against phishing attacks.');?>
t('Nextcloud will ask system administrators for password confirmation on security critical actions.');?>
; ?>/assets/img/icons/camera.svg){kind=icon}
t('Rate Limiting');?>
t('Rate Limiting allows a developer to specify how often an IP range or a user may send a request in a specific time period. This can be useful for expensive API calls, to prevent users from accessing too much data in a smaller attempt of time or harden bruteforce stuff further. It is used by Nextcloud apps to protect users from spam and overloading.');?>
; ?>/assets/img/icons/secure-server.svg){kind=icon}
t('Security hardening');?>
t('Nextcloud employs a wide variety of extra security hardening capabilities, including:');?>
t('CSP is a HTTP feature that allows the server to set specific restrictions on a resource when opened in a browser. Such as only allowing to load images or JavaScript from specific targets.');?>
t('CSP 3.0 is the latest, most strict version of the standard, increasing the barrier for attackers to exploit a Cross-Site Scripting vulnerability.');?>
t('Same-Site cookies are a security measure supported by modern browsers that prevent CSRF vulnerabilities and protect your privacy further. Nextcloud enforces the same-site cookies to be present on every request by enforcing this within the request middle ware.');?>
t('We include the __Host prefix to the cookie (if supported by browser and server). This mitigates cookie injection vulnerabilities within potential third-party software sharing the same second level domain.');?>
; ?>/assets/img/security/cii_pdf_icon.png){kind=icon}
; ?>/assets/img/security/veracode-doc.png)
