GenRocket Security

A History of Test Data Security

When evaluating GenRocket’s Test Data Automation platform, IT security professionals need to ensure it delivers a secure solution for meeting their test data requirements. At GenRocket, security has always been a primary system design and development consideration. This overview will address the many security provisions architected into this highly advanced and scalable system.

The GenRocket platform has been vetted and deployed by large enterprises around the world as an essential technology tool for synthetic data generation. Major institutions rely on GenRocket for testing their core banking applications, credit card transaction services, insurance claims processing software, and investment portfolio management systems.

 

GenRocket also provides synthetic data for testing complex healthcare information systems, global eCommerce applications, large-scale telecommunications networks and IoT machine learning algorithms. GenRocket software has been continuously updated over the last 8 years to address emerging security threats and vulnerabilities.

A Secure Hybrid Cloud Environment

The GenRocket solution is implemented in a secure hybrid cloud computing environment that separates the process of designing synthetic test data from generating synthetic test data. Test data design takes place in the cloud, while test data generation takes place on-premises and behind the customer’s corporate firewall. The security benefits of this deployment model become clear when the architectural components of GenRocket Cloud and GenRocket Runtime are fully understood.

 

GenRocket Cloud Security

GenRocket provides Software as a Service (SaaS) to deliver a self-service platform for software engineers and testers to design synthetic data for automated testing. Compact Test Data Design Files are created by the GenRocket Cloud and downloaded via a secure connection to the GenRocket Runtime on customer premises. Test Data Design Files provide the instructions needed for generating synthetic data in real-time and on-demand. All data generation is performed on-premises and no customer data of any kind is stored in GenRocket Cloud.

GenRocket Runtime Security

Located on the customer premise and behind the corporate firewall, the GenRocket Runtime is a scalable engine for generating synthetic data on one or more local computers. Real-time synthetic data is generated based on the instructions provided by GenRocket Test Data Design Files. The GenRocket Runtime is a set of Java JAR (Java Archive) files containing compiled code and packaged files stored in compressed format. JAR files are extracted and executed by the Java Runtime Environment (JRE) on one or more local machines that provide scalable performance and capacity. A checksum is performed on all JAR files to ensure the security and integrity of their contents prior to execution.

Connection Security

All communications between GenRocket Cloud and GenRocket Runtime are conducted using secure encrypted sessions based on HTTPS/TLS. This extends the security of the virtual cloud infrastructure to the security of the customer premise environment. The system-generated traffic transmitted between GenRocket Cloud and GenRocket Runtime is only recognizable and usable by internal components of the GenRocket platform. User access to the GenRocket self-service dashboard is controlled by a User Profile, an encrypted file that contains the login credentials for each licensed user and their predefined access privileges.

GenRocket Provides Unmatched Test Data Security

There are two important reasons why GenRocket delivers unmatched security to organizations who require synthetic test data with unlimited variety, in any volume, and at high velocity.

1. Synthetic data is not real data and is not sourced from a production database, so it’s 100% secure. There is no requirement for masking or anonymizing sensitive data because no personal or private data is used in the generation of synthetic data. Synthetic data is controlled, artificial data matching the data structure of the target data environment. This results in test data that fully meets the requirements of all data privacy laws such as GLBA, HIPAA, PCI, and GDPR.
2. The GenRocket platform is as secure to operate as its synthetic data is for testing. All system operations take place behind secure firewalls, either in the cloud or on customer premises and all system components communicate over encrypted connections. Access control and identity management ensure the system is operated by approved users and according to predefined privileges. No production data is ever copied, stored, processed, or used by the system to generate synthetic data.

GenRocket’s Use of Metadata

Metadata refers to any Data Definition Language (DDL), database schema or data file formats used by the GenRocket platform to provide an accurate data model for synthetic data generation. GenRocket uses metadata to ensure the validity of the data structures and relationships contained in the synthetic dataset to be generated and used for testing.

To ensure accurate data representation, it’s important to maintain the referential integrity of data tables in a relational database. GenRocket holds the only US patent for maintaining referential integrity for synthetic data generation and uses the database schema to maintain proper data table relationships. Even though exposure of a database schema does not constitute a meaningful security risk, GenRocket has taken steps to ensure it can never be accessed or used by unauthorized users for any malicious purposes.

All metadata is imported into the GenRocket platform on-premises and handled safely and securely behind the corporate firewall. Once imported, metadata files are encrypted with strong SHA 256 encryption and transported via secure HTTPS to GenRocket Cloud where they are transformed into proprietary GenRocket Test Data Design Files. Then they are downloaded to the GenRocket Runtime using a secure connection to control the synthetic data generation process. Once Test Data Design Files have been created, the customer’s metadata is no longer needed and is permanently purged from the GenRocket system.

GenRocket Cloud Security Provisions

GenRocket Cloud is hosted by AWS, recognized as one of the most advanced hosting environments in the world in terms of its security, high availability, and scalability. AWS is fully certified as an ISO 27001 compliant computing environment. Through AWS, GenRocket provides its customers with the highest possible level of application and network security for conducting Test Data Automation operations.

The diagram below is a schematic of AWS virtual infrastructure. The GenRocket application and its system resources are contained in a Virtual Private Cloud (VPC) to provide a secure multitenant environment. GenRocket Cloud is used to create Test Data Design Files using self-service components that are only accessible by licensed users.

 

The VPC is connected to an Internet Gateway (IGW) located on a public subnet. The IGW is a scalable, redundant, and highly available component that provides a single entry and exit point for all traffic between the VPC and the Internet. Resources on the VPC are not accessible by the public Internet other than by connecting through Network Address Translation (NAT) performed by the IGW. The IGW supports both IPv4 and IPv6 and ensures the security and availability of customer accounts installed on the VPC. A number of AWS components are used to provide a secure cloud computing environment for the GenRocket Cloud application. These components, identified on the diagram as Elasticache, Aurora RDS Cluster, ECR Registry and S3 Bucket, are standard web services and are fully described in the Amazon Knowledge Center. Each customer is allocated a share of these VPC resources and licensed for a predetermined number of Named Users and Named Servers. For more information, see this AWS article describing the IGW and this article on Enabling internet access.

 

While 90% of GenRocket customers are hosted in this secure VPC environment, a Dedicated Private Cloud (DPC) is optionally available. A DPC provides the same resources contained in the VPC infrastructure except they are dedicated to a single customer and partitioned from other accounts. DPC hosting is available on request for an additional charge.

GenRocket Runtime Security Provisions

As described above, the GenRocket Runtime is the engine that generates synthetic test data based on the instructions contained in Test Data Design Files. To maximize security, the GenRocket Runtime is located on the customer premise and behind the corporate firewall. The customer premise is any secure environment controlled by the customer’s security infrastructure and may include remote facilities connect by VPN or virtual infrastructure deployed on premise or in a secure private cloud.

To operate the GenRocket Runtime, a user must possess a valid User Profile installed on the system and located in the GenRocket subdirectory. Information in the User Profile allows GenRocket Runtime to:

• Match Configuration Files to a specific GenRocket Organization
• Check that the user has a proper GenRocket License to run Configuration Files
• Load system resources for performing test data generation into computer memory

All Configuration Files are stored and managed by the GenRocket Runtime in a centralized and secure repository called G-Repository, to control user access, manage downloads, synchronize changes, and monitor system usage. G-Repository is based on a modular and distributed architecture that controls the flow of information between system components. G-Repository handles the distribution of these services to GenRocket licensed users and corporate test servers. A diagram of the G-Repository component architecture is provided below.

 

G-Repository components address key corporate security concerns in the following ways:

• G-Repository Server exists on-premises, within the Corporate Environment and behind Corporate Firewalls
• G-Repository Server is the only GenRocket component that communicates to GenRocket Cloud Services
• G-Repository Client only communicates to G-Repository Server within a Corporate Environment
• G-Repository Server is the secure proxy for G-Repository Client to communicate with GenRocket Cloud Services

Connectivity Security Provisions

Secure connectivity between GenRocket Cloud and the GenRocket Runtime is ensured using HTTPS and Transport Layer Security (TLS) to authenticate user sessions and encrypt all session information. Each time a user logs in they create a secure, encrypted connection from their browser to the GenRocket Cloud. In addition to a valid username and password customers can add an extra layer of security through Single Sign-On (SSO). All passwords are encrypted with a SHA-256 one-way hash.

The GenRocket Team Permissions feature ensures users are only able to access pre-approved projects and manage permitted information within those projects. Setting up GenRocket Teams with specified Projects, Team Members, and Team Permissions prevents unauthorized access or unwanted changes to the information stored in G-Repository.

The following applies to GenRocket Team Permissions:

• A Team can have multiple Projects.
• A Project can only be assigned to one Team.
• Team Member access is based on assigned Team Permissions.
• Team Permissions are specific to each Project and Team Member.

Team permissions control the level of access to various elements of a given project. Test Data Projects are typically organized in a hierarchical structure in which a Project may have many Epics, which may have many Stories, which in turn may have many Scenarios. Permissions can be used to control access and editing privileges at the lowest level (Scenarios), the mid-level (Stories) or at the high level (Epics). Permissions can also be applied to some of the more advanced self-service features used to build Test Data Cases, such as Test Data Rules and Test Data Queries.

Ongoing Security Assessment and Testing

GenRocket is continuously monitoring, assessing, and testing its security provisions to provide incident-free service delivery to its customers. Internal penetration testing is conducted every 90 days and outside third-party penetration testing by a recognized expert security firm is conducted annually.

GenRocket has commissioned an assessment of the GenRocket platform that was conducted and documented by an authoritative information and technology security analyst.

Here are the principal findings of this formal assessment:

• GenRocket enforces strict access controls for anyone using the platform
• All session data and test data configuration files are encrypted to ensure privacy
• No data that is subject to regulatory compliance is stored by the GenRocket platform
• All synthetic test data is generated on premise in the customer’s secure environment
• GenRocket’s cloud infrastructure is hosted in an ISO 27001 certified environment
• Multiple hosting options are available to suit specific customer requirements

These findings are explained in a document titled: GenRocket Test Data Automation: Security Controls Overview. It provides a thorough description of GenRocket’s many provisions for end-to-end security when deploying and scaling its industry-leading Test Data Automation solution.