The DOQEX Story
Data security is in our DNA
Security is in our genes. The DOQEX company was created in 2013 by the merger of two information security organisations. Securability – performed security testing and training, Panoplia – delivered standards compliance consultancy for ISO27k, PCI-DSS, IG and Data Protection.
ISO27001 certified. The DOQEX company is certified compliant with the ISO27001 standard. Our last full audit concluded in April 2022 and was conducted against the 2017 version of the standard by the British Assessment Bureau (authorised to conduct assessments and certify under UKAS). Our certificate number is 216281. Visit our ISO27001 page for more details.
We’re IT security geeks. Born and bred. At DOQEX we are proud to refer to ourselves as security geeks. Every member of DOQEX is actively involved in security research. Our lab in York sports oscilloscopes, 3D-printers, solder stations and a cornucopia of kit, servos, wires and arduinos. Three software languages and a tolerance for solder-fumes are mandatory to play here!
Secure by design and default
Security is the only default. Since inception over 10 years ago DOQEX was designed to support our own needs to move and collaborate upon highly sensitive penetration testing results. We believe every vendor must rely upon your own products.
Multiple layers of Encryption. Multiple layers of strong encryption are used within DOQEX to protect your data. Meticulous attention is paid to key and storage management. No data is ever written to disk unencrypted; all data and the decryption keys themselves go through multiple encryption processes before they ever reach disk.
Secure development. We pay particular attention to secure development practices. Sanitising user inputs is the foundation stone however we deploy many other techniques including randomised memory locations, timing attack wait state routines and various obfuscation methods we shouldn’t divulge here!
The human factor. When thinking about security, you can’t ignore the weakest element – users! The UI/UX methodology of DOQEX is therefore designed to protect users from common mistakes. Our consultants have over 20 years of professional security testing experience, so we understand the failings of users and the social engineering techniques used against us.
The best control available. If you have just one control available, we believe that should be a comprehensive audit trail. This is why DOQEX logs every action made by users and every process where data is changed. An audit trail is no good hidden away either, which is why every user can view their own audit trail, schedule reports and enable notifications for almost every event.
DOQEX Cryptography
What encryption standards does DOQEX use? DOQEX encrypts files using AES-256 with a 256-bit key in Galois Counter Mode (GCM). SecureMail email text data and sensitive configuration data is encrypted using XSalsa20 with Poly1305 MAC; the option exists to enable “legacy encryption” which reverts to AES-256 in Cypher Block Chain mode (CBC).
The Initialisation Vectors (IV) for use in all encryption modes are generated using a cryptographically secure random number generator unique to each operation.
A unique key for each file. Each file (or SecureMail) is encrypted using a unique key for that file. These unique keys are themselves encrypted with AES using a master key which is never stored on disk. The individual encrypted file encryption key is stored in plain text along with the file’s individual IV.
All data is in-memory encrypted. All file and SecureMail data is encrypted in-memory on receipt. The encrypted data is stored within the encrypted FileVault, which is a separate volume on the DOQEX Node. The FileVault is encrypted using AES-256 in GCM/CBC mode, and is mounted by an administrator at node boot time. The encryption keys for the FileVault are never stored on disk on the node.
DOQEX Standards Conformity Summary
- DOQEX is certified to ISO27001:2017
- DOQEX uses FIPS 140-2 approved encryption algorithms
- DOQEX complies with FIPS 180-4 for the Secure Hash Standard
- DOQEX complies with FIPS 186-4 for the Digital Signature Standard
- DOQEX complies with FIPS 197 for use of the Advanced Encryption Standard
- DOQEX exceeds FIPS 140-2 standards for IV generation
- DOQEX is a PCI-DSSv3 compliant solution component
- DOQEX is compliant with PSN and N3 code of connection requirements
- DOQEX is compliant with NHS IG (v14) controls
- TLSv1.2 with Extended Validation (EV) Security Certificates
- DOQEX hosted services are delivered from TIA-942 Tier 3 data centres.
FIPS 140-2 Test Results
Approved Encryption Algorithm. DOQEX uses the FIPS 140-2 approved encryption algorithm, Advanced Encryption Standard (AES).
GCM mode. AES is implemented in Galois Counter Mode (GCM), which requires the use of an Initialisation Vector (IV) which is generated using a cryptographically secure method (see section 4.7.1 of FIPS 140-2).
FIPS Test Results. A significant sample from DOQEX’s IV generation mechanism is taken. Note: a test generation suite using real data is available as part of the DOQEX tools which are included with every node. Testing prodcues the FIPS-compliant results shown opposite.
Select an image opposite to view the test results.
