W H I T E P A P E R
2
About Bizible 3
Bizible User Authentication 6
Conclusion 15
3
Adobe Security At Adobe, we know the security of your digital
experience is important. Security practices are deeply ingrained
into our internal software development, operations processes, and
tools. These practices are strictly followed by our
cross-functional teams to help prevent, detect, and respond to
incidents in an expedient manner. We collaborate with partners,
leading researchers, security research institutions, and other
industry organizations to keep up to date with the latest threats
and vulnerabilities. We regularly incorporate advanced security
techniques into the products and services we offer.
This white paper describes the defense-in-depth approach and
security procedures implemented by Adobe to secure Bizible and its
associated data.
About Bizible Bizible is the market-leading revenue attribution and
planning software for B2B companies that want to understand how
their marketing efforts are driving downstream revenue in order to
impact future revenue, justify spend, and make smarter data-driven
decisions. By unifying behavioral and ad data with sales
outcomes and machine learning, marketers can get actionable
insights and ultimately make accurate, informed marketing
decisions. From first touch to close, across all marketing
channels, Bizible enables marketers to connect marketing to revenue
through advanced analytics.
Bizible Solution Architecture There are five (5) main components
that make up the Bizible system, which track, organize, and house
data and provide reporting capabilities. The components
include:
• Bizible JavaScript — The Bizible JavaScript (bizible.js) tracks
all the online marketing interactions, also called touchpoints,
that prospects/leads have with the customer’s organization. It is a
custom script that is added before the closing </head> tag on
every marketing page of the customer’s website, e.g., <script
type="text/javascript" src="//cdn. bizible.com/scripts/bizible.js"
async=""></script>
Bizible.js captures data from web visits (including anonymous web
visits), general traffic/ page navigation, content downloads and
form submissions. The Bizible solution processes this data for the
customer and pushes it into the customer’s CRM, with each marketing
interaction displayed as an online touchpoint.
4
• CRM Integrations — Bizible integrates with CRMs to house and
organize all the data that is captured by bizible.js. Currently,
Bizible has API integrations with two CRM systems: Salesforce and
Microsoft Dynamics, but only one CRM integration connection can be
used for each Bizible instance. Once the Bizible touchpoint data is
in the CRM, customers can see the granular information related to
each touchpoint and generate reports to understand how their
channels are performing.
• Third-Party Applications — Because marketers rely on many
different applications to run their marketing efforts, Bizible is
integrated with third-party marketing automation, ad platforms, A/B
testing, analytics, and live chat applications. A current list of
the applications is available on the Adobe website.
• The Bizible Application — Customers use the Bizible application
to view and report on attribution data, configure account settings
and update account information.
• Bizible Data Warehouse — All data generated by Bizible is stored
in the Bizible data warehouse, which is a Snowflake instance.
Azure Cloud Service
Azure Firewall HTTPS Ports 80, 443
Azure VSubnet
Azure SQL
SQL Database
Azure Service Principal
Queues
Snowake Firewall ODBC Over TCP Port 443 Azure Service
Principal
Snowake
Data Warehouse
Bizible Worker
Azure VSubnet
Azure Cloud Service
All connections between Bizible components as well as connections
to external components are conducted over secure, encrypted
connections, as further described below.
Bizible Data Flow Narrative The following steps describe how data
flows in a Bizible implementation. This section assumes that the
customer has already defined the data they want to track. Step
numbers correspond to the numbers in Figure 2, below:
1. When a visitor lands on a customer’s website with the script tag
referencing Bizible. js, the visitor’s browser makes a request to
one of Verizon’s EdgeCast Content Delivery Network (CDN) servers1.
This request includes a standard set of information about the
user’s machine configuration and the page they are viewing as well
as the pre-defined information the customer wants to track.
Along with the script, the EdgeCast server returns a cookie
containing a pseudonymous visitor ID, which is included in
subsequent page requests.
2. Throughout the visitor’s web session, the Bizible client-side
code relays the tracked information to the Bizible Tracking Server
using HTTPS.
3. The EdgeCast server forwards the user data to the Bizible
Tracking Server using HTTPS. This data is then stored in Azure
Table Storage.
4. Periodically, the raw EdgeCast logs are downloaded to Bizible
using SFTP. The logs are then processed and the information is
stored in Azure Table Storage (for redundancy).
5. The Bizible processing platform periodically (typically every 15
minutes) queries external integrations (e.g., CRM, ad providers)
for any updates since the last synchronization point.2
6. These updates are applied to Bizible customer-specific data in
the segregated client data store. (For more information on data
segregation, please see the “Additional Bizible Security Controls”
section below.)
7. The Bizible processing platform updates the touchpoint and
attribution data based on the configuration settings stored in the
Bizible product configuration database. The results are then stored
in the segregated client data store.
8. Periodically, some of the data in the segregated client data
store is exported into an external data warehouse (a Snowflake
instance hosted in Azure East-US2).
9. If the customer has purchased the data warehouse add-on feature,
they are given access to a read-only Snowflake account to access
their data warehouse.
10. The customer can also access static data dashboards
(implemented using Looker) to inspect their data directly using the
Bizible UI.
1 Bizible hosts Bizible.js on Verizon EdgeCast CDN servers to
ensure high performance and eliminate latency. 2 All processing
settings can be customized using the Bizible UI.
6
Bizible Reporting
Figure 2: Bizible Data Flow
Bizible uses HTTPS TLS v1.2 to protect data in transit. For
redundancy purposes, Bizible also downloads the tracking logs from
the Verizon EdgeCast CDN using SFTP.
Bizible User Authentication Access to Bizible requires
authentication with username and password. We continually work
with our development teams to implement new protections based
on evolving authentication standards.
Users can access Bizible in one of three (3) different types of
user-named licensing:
Adobe ID is for Adobe-hosted, user-managed accounts that are
created, owned, and controlled by individual users.
Enterprise ID is an Adobe-hosted, enterprise-managed option for
accounts that are created and controlled by IT administrators from
the customer enterprise organization. While the organization owns
and manages the user accounts and all associated assets, Adobe
hosts the Enterprise ID and performs authentication. Admins can
revoke access to Adobe Bizible by taking over the account or by
deleting the Enterprise ID to permanently block access to
associated data.
7
Federated ID is an enterprise-managed account where all identity
profiles—as well as all associated assets—are provided by the
customer’s Single Sign-On (SSO) identity management system and are
created, owned, controlled by customers’ IT infrastructure. Adobe
integrates with most any SAML2.0 compliant identity provider.
Adobe IDs and Enterprise IDs both leverage the SHA-256 hash
algorithm in combination with password salts and a large number of
hash iterations. Adobe continually monitors Adobe- hosted accounts
for unusual or anomalous account activity and evaluates this
information to help quickly mitigate threats to their security. For
Federated ID accounts, Adobe does not manage the users’
passwords.
Application and service entitlement is accomplished through the
Adobe Enterprise Dashboard. More information on the dashboard is
available here: https://helpx.adobe.com/
enterprise/help/aedash.html
For more information on Adobe Identity Management Services (IMS),
please see
https://www.adobe.com/content/dam/acom/en/security/pdfs/AdobeIdentityServices.pdf
Bizible Hosting and Security The Bizible solution is hosted on
Adobe-leased data centers managed by our trusted cloud hosting
provider, Microsoft Azure, in US-North Central and East
US2-Virginia. Adobe cloud service infrastructure partners maintain
very strict controls around data center access, fault tolerance,
environmental controls and network security. Only approved,
authorized Adobe employees, cloud service provider employees, and
contractors with a legitimate, documented business are allowed
access to the secured sites.
For more information on Microsoft Azure security, please see
https://azure.microsoft.com/en-us/services/security-center/
Additional Bizible Security Controls Adobe works with its cloud
infrastructure providers to ensure the following requirements
are met for all Bizible services.
Segregated Client Data Each customer’s data is stored in a
dedicated Azure Storage Account and a dedicated Snowflake schema.
The only access to these servers and databases is via secure access
by the application. All other access to the application and content
servers is made only by authorized Adobe personnel and is conducted
via encrypted channels over secure management connections.
Disaster Recovery Bizible is hosted on Microsoft Azure continuously
active Availability Zone (AZ) data center configurations. All
Bizible data centers are highly resilient, designed to deliver high
availability and tolerate system or hardware failures with minimal
impact. Each data center runs on its own physically distinct and
independent infrastructure to help ensure business continuity in
the event of an outage. More information about our data center
configurations, including our recovery point objective (RPO) and
recovery time objective (RTO) commitments, can be found on the
Adobe Support website.
Availability and Notification For both planned and unplanned system
downtime, the Bizible team follows a notification process to inform
customers about the status of the service. If there is a need to
migrate the operational service from a primary site to a disaster
recovery site, Adobe can send a customer specific notifications,
including:
• Notification of the intent to migrate the services to the
disaster recovery site
• Hourly progress updates during the service migration
• Notification of completion of the migration to the disaster
recovery site
The notifications will also include contact information and
availability for client support and customer success
representatives. These representatives will answer questions and
concerns during the migration as well as after the migration to
promote a seamless transition to newly active operations on a
different regional site.
Product Security
Operational Security
The centers of excellence in the Adobe security program
include:
• Application Security — Focuses on the security of our product
code, conducts threat research, and implements bug bounty.
• Operational Security — Helps monitor and secure our systems,
networks, and production cloud systems.
• Enterprise Security — Concentrates on secure access to and
authentication for the Adobe corporate environment.
• Compliance — Oversees our security governance model, audit and
compliance programs, and risk analysis; and
• Incident Response — Includes our 24x7 security operations center
and threat responders.
Illustrative of our commitment to the security of our products and
services, the centers of excellence report to the office of the
Chief Security Officer (CSO), who coordinates all current security
efforts and develops the vision for the future evolution of
security at Adobe.
10
The Adobe Security Organization Based on a platform of transparent,
accountable, and informed decision-making, the Adobe security
organization brings together the full range of security services
under a single governance model. At a senior level, the CSO closely
collaborates with the Chief Information Officer (CIO) and Chief
Privacy Officer (CPO) to help ensure alignment on security strategy
and operations.
In addition to the centers of excellence described above, Adobe
embeds team members from legal, privacy, marketing, and PR in the
security organization to help drive transparency and accountability
in all security-related decisions.
Marketing & PR
Physical Security
Application Security
Security Tooling
Trust & Safety
Figure 4: The Adobe Security Organization
As part of our company-wide culture of security, Adobe requires
that every employee completes our security awareness and education
training, which requires completion and re-certification on an
annual basis, helping ensure that every employee contributes to
protecting Adobe corporate assets as well as customer and employee
data. On hire, our technical employees, including engineering and
technical operations teams, are auto- enrolled in an in-depth
‘martial arts’-styled training program, which is tailored to their
specific roles. For more information on our culture of security and
our training programs, please see the Adobe Security Culture white
paper.
The Adobe Secure Product Lifecycle Integrated into several stages
of the product lifecycle—from design and development to quality
assurance, testing, and deployment— the Adobe Secure Product
Lifecycle (SPLC) is the foundation of all security at Adobe. A
rigorous set of several hundred specific security activities
spanning software development practices, processes, and tools, the
Adobe SPLC defines clear, repeatable processes to help our
development teams build security into our products and services and
continuously evolves to incorporate the latest industry
best practices.
Secure Operations • Incident Response • reat Intelligence • Logging
• Monitoring • Abuse & Fraud Prevention
Secure Development
• Static & Dynamic Analysis • Secure Code Review
• Secure Conguration • Operational Security Controls • External
& Internal Penetration Testing
• Security Scanning • Auto-remediation
Figure 5: The Adobe Secure Product Lifecycle
Adobe maintains a published Secure Product Lifecycle Standard that
is available for review upon request. More information about the
components of the Adobe SPLC can be found in the Adobe Application
Security Overview.
Adobe Application Security At Adobe, building applications in a
“secure by default” manner begins with the Adobe Application
Security Stack. Combining clear, repeatable processes based on
established research and experience with automation that helps
ensure consistent application of security controls, the Adobe
Application Security Stack helps improve developer efficiency and
minimize the risk of security mistakes. Using tested and
pre-approved secure coding blocks that eliminate the need to code
commonly used patterns and blocks from scratch, developers can
focus on their area of expertise while knowing their code is
secure. Together with testing, specialized tooling, and monitoring,
the Adobe Application Security Stack helps software developers to
create secure code by default.
Static Analysis | Root Cause Analysis | Connecting the Dots Dynamic
Analysis | Scalable Testing Framework | Inventory
reat Model (Automated) | Soware Composition Analysis Static
Analysis | Dynamic Analysis
Trust Modeling (Manual) | Ticketing | Dashboards
Security Features | Secure-by-Default/Paved PathsSecure Building
Blocks
Custom Security Automation
Figure 6: The Adobe Application Security Stack
Adobe also maintains several published standards covering
application security, including those for work specific to our use
of Amazon Web Services (AWS) and Microsoft Azure public cloud
infrastructure. These standards are available for view upon
request. For more information on Adobe application security,
please see the Adobe Application Security Overview.
IaaS Monitoring | Vulnerability Scanning | Hubble (Host) Scanning
Syslog | Port Scanning | Container Scanning | Kubernetes
Monitoring
Secure Host Login | Secret Storage | Central Cloud Account
Provisioning Image Factory | Secure Cloud Policy
SIEM | Bug Database | Central Cloud Account Provisioning Active
Directory | Container Inventory
Ticketing | Dashboards
Figure 7: The Adobe Operational Security Stack
Adobe maintains several published standards covering our ongoing
cloud operations that are available for view upon request. For a
detailed description of the Adobe OSS and the specific tools used
throughout Adobe, please see the Adobe Operational Security
Overview.
Adobe Enterprise Security In addition to securing our products and
services as well as our cloud hosting operations, Adobe also
employs a variety of internal security controls to help ensure the
security of our internal networks and systems, physical corporate
locations, employees, and our customers’ data.
For more information on our enterprise security controls and
standards we have developed for these controls, please see the
Adobe Enterprise Security Overview.
Adobe Compliance All Adobe products and services adhere to the
Adobe Common Controls Framework (CCF), a set of security
activities and compliance controls that are implemented within our
product operations teams as well as in various parts of our
infrastructure and application teams. As much as possible,
Adobe leverages leading-edge automation processes to alert teams to
possible non-compliance situations and help ensure swift mitigation
and realignment.
Adobe products and services either meet applicable legal standards
or can be used in a way that enables customers to help meet their
legal obligations related to the use of service providers.
Customers maintain control over their documents, data, and
workflows, and can choose how to best comply with local or regional
regulations, such as the General Data Protection Regulation (GDPR)
in the EU.
Adobe also maintains a compliance training and related standards
that are available for review upon request. For more information on
the Adobe CCF and key certifications, please see the Adobe
Compliance, Certifications, and Standards List.
Incident Response Adobe strives to ensure that its risk and
vulnerability management, incident response, mitigation, and
resolution processes are nimble and accurate. We continuously
monitor the threat landscape, share knowledge with security experts
around the world, swiftly resolve incidents when they occur, and
feed this information back to our development teams to help achieve
the highest levels of security for all Adobe products and
services.
We also maintain internal standards for incident response and
vulnerability management that are available for view upon request.
For more detail on Adobe’s incident response and notification
process, please see the Adobe Incident
Response Overview.
Business Continuity and Disaster Recovery The Adobe Business
Continuity and Disaster Recovery (BCDR) Program is composed of the
Adobe Corporate Business Continuity Plan (BCP) and product-specific
Disaster Recovery (DR) Plans, both of which help ensure the
continued availability and delivery of Adobe products and services.
Our ISO 22301-certified BCDR Program enhances our ability to
respond to, mitigate, and recover from the impacts of unexpected
disruptions. More information on the Adobe BCDR Program can be
found here.
© October 2021 Adobe. All rights reserved.
Adobe and the Adobe logo are either registered trademarks or
trademarks of Adobe in the United States and/or other
countries.
Conclusion The proactive approach to security and stringent
procedures described in this paper help protect the security of
Bizible and your confidential data. At Adobe, we take the security
of your digital experience very seriously and we continuously
monitor the evolving threat landscape to try to stay ahead of
malicious activities and help ensure the security our customers’
data.
More information on Adobe security can be found on the Adobe Trust
Center.