Historias persistentes
In-Memory
Datos
Integraciones
Media Cloud
Analytics
Documentos
Datos empresariales
Cifrado AES 256
Usuarios y administradores
Workday security model
Duo Security
Los intentos de acceso no autorizados se registran y se supervisan en el departamento de seguridad del centro de datos.
Disponen de personal de seguridad que los supervisa en todo momento.
Cuentan con sistemas de videovigilancia en los puntos internos y externos de entrada más importantes.
Las áreas más importantes requieren una autenticación biométrica de doble factor.
Cuentan con varias capas de autenticación antes de poder acceder a la zona de servidores.
RGPD
aquí.
Los reglamentos sobre la privacidad de los datos pueden ser complejos, variar de un país a otro e imponer unos requisitos muy estrictos. Workday siempre cumple con las obligaciones de protección de datos vigentes, y ofrece una funcionalidad y unas prácticas de privacidad muy sólidas que permiten que clientes de todo el mundo cumplan sus compromisos de privacidad.
Además, ofrecemos a los equipos jurídicos y de cumplimiento normativo de nuestros clientes una gran variedad de recursos de la Comunidad Workday, así como información para entender los requisitos de cumplimiento normativo de sus organizaciones y saber cómo darles validez. También les proporcionamos información sobre cómo Workday puede ayudarles a la hora de ajustarse a ese cumplimiento normativo.
Las cuestiones relacionadas con la protección de datos y su legislación a escala internacional no paran de evolucionar y son cada vez más complejas. Por eso, Workday entiende la importancia de integrar de forma nativa un programa de privacidad arraigado en la cultura y en los servicios de nuestra empresa. En Workday, estamos comprometidos con los estándares globales de privacidad, y un buen ejemplo es nuestra dedicación a programas como el Privacy Shield, las reglas económicas transfronterizas de privacidad de la región de Asia-Pacífico y el RGPD.
Como proveedor de servicios, Workday siempre se centra en el cliente. Creemos que las relaciones se basan en la confianza, y la confianza es algo que se gana, no se regala. Workday no se toma esa responsabilidad a la ligera, y se compromete no solo a ganarse la confianza de sus clientes, sino a mantenerla.
En definitiva, en Workday hemos integrado la seguridad en el tejido de todo lo que hacemos. Nuestros procedimientos y nuestras medidas, de gran sofisticación, garantizan que los clientes cuentan con un entorno de trabajo de alto rendimiento que también es sumamente seguro, tanto desde la perspectiva de la aplicación como desde la perspectiva técnica o de cumplimiento normativo.
Workday sigue explorando nuevas formas de ayudar a sus clientes a proteger sus datos, centrándose siempre en crear una cultura de seguridad. Certificamos constantemente la seguridad de Workday frente a los requisitos de cumplimiento normativo más estrictos del sector, y ofrecemos mejores prácticas y formación exhaustivas a toda la plantilla y a toda la comunidad de clientes de Workday. Como todos nuestros clientes utilizan una sola versión, somos capaces de responder con rapidez y de forma global ante posibles amenazas y vulnerabilidades, y nos aseguramos de que todos estén actualizados. Obtenga más información acerca de cómo Workday mantiene la privacidad y seguridad de las empresas aquí.
A continuación, profundizaremos en la arquitectura de Workday, que puede resultar difícil de representar en un diagrama debido a las complejidades derivadas de las relaciones entre sus distintos servicios y de cómo estos funcionan en conjunto. Para ayudarnos a explicar debidamente cómo funciona la arquitectura de Workday, utilizamos la metáfora del plano de una ciudad.
Privacidad, confianza y cumplimiento normativo
Workday ofrece a auditores y administradores una amplia serie de informes que muestran cómo utilizan los usuarios el entorno de Workday. El registro de auditoría, los registros de actividad de los usuarios y los informes de inicio de sesión son las funciones favoritas de los clientes y auditores de Workday.
Auditorías
Workday aloja sus sistemas de producción en centros de última generación. Estos se han diseñado para albergar sistemas informáticos que desempeñan una tarea crucial y cuentan con subsistemas redundantes y zonas de seguridad compartimentadas. Los centros de datos de Workday cumplen unas medidas físicas de seguridad muy estrictas:
La seguridad física
Workday también ha implementado procedimientos proactivos de seguridad de red en cloud, como los sistemas de defensa perimetral y de prevención de intrusiones en la red. Workday, así como otros proveedores externos, analizan y llevan a cabo con frecuencia evaluaciones de vulnerabilidades y pruebas de penetración en la infraestructura de red de Workday.
La seguridad de red
Los usuarios acceden a Workday a través de Internet, y esos accesos están protegidos por el protocolo de seguridad de la capa de transporte (TLS). De esta forma, se protege el tráfico de la red frente a escuchas pasivas, manipulaciones activas o falsificación de mensajes.
Cifrado de datos en tránsito
Una de las características de diseño fundamentales de Workday es que ciframos todos los atributos de los datos de clientes de las aplicaciones con el algoritmo del estándar de cifrado avanzado AES antes de que esos datos sigan utilizándose. Este nivel de cifrado es complejo pero asumible, teniendo en cuenta que Workday es una aplicación orientada a objetos in-memory, lo que la distingue del resto de aplicaciones de sistemas de gestión de bases de datos relacionales (RDBMS) basadas en disco. Todas las inserciones, actualizaciones y eliminaciones de datos se envían al mismo almacén persistente de una base de datos MySQL. El uso de esta arquitectura única implica que Workday funciona solo con varias docenas de tablas de bases de datos. En cambio, una aplicación basada en un sistema RDBMS necesita decenas de miles de tablas, y esto hace que el cifrado completo de bases de datos no sea práctico, ya que resulta bastante perjudicial para el rendimiento del sistema.
Cifrado de datos en reposo
La autorización determina el acceso de un usuario a un sistema después de que este haya demostrado su identidad. Se define y rige según el modelo de seguridad configurable de Workday.
Workday impone una seguridad basada en políticas de grupo para la autorización. Los grupos de seguridad de Workday, junto con las políticas de seguridad predefinidas, conceden o restringen el acceso de usuarios a la funcionalidad, los procesos de negocio, los informes y los datos de Workday.
Los grupos de seguridad configurables por el cliente son flexibles y pueden basarse en usuarios, roles, puestos, organizaciones o sedes. Se pueden combinar para crear nuevos grupos de seguridad que incluyan y excluyan a otros grupos de forma lógica, aumentando así la flexibilidad general. El acceso de sistema a sistema viene definido por los grupos de seguridad del sistema de integración. Los administradores pueden personalizar los grupos y las políticas para que se ajusten a sus necesidades mediante accesos lo más específicos posible con el fin de tener compatibilidad con configuraciones o implementaciones globales complejas.
Autorización
Con el fin de reforzar aún más la autenticación y evitar que se produzcan ataques, Workday incluye opciones de autenticación mediante SMS y aplicaciones dentro de la autenticación multifactor (MFA), entre las que se incluye una colaboración con Duo Security, un proveedor de ciberseguridad que ofrece una MFA de acceso seguro fácil de usar. De esta forma, el modelo de seguridad único e integrado de Workday se complementa con la funcionalidad de MFA de Duo Security, que se integra a la perfección en la interfaz de usuario de Workday.
Autenticación multifactor
Las organizaciones que utilizan SAML, pero tienen dudas con respecto al acceso no autorizado cuando alguien deja su consola abierta o varios usuarios acceden a Workday desde el mismo dispositivo, pueden identificar las zonas con más riesgo de Workday e implementar un segundo factor de autenticación que los usuarios deben introducir para poder acceder a ellas. Esta capacidad se llama "autenticación de nivel superior", una técnica eficaz para reducir el riesgo de que alguien tome el control de las cuentas de nuestros clientes.
Autenticación de nivel superior
Si el cliente usa el inicio de sesión de Workday, sus contraseñas de Workday solo se almacenan como hash seguro, y no como contraseñas propiamente dichas. Toda la actividad de inicios de sesión erróneos y de inicios y cierres de sesión correctos se registra con fines de auditoría. Las sesiones de usuario inactivas caducan de forma automática después de cierto tiempo, y el cliente puede configurar el tiempo de espera por usuario o rol. Además, Workday ofrece numerosas reglas de contraseña que el cliente puede configurar, como las referidas a longitud, complejidad, caducidad y las preguntas para recuperar una contraseña olvidada.
Inicio de sesión nativo de Workday
La autenticación LDAP nos permite tener un nombre de usuario y una contraseña unificados, mientras que SAML va un paso más allá y posibilita un entorno de inicio de sesión único (SSO) empresarial. Aunque la autenticación delegada LDAP permite a los usuarios tener el mismo nombre de usuario y la misma contraseña para las aplicaciones internas y Workday, es necesario iniciar sesión dos veces. Sin embargo, con SAML, los usuarios pueden disfrutar de una experiencia de inicio de sesión único tanto en los portales web internos como en Workday.
Compatibilidad con inicio de sesión único
Workday es compatible con la autenticación delegada mediante un servidor LDAP en las instalaciones del cliente, como Microsoft Active Directory. Esta función resulta útil cuando el equipo de seguridad del cliente tiene que desactivar una cuenta de usuario desde el servidor LDAP sin tener que iniciar sesión en Workday. Workday también es capaz de actualizar el servidor LDAP de forma automática con las cuentas de usuario activas que se crean después de nuevas contrataciones, o con las cuentas desactivadas de empleados que se han ido o están de baja.
Autenticación delegada
El primer paso para garantizar una experiencia segura es poder determinar que el usuario o el sistema que acceden a Workday son auténticos. Nuestros clientes pueden crear identidades de usuario final dentro de Workday o integrarlas en Workday desde sistemas externos, como Active Directory. Algunas de las identidades habituales de Workday son las de Trabajador, Colaborador externo, Candidato o Alumno.
El siguiente paso es demostrar esa identidad. Con las técnicas de autenticación podemos demostrar la identidad de usuarios y sistemas. Los usuarios pueden iniciar sesión en Workday de muchas formas, como la autenticación delegada LDAP, SAML, la autenticación a través del certificado X.509 (para integraciones del servicio web y usuarios) y la autenticación nativa de Workday o la autenticación multifactor.
Identidad y autenticación
Cifrado y seguridad de red
Además de los beneficios principales del modelo de seguridad único de Workday, aplicamos continuamente prácticas recomendadas y tecnologías del sector de la seguridad cloud para detectar, prevenir y eliminar amenazas, así como para proteger la privacidad global de los datos. Veamos las áreas principales de la seguridad y la privacidad de Workday.
Ciclo de vida de la seguridad de Workday
En otras palabras, la seguridad se aplica continuamente a todos los datos independientemente de cómo y desde dónde se utilizan o se accede a ellos. Este modelo de seguridad universal, junto con la capacidad automatizada de Workday de realizar auditorías de todas las actualizaciones de datos, permiten que los administradores de seguridad disminuyan el tiempo y los costes relacionados con el gobierno y el cumplimiento normativo. Y, sobre todo, este modelo de seguridad universal reduce el riesgo de seguridad general para todos los usuarios de Workday.
El modelo de seguridad de Workday
El modelo de seguridad único de Workday se aplica continuamente a todos los datos
Todos los usuarios y sistemas que accedan a Workday deben pasar por un proceso de autenticación y autorización con el modelo de seguridad de Workday. Por su parte, los sistemas ERP tradicionales suelen tener una capa de seguridad en la aplicación que el personal de TI o de administración de bases de datos puede sortear para acceder directamente a los datos en el nivel de base de datos.
En Workday, la seguridad no puede sortearse. Workday es un sistema in-memory orientado a objetos que cuenta con un almacén de datos persistente y cifrado. Nadie tiene acceso directo al almacén de datos. Los usuarios y administradores solo pueden acceder a los datos de forma indirecta a través de las API, que exigen el cumplimiento de las políticas de autorización y acceso. Se realizan seguimientos y auditorías constantes de todos los accesos y las modificaciones, y el modelo de seguridad basado en políticas de Workday se aplica a todos los accesos a datos en todas las aplicaciones de Workday.
Compare este sistema con los complejos sistemas legacy que tienen modelos de seguridad enrevesados y difíciles de entender por completo. Estos sistemas suelen tener varias formas de proteger el acceso a los datos en sus diferentes arquitecturas e integraciones. Esta complejidad suele generar errores y descuidos que tienen graves consecuencias, sobre todo en el caso del acceso a herramientas personalizadas de análisis y generación de informes. Por el contrario, el modelo de seguridad de Workday es universal. Por ejemplo, nuestro generador de informes aplica la misma seguridad basada en políticas a nivel granular a todos los datos de todos los informes que crea un cliente, y esa seguridad sigue vigente incluso cuando los informes se distribuyen y se accede a ellos a través de dispositivos móviles, cuadros de mando y hojas de cálculo, así como a través de API de servicios web de Workday y el workflow que se procesa en nuestro process framework de gestión.
Para Workday el modelo de seguridad es un elemento central, ya que es la forma que tenemos de garantizar la seguridad de los datos de nuestros clientes de forma constante. Este modelo nos permite implementar la seguridad a escala, y además, que las mejoras de seguridad que se llevan a cabo para un cliente también beneficien al resto de clientes. Nuestros clientes de menor tamaño de sectores menos regulados pueden aprovechar los beneficios de la inversión que realizamos para satisfacer a nuestros clientes de mayor tamaño de sectores más regulados.
Uno de los principios para lograr una seguridad sin fisuras es la sencillez. Workday logra una seguridad sin fisuras de forma sencilla aplicando un solo modelo de seguridad a todos los datos, las transacciones, los procesamientos y las aplicaciones. Todos los usuarios finales, administradores y sistemas que acceden a Workday a través de la IU, las API y las integraciones utilizan el mismo modelo de acceso. De esta forma, se simplifica la administración y se garantiza que las personas y entidades adecuadas tengan el acceso correcto a los datos adecuados. El modelo de acceso único también reduce los riesgos asociados con las puertas traseras de acceso de administración habituales en otras aplicaciones tradicionales.
Y, conforme Workday desarrolla y ofrece nuevas funcionalidades y actualizaciones para la aplicación, la seguridad es un elemento esencial de nuestro proceso de distribución continua. Workday usa las pruebas de seguridad automatizadas como elemento esencial de nuestro pipeline de distribución continua y, como todos los clientes utilizan la misma versión, pueden acceder a todas las actualizaciones de seguridad al instante. Nadie se queda atrás por tener una versión antigua de nuestras aplicaciones.
El modelo de seguridad único también implica que consideramos todos los datos de nuestros clientes confidenciales y ciframos todos los datos en reposo. Las capacidades de auditoría están perfectamente integradas en nuestras aplicaciones, por lo que Workday realiza auditorías continuas y permanentes de todos los datos de los clientes. Además, los procesos de negocio se dan dentro de Workday, y no fuera, de forma que el alcance de las auditorías es completo y continuo. Otras soluciones suelen utilizar capacidades de auditoría añadidas que no son más que un subconjunto de datos de clientes que se pueden pasar por alto, y esto suele provocar dolores de cabeza a los auditores.
Al evaluar cualquier proveedor de servicios cloud, las evaluaciones externas son esenciales. Tener una sola arquitectura de aplicación implica que nuestras certificaciones de seguridad, nuestras autenticaciones y nuestros informes de auditoría de terceros se aplican de forma global a toda nuestra plataforma tecnológica y a todo nuestro conjunto de aplicaciones. Empleamos toda nuestra energía y nuestra atención en los procesos de auditorías y certificaciones con el fin de garantizar que los datos sean privados y estén protegidos.
Las organizaciones de todo el mundo tienen la misión de proteger los datos de sus clientes, sus empleados y su propiedad intelectual en un entorno en el que las amenazas a la seguridad son cada vez más sofisticadas. Por este motivo, la seguridad es la preocupación principal de Workday. Cuando creamos software que alberga algunos de los datos más confidenciales de las empresas, la seguridad debe ser un aspecto fundamental de la aplicación, y no algo opcional. En esta época, en la que los reglamentos son cada vez más exigentes, las capacidades de cumplimiento normativo y auditoría son esenciales.
La seguridad de Workday comienza por el concepto de Power of One.
Con la seguridad de Workday, se acabaron las puertas traseras
The Power of One: un solo modelo de seguridad
La seguridad de Workday: protegemos lo que importa
Power of One: A Single Security Model
With Workday Security, There Are No “Backdoors”
Around the globe, organizations are tasked with securing and protecting their customer, employee, and intellectual property data in an environment of increasingly sophisticated security threats. So at Workday, security is job one. When creating software that houses some of the most sensitive data that enterprises have, security must be built into the core of our application, not bolted on. And in an era of increasing regulatory scrutiny, compliance and audit capabilities are a must.
Security at Workday starts with the Power of One.
Central to Workday is our single security model—critical to how we continuously ensure the security of our customers’ data.
This model enables us to deploy security at scale, and security improvements for one customer benefit all of our customers. Our smallest customers in less regulated industries are able to realize the benefits of the investments we make to meet the risk appetite of our largest, most regulated customers.
One of the tenets of strong security is simplicity. Workday achieves simplicity with strong security by extending the
single security model to all data, transactions, processing, and applications. All end users, administrators, systems accessing Workday through its UI, APIs, and integrations use the same access model. This streamlines administration, making it easier to ensure that the right people and entities have the right access to the right data. The single access model also mitigates the risks associated with administrative “backdoor” access that are present in other legacy applications.
And as Workday develops and delivers new application features and updates, security is integral to our continuous delivery process. Workday applies automated security testing as a fundamental part of our continuous delivery pipeline and with every customer on the same version, any security updates are immediately available to all customers. No one is left behind
by being on an older version of our applications.
A single security model also means that we consider all customer data to be sensitive and encrypt all customer data at rest. Audit capabilities are integrated into the fabric of our applications, enabling Workday to have pervasive, always-on auditing for all customer data. And, business processes exist within Workday, not outside of it—allowing for a complete and continuous level
of audit coverage. Other solutions frequently use bolted-on audit capabilities that are limited to a subset of customer data and can be bypassed, creating headaches for auditors.
When evaluating any cloud service provider, third-party assessments are essential. Our single application architecture means that our security certifications, attestations, and third-party audit reports apply universally across our platform and to our entire application suite. We put a great deal of energy and focus through extensive auditing and certification processes to ensure that data is private and secure.
Every user and every system accessing Workday must be authenticated and authorized through the Workday security model. By contrast, legacy ERP systems often have an application layer of security that IT and DBA personnel can bypass to access data directly at the database level.
Within Workday, security cannot be bypassed. Workday is an object-oriented in-memory system with an encrypted persistent data store. And no one has direct access to the data store—users and administrators are only able access data indirectly via APIs, which are able to enforce authorization and access policies. All access and changes are continuously tracked and audited, and the Workday group policy-based security model applies for all data access across Workday applications.
Contrast this with complex legacy systems that have security models that are byzantine and hard to fully understand. These systems frequently have several ways of securing access to data across their architectures and integrations. This complexity often leads to errors and oversights that have serious consequences, and is especially true of data access from custom reporting and analytical tools. In contrast, the Workday security model stays universal. For example, our custom report writer applies the same policy-based security at a granular level for all data in all reports that a customer creates, and this security stays in effect even when these reports are distributed and accessed via mobile, dashboards, and worksheets, and through Workday web service APIs and workflow processed in our business process framework.
The Workday Single Security Model Continuously Applies to All Data
Workday Security Model
In other words, security continuously applies to data regardless of how and where it’s used or accessed. This universal security model, combined with the automated ability in Workday to audit all data updates, helps security administrators lower the time and costs associated with governance and compliance. And, vitally, this universal security model reduces the overall security risk for all Workday users.
Workday Security Lifecycle
Along with the core benefits of the Workday single security model, we’re constantly applying the industry’s best cloud security practices and technologies to detect, prevent, and eliminate threats and ensure global data privacy. Let’s explore the key areas of security and privacy throughout Workday:
Encryption and Network Security
Identity and Authentication
The first step in ensuring a secure experience is being able to define that the user or system accessing Workday is authentic. Workday allows customers to create end-user identities within Workday or integrate them into Workday from external systems, such as Active Directory. Typical examples of Identity in Workday are Worker, Contingent Worker, Candidate, or Student.
The next step is to prove it. Authentication techniques prove user or system identity. Users can sign into Workday using a variety of ways including LDAP Delegated Authentication, SAML, and X.509 Certificate Authentication for both user and web service integrations; and Workday Native Authentication or Multi-Factor Authentication.
Delegated Authentication
Workday supports delegated authentication through a customer’s on-premise LDAP server, such as Microsoft Active Directory. This capability supports a customer’s security team when they need to disable a user account centrally from the LDAP server without the need to log in to Workday. Workday can also automatically update the LDAP server with new active user accounts from new hires, or deactivated accounts when employees separate or go on leave of absence.
Single-Sign-On Support
While LDAP allows for a unified username/password, SAML takes the next step and enables an enterprise single-sign-on (SSO) environment. While LDAP Delegated Authentication makes it possible for users to have the same username and password for both their internal applications and Workday,
it still requires the user to log in twice. However, with SAML, users gain a single-sign-on experience between internal web portals and Workday.
Workday Native Login
For customers using the Workday native login, heir Workday passwords are only stored in the form of a secure hash as opposed to the password itself. Unsuccessful logins and successful login/logout activity is captured for audit purposes. Inactive user sessions automatically time-out after a specified time, and are customer configurable by user or role. And Workday provides a number of customer-configurable password rules including length, complexity, expiration,
and forgotten password challenge questions.
Step-Up Authentication
Organizations that use SAML, but have concerns about unauthorized access when someone leaves their console open or multiple users access Workday from the same device, have the ability to identify critical areas of Workday and force a secondary authentication factor that users must enter for access. This capability is called Step-Up Authentication, and is a proven technique to reduce the risk of account takeovers.
Multi-Factor Authentication
To strengthen authentication even further and prevent attacks, Workday includes SMS and authenticator application options for Multi-Factor Authentication (MFA), including a partnership with Duo Security, a cybersecurity provider focused on trusted access and easy-to-use MFA. The partnership complements the single built-in security model
in Workday with Duo’s MFA functionality integrated seamlessly within the Workday user interface.
Authorization
Authorization defines user access after they successfully authenticate into a system. Authorization is defined and governed by the Workday configurable security model.
Workday enforces group policy-based security for authorization. Workday security groups combined with predefined security policies grant or restrict user access to Workday functionality, business processes, reports, and data.
Customer-configurable security groups are flexible and can be based on users, roles, jobs, organizations, or business sites. They can be combined into new security groups that logically include and exclude other groups, increasing overall flexibility. System-to-system access is defined by integration system security groups, and administrators can tailor security groups and policies to meet their needs, providing as finely grained access as needed to support complex configurations or
global deployments.
Encryption of Data at Rest
A fundamental design characteristic of Workday is that we encrypt every attribute of customer data within applications before the data is persisted using the Advanced Encryption Standard (AES) algorithm. This level of encryption is technically challenging but achievable because Workday is an in-memory object-oriented application as opposed to a disk-based RDBMS application. All data inserts, updates, and deletes
are committed to a persistent store on a MySQL database. This unique architecture means Workday operates with only
a few dozen database tables. By contrast, an RDBMS-based application requires tens of thousands of tables, making complete database encryption impractical due to its detrimental impact on performance.
Encryption of Data in Transit
Users access Workday via the internet, and that access is protected by Transport Layer Security (TLS). This secures network traffic from passive eavesdropping, active tampering, or forgery of messages.
Network Security
Workday has also implemented proactive cloud network security procedures, such as perimeter defense and network intrusion prevention systems. Vulnerability assessments and penetration testing of the Workday network infrastructure are evaluated and conducted on a regular basis by both Workday and external third-party vendors.
Physical Security
Workday co-locates its production systems in state-of-the-
art data centers designed to host mission-critical computer systems with fully redundant subsystems and compartmentalized security zones. Workday data centers adhere to the strictest physical security measures, including:
Audit
Workday provides an extensive set of reports available to auditors and administrators on how their users are using the Workday tenant. The audit trail, user activity logs, and sign-on reports are favorites among Workday customers and auditors.
Privacy, Trust, and Compliance
Data privacy regulations can be complex, vary from country
to country, and impose stringent requirements. Workday continuously complies with data protection obligations and delivers strong privacy functionality and practices, enabling customers around the globe to meet their privacy commitments.
Additionally, we provide our customers’ compliance and legal teams with extensive Workday Community resources and information to help understand and validate privacy and compliance requirements for their organization, as well as detail how Workday can help power their compliance efforts.
As data protection issues and global laws continue to evolve and become increasingly complex, Workday understands the importance of a privacy program that is embedded into our company's culture and services. Workday remains committed to global privacy standards, as shown by our dedication to programs such as the Privacy Shield, Asia-Pacific Economic Cross-Border Privacy Rules, and GDPR.
As a service provider, Workday focus is on the customer. We believe that relationships are built on trust, and that trust is something earned, not given. Workday doesn’t take this responsibility lightly and remains fully committed to both earning and maintaining our customers’ trust.
In summary, at Workday, we’ve woven security into the fabric of everything we do. From an application perspective, a compliance perspective, and a technical perspective, our sophisticated measures and procedures ensure that customers receive a high-performance work environment that’s also highly secure.
Yet Workday continues to explore ways to help our customers keep their data safe, with a relentless focus on creating a culture of security. We continuously certify Workday security against the industry's most stringent compliance requirements and provide in-depth best practices and training across the Workday employee base and customer community. With our customers all on a single version, we support a rapid and comprehensive response to emerging threats and vulnerabilities and ensure all customers are up-to-date. Learn more about the ways Workday works to keep privacy and security continuous here.
In the next chapter, we'll take a deeper dive into the Workday architecture, which can be difficult to depict in a traditional stack diagram because of how intricately all the different services interrelate and work together. To help properly convey the details of how Workday architecture functions, we use a city map metaphor. Keep reading for a guided tour of Workday as a city.
Multiple layers of authentication required before granting access to the server area
Critical areas require two-factor biometric authentication
Camera surveillance systems at critical internal and external entry points
Security personnel monitor 24/7
Unauthorized access attempts are logged and monitored by data center security
Users and
administrators
AES 256 Encryption
Business
data
Documents
Analytics
Media
Cloud
Integrations
Data
In-memory
Persistent Stories
Workday Security: We Protect What Matters
Power of One: A Single Security Model
With Workday Security, There Are No “Backdoors”
Around the globe, organizations are tasked with securing and protecting their customer, employee, and intellectual property data in an environment of increasingly sophisticated security threats. So at Workday, security is job one. When creating software that houses some of the most sensitive data that enterprises have, security must be built into the core of our application, not bolted on. And in an era of increasing regulatory scrutiny, compliance and audit capabilities are a must.
Security at Workday starts with the Power of One.
Central to Workday is our single security model—critical to how we continuously ensure the security of our customers’ data. This model enables us to deploy security at scale, and security improvements for one customer benefit all of our customers. Our smallest customers in less regulated industries are able to realize the benefits of the investments we make to meet the risk appetite of our largest, most regulated customers.
One of the tenets of strong security is simplicity. Workday achieves simplicity with strong security by extending the single security model to all data, transactions, processing, and applications. All end users, administrators, systems accessing Workday through its UI, APIs, and integrations use the same access model. This streamlines administration, making it easier to ensure that the right people and entities have the right access to the right data. The single access model also mitigates the risks associated with administrative “backdoor” access that are present in other legacy applications.
And as Workday develops and delivers new application features and updates, security is integral to our continuous delivery process. Workday applies automated security testing as a fundamental part of our continuous delivery pipeline and with every customer on the same version, any security updates are immediately available to all customers. No one is left behind by being on an older version of our applications.
A single security model also means that we consider all customer data to be sensitive and encrypt all customer data at rest. Audit capabilities are integrated into the fabric of our applications, enabling Workday to have pervasive, always-on auditing for all customer data. And, business processes exist within Workday, not outside of it—allowing for a complete and continuous level of audit coverage. Other solutions frequently use bolted-on audit capabilities that are limited to a subset of customer data and can be bypassed, creating headaches for auditors.
When evaluating any cloud service provider, third-party assessments are essential. Our single application architecture means that our security certifications, attestations, and third-party audit reports apply universally across our technology platform and to our entire application suite. We put a great deal of energy and focus through extensive auditing and certification processes to ensure that data is private and secure.
Every user and every system accessing Workday must be authenticated and authorized through the Workday security model. By contrast, legacy ERP systems often have an application layer of security that IT and DBA personnel can bypass to access data directly at the database level.
Within Workday, security cannot be bypassed. Workday is an object-oriented in-memory system with an encrypted persistent data store. And no one has direct access to the data store—users and administrators are only able to access data indirectly via APIs, which are able to enforce authorization and access policies. All access and changes are continuously tracked and audited, and the Workday group policy-based security model applies for all data access across Workday applications.
Contrast this with complex legacy systems that have security models that are byzantine and hard to fully understand. These systems frequently have several ways of securing access to data across their architectures and integrations. This complexity often leads to errors and oversights that have serious consequences, and is especially true of data access from custom reporting and analytical tools. In contrast, the Workday security model stays universal. For example, our report writer applies the same policy-based security at a granular level for all data in all reports that a customer creates, and this security stays in effect even when these reports are distributed and accessed via mobile, dashboards, and worksheets, and through Workday web service APIs and workflow processed in our business process framework.
The Workday Single Security Model Continuously Applies to All Data
Workday Security Model
In other words, security continuously applies to data regardless of how and where it’s used or accessed. This universal security model, combined with the automated ability in Workday to audit all data updates, helps security administrators lower the time and costs associated with governance and compliance. And, vitally, this universal security model reduces the overall security risk for all Workday users.
Workday Security Lifecycle
Along with the core benefits of the Workday single security model, we’re constantly applying the industry’s best cloud security practices and technologies to detect, prevent, and eliminate threats and ensure global data privacy. Let’s explore the key areas of security and privacy throughout Workday:
Encryption and Network Security
Identity and Authentication
The first step in ensuring a secure experience is being able to define that the user or system accessing Workday is authentic. Workday allows customers to create end-user identities within Workday or integrate them into Workday from external systems, such as active directory. Typical examples of identity in Workday are worker, contingent worker, candidate, or student.
The next step is to prove it. Authentication techniques prove user or system identity. Users can sign into Workday using a variety of ways, including LDAP Delegated Authentication, SAML, and X.509 Certificate Authentication for both user and web service integrations; and Workday Native Authentication or Multi-Factor Authentication.
Delegated Authentication
Workday supports delegated authentication through a customer’s on-premise LDAP server, such as Microsoft Active Directory. This capability supports a customer’s security team when they need to disable a user account centrally from the LDAP server without the need to log in to Workday. Workday can also automatically update the LDAP server with new active user accounts from new hires, or deactivated accounts when employees separate or go on leave of absence.
Single-Sign-On Support
While LDAP allows for a unified username/password, SAML takes the next step and enables an enterprise single-sign-on (SSO) environment. While LDAP Delegated Authentication makes it possible for users to have the same username and password for both their internal applications and Workday, it still requires the user to log in twice. However, with SAML, users gain a single-sign-on experience between internal web portals and Workday.
Workday Native Login
For customers using the Workday native login, heir Workday passwords are only stored in the form of a secure hash as opposed to the password itself. Unsuccessful logins and successful login/logout activity is captured for audit purposes. Inactive user sessions automatically time-out after a specified time, and are customer configurable by user or role. And Workday provides a number of customer-configurable password rules including length, complexity, expiration, and forgotten password challenge questions.
Step-Up Authentication
Organizations that use SAML, but have concerns about unauthorized access when someone leaves their console open or multiple users access Workday from the same device, have the ability to identify critical areas of Workday and force a secondary authentication factor that users must enter for access. This capability is called Step-Up Authentication, and is a proven technique to reduce the risk of account takeovers.
Multi-Factor Authentication
To strengthen authentication even further and prevent attacks, Workday includes SMS and authenticator application options for Multi-Factor Authentication (MFA), including a partnership with Duo Security, a cybersecurity provider focused on trusted access and easy-to-use MFA. The partnership complements the single built-in security model in Workday with Duo’s MFA functionality integrated seamlessly within the Workday user interface.
Authorization
Authorization defines user access after they successfully authenticate into a system. Authorization is defined and governed by the Workday configurable security model.
Workday enforces group policy-based security for authorization. Workday security groups combined with predefined security policies grant or restrict user access to Workday functionality, business processes, reports, and data.
Customer-configurable security groups are flexible and can be based on users, roles, jobs, organizations, or business sites. They can be combined into new security groups that logically include and exclude other groups, increasing overall flexibility. System-to-system access is defined by integration system security groups, and administrators can tailor security groups and policies to meet their needs, providing as finely grained access as needed to support complex configurations or global deployments.
Encryption and Network Security
A fundamental design characteristic of Workday is that we encrypt every attribute of customer data within applications before the data is persisted using the Advanced Encryption Standard (AES) algorithm. This level of encryption is technically challenging but achievable because Workday is an in-memory object-oriented application as opposed to a disk-based RDBMS application. All data inserts, updates, and deletes are committed to a persistent store on a MySQL database. This unique architecture means Workday operates with only a few dozen database tables. By contrast, an RDBMS-based application requires tens of thousands of tables, making complete database encryption impractical due to its detrimental impact on performance.
Encryption of Data in Transit
Users access Workday via the internet, and that access is protected by Transport Layer Security (TLS). This secures network traffic from passive eavesdropping, active tampering, or forgery of messages.
Network Security
Workday has also implemented proactive cloud network security procedures, such as perimeter defense and network intrusion prevention systems. Vulnerability assessments and penetration testing of the Workday network infrastructure are evaluated and conducted on a regular basis by both Workday and external third-party vendors.
Physical Security
Workday co-locates its production systems in state-of-the-art data centers designed to host mission-critical computer systems with fully redundant subsystems and compartmentalized security zones. Workday data centers adhere to the strictest physical security measures, including:
Audit
Workday provides an extensive set of reports available to auditors and administrators on how their users are using the Workday tenant. The audit trail, user activity logs, and sign-on reports are favorites among Workday customers and auditors.
Privacy, Trust, and Compliance
Data privacy regulations can be complex, vary from country to country, and impose stringent requirements. Workday continuously complies with data protection obligations and delivers strong privacy functionality and practices, enabling customers around the globe to meet their privacy commitments.
Additionally, we provide our customers’ compliance and legal teams with extensive Workday Community resources and information to help understand and validate privacy and compliance requirements for their organization, as well as detail how Workday can help power their compliance efforts.
As data protection issues and global laws continue to evolve and become increasingly complex, Workday understands the importance of a privacy program that is embedded into our company's culture and services. Workday remains committed to global privacy standards, as shown by our dedication to programs such as the Privacy Shield, Asia-Pacific Economic Cross-Border Privacy Rules, and GDPR.
As a service provider, Workday focus is on the customer. We believe that relationships are built on trust, and that trust is something earned, not given. Workday doesn’t take this responsibility lightly and remains fully committed to both earning and maintaining our customers’ trust.
In summary, at Workday, we’ve woven security into the fabric of everything we do. From an application perspective, a compliance perspective, and a technical perspective, our sophisticated measures and procedures ensure that customers receive a high-performance work environment that’s also highly secure.
Yet Workday continues to explore ways to help our customers keep their data safe, with a relentless focus on creating a culture of security. We continuously certify Workday security against the industry's most stringent compliance requirements and provide in-depth best practices and training across the Workday employee base and customer community. With our customers all on a single version, we support a rapid and comprehensive response to emerging threats and vulnerabilities and ensure all customers are up-to-date. To learn more about the ways Workday works to keep privacy and security continuous, visit: trust.workday.com
Next, we'll take a deeper dive into the Workday architecture, which can be difficult to depict in a traditional stack diagram because of the intricacies of how all the different services interrelate and work together. To help properly convey the details of how Workday architecture functions, we use a city map metaphor.
Multiple layers of authentication required before granting access to the server area
Critical areas require two-factor biometric authentication
Camera surveillance systems at critical internal and external entry points
Security personnel monitor 24/7
Unauthorized access attempts are logged and monitored by data center security
Users and
administrators
AES 256 Encryption
Business
data
Documents
Analytics
Media
Cloud
Integrations
Data
In-memory
Persistent Stories
Workday Security: We Protect What Matters
