Note: This announcement was originally posted to Ninja’s customer community and highlighted in-app on July 3, 2021. We are posting publicly here on the blog to improve visibility and help partners share more easily with their end customers.
Ninjas,
By now, most of you are likely aware of the ransomware situation involving Kaseya VSA that is impacting MSPs and their end customers. Like you, we are monitoring the situation extremely closely, and we want to reassure you that we have found no indication that this or any similar attack has affected Ninja or Ninja partners. To confirm, NinjaOne does not utilize any Kaseya products, services, or components anywhere in our stack.
The questions and concerns that we’ve heard from partners understandably go beyond “Is Ninja affected by this latest event?” though, and extend into “What is Ninja doing to keep us safe?”
We want to provide you with more detail on that front. First, however, we also want to state that we unequivocally stand in solidarity with Kaseya, and condemn this act of terrorism against a business and its customers. These types of events are what keep all of us up at night, and we feel strongly that this is a fight that we are all in together, so we are ready to lend a hand to Kaseya and their team.
With respect to our own internal security efforts: As a vendor, we recognize that you entrust us with your security, and we take that responsibility incredibly seriously. Since our inception, Ninja has placed safeguarding our infrastructure at the highest priority. We are constantly adapting, evaluating, reinforcing, and adding to our security processes and initiatives, and see our work in security as never fully being done.
To give insight into our efforts, the following is a small sampling of the measures that we have taken to help keep Ninja and our partners secure:
- Ninja’s web service and source code is routinely scanned and regularly penetration tested by premiere 3rd party firms for security vulnerabilities, consistently resulting in “HIGHLY SECURE” ratings.
- Our agent management portal is hosted in a secure, isolated cloud environment with strong encryption for all data at rest. Our cloud infrastructure has numerous layers of built-in security by design, and is only hosted on industry-leading cloud providers who have undergone audits resulting in SSAE18 SOC1/SOC2/SOC3 reports.
- In addition, all of our cloud assets, services, and environments are tightly restricted requiring VPNs (using cryptography), two levels of MFA/2FA authentication coupled with SSL Certificates, and monitor/alert on unusual activity and intrusions.
- NinjaOne also undergoes annual independent SSAE18 SOC2 audits, resulting in a report that can be made available to our customers upon request.
- In addition to undergoing independent penetration tests and security assessments against all systems, earlier this year we also launched our own internal red team to constantly probe for and help us address any gaps.
- Finally, NinjaOne has implemented security controls to comply with several US government cyber security standards including:
- NIST Cyber Security Framework (CSF) Revision 1.1
- NIST Special Publication 800-171 Revision 2
- NIST Special Publication 800-53 Revision 5
- US Department of Defense Federal Acquisition Regulation Supplement (DFARS) clause 204-7012
- US Department of Defense Cybersecurity Maturity Model Certification Level (CMMC) 3 (note: have not undergone certification process)
Our staff, and especially our Security Ops team remain ever vigilant in the face of this event. We will continue to monitor for additional information pertaining to the nature of the attack, and will continue to review, adjust, and improve our own security practices now and forever. We live by the code that there is no final destination for security, and we will continue our mission of keeping you and your partners safe.
As always, our team is reachable for questions or concerns, and can be reached at [email protected].
Thank you for being a NinjaOne partner.
Best Regards,
Lewis Huynh
Chief Security Officer
