Kanda Virtual Training Platform

VTP authenticates users with OpenID Connect using Auth0 as the main identity provider.

When logging in, our apps request the following OpenID scopes:

• openid

• profile

• email

• offline_access

Does VTP support Single Sign-On?

Yes, SSO is supported as part of an enterprise license with private cloud deployments.

VTP supports SSO using OpenID Connect federated through our main identity provider. At the moment we support SSO with Azure Active Directory and plan to add more SSO options in the future.

For private cloud deployments, we request that enterprise customers share their OIDC issuer ID and a list of email domains such that we can whitelist them for login.

As an alternative to SSO it is also possible to invite users via email. Each user will need to provide a password. This type of user profile is created and stored in an Auth0 user database.

What is needed from my organisation to enable Single Sign-On?

Each organization might have different requirements, controls and setup for allowing sign-in to applications and have full control of this. However, most enterprise customers does not allow logging in with Microsoft without consent of an administrator. The admin will need to consent on behalf of the organisation in order for all members to be able to login.

How do you manage access rights for VTP users?

For users in the VTP system, the organisation administrator can choose a set of pre-defined roles which limit which kinds of actions a user can take.

We use scoped role-based access control on our Kanda corporate accounts. Access is granted on a principle of “least privilege” which means that a Kanda corporate account will only have access to the essential services needed for that person to do their job.

How often do you review access rights for VTP users?

Within the Web Dashboard, an administrator can review and revoke access rights for users in their organisation.

We review and revoke access rights for Kanda corporate accounts on a regular basis, usually triggered by new hires or employment termination.

Do inactive VTP users get disabled?

VTP requires credential to be refreshed at minimum every 10 hours and a user’s session becomes invalid after 15 days of inactivity, requiring them to re-enter login information.

Enterprise users log in to VTP via SSO and are therefore in control of their own user accounts and their access to VTP.

Does VTP enforce password requirements?

For users signing up to our user database, we enforce strong password requirements. Enterprise users log in to VTP via SSO and are therefore in control of password requirements for their users.

Kanda corporate accounts are required to use strong and unique passwords. Passwords are generated and managed via LastPass.

Where are VTP users listed and maintained?

We store user profiles on Auth0. When logging in via SSO, the user profile gets synchronised to our user list and when logging in via email-password, the user is stored in a database on Auth0.

Kanda corporate accounts are maintained via Azure Active Directory.

When creating rooms in the lobby, a user's first name is saved with the room data. This is to help others identify which user created the room. This data is deleted once a room is no longer in use.

When logging in through SSO, the user name and email are extracted from the ID token provided by the customer’s identity provider. By default, this is stored in our user database. If a client does not wish to provide user names, they can choose to exclude or mask the name attribute.

Additionally, we store the IP used when logging in, as a security measure to prevent potential malicious IPs from accessing data in VTP.

Does VTP store any other user data?

For specific actions, VTP stores an identifier for the user carrying out the action. This identifier is linked to the user in our database. This data is stored for use in billing and audit trails.

Which type of data subjects does VTP process?

The personal data processed by VTP concerns the following subjects:

• Client’s employees

Which categories of personal data does VTP process?

The types of personal data processed by VTP are listed below:

• Name

• Email address

• Employer

• IP address

VTP does not process information such as employment data (salary, sick leave, etc) or information related to a person’s race or ethnic origin, political or religious opinions, gender, sexual orientation etc.

How does VTP use the personal data it stores?

The personal data stored in VTP is used only to provide its services, namely to authenticate and authorise users and to determine billing details for each customer.

Where does VTP perform processing of personal data?

By default, personal data in VTP is processed in the European Union. 

Upon request from our clients, we can facilitate better performance of multiplayer sessions outside the EU as we have the option to enable Photon Cloud services outside of EU.

How long does VTP retain data?

The concept of VTP is that room data exists as long as there is a need for it from the customers point of view. When a room is deleted, the data relating to that room is also deleted, thus the information is stored as long as the room exists.

Logs of logins are used as a basis for invoicing, thus it is considered financial information. By Danish law, such information must be kept for 5 years, thus VTP retain such logs for 5 years.

We use Snyk to perform automated vulnerability scans on our codebase. Additionally, we routinely perform external penetration tests of our systems. 

Do you rotate application secrets regularly?

Yes, we rotate secrets used in VTP data processing infrastructure at least every 90 days.

For Azure services, we use Managed Identity for role-based access control which implements secrets rotation by default. For other services, we automate the key rotation process when possible.

When rotating a key requires manual intervention, we store the secret in a separate vault, which VTP application code can access using Managed Identity. Secrets within this vault are set to expire automatically, which helps enforce manual steps of the key rotation process are executed.

Do you outsource aspects of your security program?

Our security controls for the VTP platform have been audited and validated by IBM Security. And penetration tests are performed by external companies.

Are VTP components patched regularly?

In addition to swiftly resolving vulnerabilities found through automated scans and security reviews, our backend logic runs on serverless architecture such as Azure Functions, which is routinely monitored and patched by Azure’s security organization.

Which steps are you taking to actively harden VTP components?

VTP components are regularly reviewed to ensure vulnerabilities are patched, unused components are removed, and access control is always granted on the principle of least privilege.

Which steps are you taking to prevent malware on Kanda’s devices?

Our corporate devices are required to use a managed Avast Antivirus installation and undergo regular security scans. Additionally, our devices are required to apply security baselines informed by CIS Benchmarks.

Yes, essential activities in the VTP backend system are logged, and audit logs are kept. Access authorization and logins for Kanda corporate accounts are logged via Active Directory.

Kanda also logs crashes via the Unity Cloud Diagnostics to help identify stability and performance issues. The Cloud Diagnostics is only accessible to a subset of Kanda employees invited to the Kanda Unity Services account.

How do you prevent unauthorized changes to logs?

We use Azure services for logging and monitoring, which enforce that changes cannot be made by unauthorized users (most often, changes cannot be made at all).

When are the logs reviewed?

Logs for the VTP backend system are reviewed on an as-needed basis. We review the logs for development and debugging, when there is a notice of unusual system behavior, and when investigating recent threats.

Kanda staff are automatically notified of unusual system behavior using anomaly detection algorithms and custom alerts. Additionally, system metrics such as errors and failed authentication attempts are monitored on a large dashboard display in the Kanda office. We are automatically notified of unusual login activity for critical internal tools and services.

This way, we ensure that suspicious user and system behaviour is flagged as soon as possible and that the logs are promptly reviewed thereafter.