PRF/PRA security statement

PRF/PRA is a connected lighting system combining connected luminaires, sensors, and other lighting system devices with Interact software and services like apps and portal. PRF/PRA system devices connect to the Internet and embed two-way data communication with cloud-based services: a such they participate in the Internet-of-Things (IoT). With the proliferation of these devices in buildings, it is key to address the security risks associated with its use. With this document, we address security risks, implementations, processes and responsibilities.

Security is embedded in all aspects of our innovation, products, systems, and services—from secure system development, to device, network and cloud security, system monitoring, and secure device updates.

Our security processes are built on a strong PRF of industry standards, governance, and procedures. When selecting Signify as a partner for PRF/PRA , you can trust that we have dedicated abundant attention to security across all of products, systems, and services, and that Signify will support you throughout the entire lifecycle of PRF/PRA .

All of our internal and external development activities follow the Signify Security Development Lifecycle (SDL), which codifies industry accepted best practices. The major components of the SDL are security risk analysis and threat modeling, code analysis and review, and vulnerability management. We apply the SDL to all of our hardware products, systems, services, software, and cloud solutions.

In accordance with the SDL, Signify takes the following actions during design, development, and testing:

The Innovation team is responsible for evaluating the latest IoT security technologies, and supports the development team in making the right choices when introducing new security algorithms, solutions, and technology partners.

Signify regularly audits its partners and supply chain to maintain the appropriate level of security in the manufacturing process.

The figure below depicts an overview of an PRA system.

The overview for PRF:

In PRF or PRA, light control is implemented using a wireless mesh network based on the Zigbee protocol: two-way communication between lights and discrete controls is solely based on this protocol. Commissioning and user control are done using a mobile phone app.

When the system is connected to the internet via gateways:

For connected systems, each gateway is the trust center for all the other Zigbee devices in the network it is connecting to.

When the system is not connected via gateways:

For non-connected systems, the mobile phone serves as the trust center for each light network it can connect to.

In both cases, non-connected and connected, system security is addressed end-to-end to guarantee data confidentiality, integrity and availability: to ensure this, network security, device and physical security, communication security for in-transit data, cloud security as well as installation security aspects are addressed.

Various encryption techniques are used to ensure that all communication is protected end-2-end between devices used in an PRF/PRA system. To protect the PRF/PRA cloud services, only Interact devices can access them. This is ensured by using unique device credentials that are assigned to all devices during production. The identities of all of these devices are maintained in the cloud platform. Only devices with a known credential can communicate with PRF/PRA cloud services.

All communication between devices on-site and the cloud is done by PRF/PRA gateways. This communication is encrypted using the standard TLS1.2 protocol. Authentication ensures that only these Interact devices are communicating with our cloud services. Furthermore, all communication is enabled inside out: that is the gateway connects to the cloud rather than the other way around.

Gateways do not store data: they relay data coming from other devices to the cloud. To optimize communication and to bridge periods with limited connectivity they may temporarily store some data in memory. However, they are connected to the customer’s IT network and have ample computing and memory resources. To prevent tampering with gateways, that they can’t be used to compromise the customer network or access data, they are hardened to minimize attack surface and vectors.

Wireless lights, sensors and switches are communicating using the Zigbee protocol. This protocol uses a 128-bit AES key to encrypt messages for protection. This key is unique to each Zigbee network and generated randomly at the creation time of the network.

The PRF/PRA app can directly communicate with the latest generation of wireless devices that besides Zigbee also allow for Bluetooth communication (only between mobile devices and an Interact device). Bluetooth security builds on the security libraries of the operation system of the supported mobile phone platforms, iOS and Android. The complete security solution consists of:

All device features and requirements are aligned with the OWASP IoT framework and built with security in mind. The devices’ Operating Systems are hardened by whitelisting of services and libraries.

Firmware updates are started using the app or portal by authorized users. All firmware images are signed and verified before being deployed on end devices.

The cloud platform is key component of PRF/PRA :

PRA gateways communicate with the cloud via a customer’s IT network using IPv4. Each gateway needs to receive an IP address from a DHCP server on that network. The use of static IP addresses for gateways is not possible.

All connections from PRF/PRA devices to cloud services are initiated by the gateway using dedicated URLs and ports. New connections created outside the network are not allowed. Secure communication is always initiated by a gateway of an PRF/PRA system. Communication between the gateways and the cloud uses the HTTPS protocol which uses the standard TCP port 443. MQTT messages are also sent using this port. The benefit is that only standard web browser ports need to be opened up for PRF/PRA devices to communicate with the cloud.

The URLs and ports used by PRF/PRA are:

Optionally, when allowed on the customer’s IT network, UDP port 123 needs to be open to allow for NTP (Network Time Protocol) time synchronization.

These URLs and ports need to be whitelisted using the security framework of customer’s IT network to allow for communication between PRF/PRA gateways and the cloud.

Note that PRF/PRA PRF doesn’t impose any requirements on the customer’s IT network. Only the phone used for setup and control of the system needs to be able to connect to the cloud platform for backup purposes.

At Signify, we implement a security policy which enforce segregation of duties and least privilege access.

The PRF/PRA cloud services are managed by a specialized global operations team to ensure proper segregation of duties for system administration purposes. Responsibilities of the team include producing operational specifications and performing maintenance, security updates, vulnerability management, backup, logging, monitoring, and management of events and incidents. The team also performs periodic review of network and application security. Development teams and in general other personnel do not have access to production systems or production data. In case access to data is necessary, for supporting operations, only the Operations team is allowed and strictly for the limited time and scope needed.

PRF/PRA application services (mobile app, and PRF/PRA web portal for PRA) are managed by the concept of Projects. A Project is characterized by (part of) a building at a specific location and dedicated user account(s). Data of different projects are separated from each other. All data of a project is considered confidential.

Data of all Projects (except China) is stored with the following cloud provider at the following locations:

For reliability and availability, backups are stored at two different locations to be able to recover from a major system event.

Data is stored in the form of

Project data can only be accessed by authorized users or Signify user managers via user accounts. User accounts are created through self-registration, which results in a profile having project ownership and by invitation, which results in a profile giving a user the necessary rights to access the project data via its application services. PRF/PRA supports different user profiles with associated access rights and capabilities for its application services.

Project data consists of system telemetry and personal identifiable information, each of which will be processed differently (see also 'Data processing').

For more information on Signify’s privacy and data governance, visit our privacy notice page.

Signify policies and processes are aligned with global standards such as ISO/IEC 2700x—Information Security Management Systems (ISMS) and the ISA/IEC 62443 standards suite for product development. Signify is IEC-62443-4-1 certified which ensures that development and maintenance processes enable the creation of secure systems.

Through our Standards and Regulation department, we collaborate with many worldwide standardization organizations, such as IEC, ANSI, and CENELEC, and with industry alliances such as the IoT Security Foundation.

Signify also aligns its practices with the Cloud Security Alliance (CSA) self-assessment tool.

Signify business processes are internally and externally audited on a regular basis.

Signify recognizes that the security of our products and services is an important part of our customers’ in-depth security strategy. In practice, however, security is a responsibility shared by manufacturers and providers of products and services and their customers.

Appropriate evaluation of risks and proper care in installation, maintenance, and operations are essential to mitigate internal and external threats.

For PRF/PRA , the following practices are customers' responsibility:

Security incidents for PRF/PRA are to be reported via its support channels, either the local support call center or the Customer Satisfaction team of the market.

Signify supports responsible vulnerability disclosures and encourages researchers and ethical hackers to report identified vulnerabilities. For more information on Signify responsible disclosure, visit the vulnerability disclosure page.

This information is provided for informational purposes only. It represents the current product information as of the date of publication. These are subject to change without notice.

Customers are responsible for making their own independent assessment of Signify products or services and the use thereof. This information is provided “as is” without warranty of any kind, whether express or implied. This information does not create any warranties, representations, contractual commitments, conditions, or assurances from Signify, its affiliates, suppliers, or licensors. The responsibilities and liabilities of Signify and its customers are defined in the agreements between Signify and its customers. This information is not part of, nor does it modify, any agreement between Signify and its customers.