Adobe Creative Cloud for teams Security Overview White Paper Adobe Creative Cloud for teams Security Overview Adobe Security At Adobe, we take the security of your digital experience seriously. From our rigorous integration of security into our internal software development process and tools to our cross-functional incident response teams, we strive to be proactive and nimble. What’s more, our collaborative work with partners, researchers, and other industry organizations helps us understand the latest threats and security best practices, as well as continually build security into the products and services we offer. Table of contents 1: Adobe Security 1: About Creative Cloud Teams 1: Creative Cloud for teams Storage and Storage Options 1: Administrative Tools for Creative Cloud for teams 2: The Adobe Security Organization 2: Adobe Secure Product Development 3: Adobe Security Training 4: Creative Cloud Architecture 5: About Amazon Web Services (AWS) 6: Creative Cloud for teams Authentication (Adobe ID) 6: Adobe Risk & Vulnerability Management 7: AWS Data Center Physical and Environmental Controls 8: Adobe Corporate Locations 8: Adobe Employees 9: Customer Data Confidentiality 9: Security Compliance 9: Conclusion This white paper describes the proactive approach and procedures implemented by Adobe to increase the security of your Creative Cloud experience and your data. About Creative Cloud for teams Creative Cloud for teams includes the entire collection of Creative Cloud desktop applications (such as Adobe Photoshop CC, Adobe Illustrator CC, etc.) plus services and business features for teams and small to medium-sized organizations. Creative Cloud for teams is available via two plans — complete and single app — both of which are easily purchased, managed, and deployed via an intuitive Admin Console. Creative Cloud for teams Storage and Storage Options With Creative Cloud for teams, each complete membership includes up to 100 GB of cloud-based storage (single app members get 20GB) using Amazon S3 (Amazon Simple Storage Service), which provides a highly reliable data storage infrastructure for storing and retrieving data. While the default storage option stores customer data in the cloud, customers can choose not to store on the cloud or to block the network connection within their corporate network. More information on storage options can be found on the Adobe.com website. Administrative Tools for Creative Cloud for teams Admin Console Creative Cloud for teams includes a web-based Admin Console for IT administrators to easily purchase seats, add users, manage licenses, and deploy the Creative Cloud applications and updates. Administrators send emails asking users to create their own Adobe IDs. Creative Cloud Packager Available via the Creative Cloud for teams Admin Console, Creative Cloud Packager is a tool that enables IT administrators to centrally deploy all – or a customized subset of – the Creative Cloud applications. Creative Cloud Packager ensures that every user is on the same version of the software, saving support costs, and eliminating multiple users downloading the same software at the same time, reducing network congestion. IT administrators log into Creative Cloud Packager using their Adobe ID, which they create when first registering for a Creative Cloud for teams plan. More information on Creative Cloud Packager and deployment options can be found on the Adobe.com website.

The Adobe Security Organization As part of our commitment to the security of our products and services, Adobe coordinates all security efforts under the Chief Security Officer (CSO). The office of the CSO coordinates all product and service security initiatives and the implementation of the Adobe Secure Product Lifecycle (SPLC). The CSO also manages the Adobe Secure Software Engineering Team (ASSET), a dedicated, central team of security experts who serve as consultants to key Adobe product and operations teams, including the Adobe Creative Cloud teams. ASSET researchers work with individual...

Adobe Secure Product Lifecycle (SPLC) Adobe Security Training Adobe Software Security Certification Program As part of the Adobe SPLC, Adobe conducts ongoing security training within development teams to enhance security knowledge throughout the company and improve the overall security of our products and services. Employees participating in the Adobe Software Security Certification Program attain different certification levels by completing security projects. The program has four levels, each designated by a colored ‘belt’: white, green, brown, and black. The white and green levels are achieved...

Creative Cloud Architecture Adobe is working toward a converged, hosted infrastructure for all Creative Cloud for teams components; however, the company currently utilizes two (2) primary hosting infrastructures for various components of Creative Cloud for teams: • Amazon Web Services (AWS): Most components of Creative Cloud for teams are hosted on AWS, including Amazon Elastic Compute Cloud (Amazon EC2) and Amazon Simple Storage Service (Amazon S3), in the United States, EU, and Asia Pacific. Amazon EC2 is a web service that provides automatically scalable compute capacity in the cloud, making...

The services available are dependent on how the customer is accessing the Adobe Creative Cloud. For example, the individual applications can access the Creative Cloud to validate the user, synchronize settings, and, optionally, share content through Adobe Behance. Similarly, the Creative Cloud desktop application allows users to download and update their desktop applications, download web fonts through Typekit, and upload or download files to their local system from Creative Cloud storage. Regardless of the customer endpoint, all Creative Cloud access is controlled through a public set of services...

Network Monitoring and Protection AWS uses a variety of automated monitoring systems to provide a high level of service performance and availability. Monitoring tools help detect unusual or unauthorized activities and conditions at ingress and egress communication points. The AWS network provides significant protection against traditional network security issues: • Distributed Denial Of Service (DDoS) Attacks • Man in the Middle (MITM) Attacks • IP Spoofing • Port Scanning • Packet sniffing by other tenants You can find more information about Network Monitoring and Protection in the AWS Security...