This document describes different areas of our Danfoss Leanheat® Monitor software. Tools and services that are being used are subject to change while the security posture of Danfoss Leanheat® Monitor will remain and improve in the future.

2. General description

Danfoss Leanheat® Monitor is a web-based cloud SCADA software application hosted in Microsoft Azure for heating, cooling, and ventilation systems. Leanheat® Monitor is built on strong bases of already established Danfoss solutions with new and improved features for remote monitoring, control and optimization of your heating, cooling, and ventilation applications. A reliable and stable software solution brings you cost effective and energy efficient management and lays the foundations for a connected future of your energy system. Leanheat® Monitor is offered as a cloud SaaS (software as a service) solution. This means that Danfoss takes care of all maintenance, backup, and security updates of the system. Customers can access the system from any personal computer or mobile device connected to internet. The user of Leanheat® Monitor can remotely control and monitor the parameter settings in the controllers. Reference and historical values of sensors and meters connected to the controllers can also be monitored.

3. Cloud infrastructure

From a high-level architectural viewpoint, Leanheat® Monitor is a single-page web application, hosted in Microsoft Azure that also offers a secure REST API for integrations.

Internally, Leanheat® Monitor is a multitenant, cloud-native, distributed application running multiple services that perform a variety of activities.

Such services run as orchestrated containers using Azure’s offering for Kubernetes orchestration: Azure Kubernetes Services (AKS). Choosing a managed service, by Microsoft, ensures that the platform is stable and secure.

4. Cyber security

4.1 General information

Danfoss information security program is built on the internationally recognized ISO/IEC 27001 standard. We maintain an Information Security Management System (ISMS) to ensure consistent compliance, with specific organizational entities holding official ISO/IEC 27001 certification.

Leanheat® Monitor is a SaaS (software as a service) cloud solution hosted on Microsoft Azure’s European data center. Leanheat® Monitor uses Azure Kubernetes Service (AKS), Storage, Key vaults, and other Azure services. Microsoft Azure data centers are compliant with many physical and information security standards. For details about security within Microsoft Azure data centers, see Microsoft’s Compliance website.

4.2 Tenant isolation

Leanheat® Monitor is a multitenant platform in which tenants’ data is logically separated and remains inaccessible to other tenants. Access control ensures that only valid authenticated and authorized users can access the platform.

4.3 Data encryption

Leanheat® Monitor enforces TLS (Transport Layer Security) 1.2 protocol for data in transit. By default, data at rest is encrypted using strong encryption methods (AES-256) within Microsoft Azure, Atlas Mongo, and Influx Db.

4.4 Data storage

Leanheat® Monitor leverages managed data storage providers for storing data. Data is stored in a MySQL relational database (provided by Microsoft Azure MySQL Database), a MongoDB cluster (provided by MongoDB Atlas - hosted in Azure), and an InfluxDB time-series database (provided by InfluxDB Cloud - hosted in Azure).

Main advantages of managed data storage providers are that their services are secure, patched, maintained, and monitored.

4.5 Data backup strategy

Each data store uses the backup service of its provider. The recovery point objective (RPO) is the maximum period of data changes that a restore can lose.

4.5.1 MongoDB Atlas

Atlas takes a snapshot of the database every 6 hours. The RPO is 6 hours.
A restore returns the database to the state of a selected snapshot.
Atlas keeps the 6-hourly snapshots and the daily snapshots for 7 days.
Atlas keeps the weekly snapshots for 4 weeks and the monthly snapshots for 12 months.

4.5.2 Microsoft Azure Database for MySQL

Azure takes a full backup every 24 hours and backs up the transaction log every 5 minutes. The RPO is 5 minutes.
Restoring returns the database to any point in time within the last 7 days.

4.5.3 InfluxDB Cloud

InfluxDB Cloud adds each accepted write request to a durable message queue before it stores the data. The message queue holds each write request for 96 hours.
InfluxData states the RPO as any accepted write.
InfluxDB Cloud takes a weekly snapshot of the stored data and keeps each snapshot for 100 days.

4.6 Data retention

Time-series data, such as sensor and meter values collected from devices, is retained for 5 years by default. Extended retention of up to 10 years is available as an option. To order it, contact your local Danfoss representative.

4.7 Application and service security

4.7.1 Identity management and access management

Danfoss Identity provider (DIP) is used for authentication purposes for Leanheat® Monitor solution. DIP is based on Auth0 authentication platform. With DIP our customers can use their existing solutions like Active Directory to leverage federated authentication and 2FA.

There is an advanced user management system in Leanheat® Monitor and it is possible to provide users with access to all or a limited number of devices. Besides limiting the access to devices there are six different user roles in Leanheat® Monitor which provide a diverse set of functionalities:

Admin
Designer
Full
Limited
Basic
Read-only

For a full overview of what each role can do, see User management.

4.7.1.1 Admin user

Administrators have full control and overview of the system. Admin users can access all devices and assign them to different users, access all settings, create reports and alarm rules, and add new devices and users.

4.7.1.2 Designer user

Designer users have control and overview of all devices on the tenant. Designer users can access all device settings, create reports and alarm rules, add new devices, manage areas, and edit custom flow diagrams (an Additional Service).

4.7.1.3 Full user

Full users have control and overview of devices assigned to them by the admin. Full users can access all device settings, create reports and alarm rules, and add new devices.

4.7.1.4 Limited user

Limited users have control and overview of devices assigned to them by the admin. Limited users can access most device settings and create reports and alarm rules.

4.7.1.5 Basic user

Basic users have an overview of devices assigned to them by the admin. Basic users can access only some device settings.

4.7.1.6 Read-only user

Read-only users have an overview of devices assigned to them by the admin. Read-only users can only see values from the controllers but cannot adjust any settings.

4.7.2 Internal access controls

Infrastructure administrative privileges are restricted to an authorized set of users.
Multi-factor authentication (MFA) is required for all infrastructure access.
Shared accounts are prohibited.

4.8 Configuration management

Leanheat® Monitor is programmatically managed and deployed using IAC (infrastructure as a code) which undergoes version control and testing as part of automated deployment process. Permission to push code is controlled, requiring peer review and approval by infrastructure engineers.

4.9 Secure software development lifecycle (SDLC)

Leanheat® Monitor team follows security best practices throughout the development cycle:

Security controls points at multiple phases of development.
Source code management:
- Version control
- 4 eyes review principles on PR (Pull requests)
- Static application security testing (SAST)
- Vulnerability scans on third-party dependencies and libraries
Unit, integration, and E2E (End to end) testing
Automated vulnerability scans on containers
Regular dynamic application security testing (DAST)
Microsoft Defender for Cloud for CSPM (Cloud security posture management) and security recommendations
Microsoft WAF (Web Application firewall) protects our solution.

4.10 Separation of environments and duties

Production and non-production environments are separate. Developers use non-production environments solely for development and testing. Customer data is used only in the production environment.

4.11 Monitoring, logging, and alerting

The operations team continuously monitors and analyzes metrics and logs from Leanheat® Monitor environments.

Services are monitored to ensure performance and availability.
Application logging, performance, and observability data are gathered for event analysis and alerting. Access to these logs is provided only to employees that require access to deliver the services.

4.12 Security assessments

We use trusted third-party security firms to perform penetration testing to discover vulnerabilities. Penetration testing is performed yearly.

4.13 Incident response

Report security incidents to security@danfoss.com or use this Report security vulnerability. We maintain procedures for incident alerting and response.

4.14 Security awareness training

Every year there is mandatory security awareness training for all employees to brush up on their security knowledge.

1. Document purpose