[Part 1] Scary Stories Impart Valuable Lesson for Network Security
Late one night, 911 operators received a harrowing phone call from a woman who heard strange noises at her front door. She grabbed her 6-month-old baby, a licensed pistol and locked herself in an upstairs bathroom, holding her breath while the intruder violently tore apart the first floor of her home and stole valuables. In minutes, he was gone: “like a ghost,” said the homeowner. Later, they found the crook along with over 100 different house keys, presumably, of other unsuspecting victims.
A creepy story and one that will likely remind you to set your house alarm tonight, but it’s the scary tales of network invasions that will make even the most powerful executive shudder. In fact, security is the number one greatest fear of IT Directors, according to Evolve IP’s recent survey. As alarming, a new report from Silicon Valley Bank reveals that only one-third of 200 tech executives surveyed are completely confident in the security of their information.1
Stories of cyber security attacks flood the news with disturbing frequency. A breach in Epsilon’s network leaked millions of names and email addresses from the customer databases of some of its biggest clients.2 Sony Corp.’s PlayStation Network and Sony Online Entertainment suffered a series of attacks that placed 100 million customer accounts at risk, costing the company up to $2 billion.3 A group of individuals claiming to be affiliated with the ‘hacktivist’ collective Anonymous stole 75,000 credit card numbers and 860,000 user names and passwords from Stratfor, a subscription-based provider of geopolitical analysis.4 And earlier this fall, the websites of several large U.S. financial firms were disrupted by a monster DDoS attack that reportedly exceeded 60 Gbps – much larger than the typical 5-10 Gbps attack.5
Indeed, it seems like security standards are being compromised every day, masked by the hasty assurances that the occasional breach is inevitable and that everyone takes network security as seriously as you do.
Or not. Lapses in security practices may not be obvious, especially when obscured by contract liability language and certain…ahem…unstated assumptions. But while no cloud provider can absolutely guarantee an ironclad defense against the threats of tomorrow, every cloud vendor should be expected to maintain robust procedures that anticipate and mitigate data security risks before they cause harm.
In order to ensure maximum protection from all of the existing and emerging threats to any network’s security whether in the cloud or on-premise, there are two major buckets that need to be filled with proper security measures: 1) physical construction and 2) architectural design.
Physical Construction – Critical components to ensure control and constant visibility
Fewer than 10% of cloud providers own and operate 100% of their own facilities and, instead, rely on partners to provide data center resources. As a result, you need to ask the right questions to ensure that they have selected the right organizations; ones that provide the necessary controls and visibility into the physical security measures in place to protect their service offerings.
Look for cloud providers that either own or work with Tier One data centers, those strategically located in regions with low risk of natural disasters. This helps ensure that the provider also maintains rigorous protocols for securing these centers from things like unauthorized access. For example, each data center should only be accessible at a single point of entry and exit, secured with a biometric scanner and/or a video call box that allows security guards to visually identify each visitor before granting entry. And, ask if the provider monitors each data center around the clock via closed-circuit TV cameras that also record all footage. Be sure to probe the cloud provider, also, about security within the facility. For example, are all areas individually segmented with badge-secured doors, two-factor authentication and biometric hand scanning systems? Inside the server rooms, are each rack, cage and cabinet individually locked with keys held in a monitored lockbox?
In addition to protecting a provider’s data centers from unauthorized access, each center should be safeguarded from environmental threats. Extensive environmental controls and back-up power units must be installed – complete with dual power grids, multiple battery lines, emergency generators, back-up fuel supply, fire-suppression system, smoke and thermal detectors, and a fail-secure door and alarm system. Do the data centers have adequate cooling and ventilation? Are they physically separated from underlying service providers and other third parties? These are important questions to ask when considering a new provider…whether in the cloud or not.
Last but not least, it’s critical to find out how thoroughly the provider checks the background of each employee that will be working on site. Does the provider enforce mandatory drug testing? Run full background checks? Vet each potential employee with a detailed interview process? If you’re not convinced of the reliability of their hiring process, reconsider.
In next week’s post I will look architectural design and protecting how data is moved stored and transacted in the Cloud. In the meantime for 10 Easy-to-Implement cloud security best practices click here!
1. Wall Street Journal Online, “Survey shows majority of tech executives planning for cyber security attacks,” by Silicon Valley Bank, September 24, 2013.
2. Sophos Naked Security Blog, “Epsilon email address megaleak hands customers’ customers to spammers,” by Paul Ducklin, April 4, 2011.
3. Sophos Naked Security Blog, “Sony admits breach larger than originally thought, 24.5 million SOE users also affected,” by Chester Wisniewski, May 3, 2011.
4. Sophos Naked Security Blog, “Data leaks at Stratfor and Care2 mark the end of a year riddled with data theft,” by Chester Wisniewski, December 30, 2011.Security & Compliance