Stories of cyber security attacks flood the news with disturbing frequency. A breach in Epsilon’s network leaked millions of names and email addresses from the customer databases of some of its biggest clients.2 Sony Corp.’s PlayStation Network and Sony Online Entertainment suffered a series of attacks that placed 100 million customer accounts at risk, costing the company up to $2 billion.3 A group of individuals claiming to be affiliated with the ‘hacktivist’ collective Anonymous stole 75,000 credit card numbers and 860,000 user names and passwords from Stratfor, a subscription-based provider of geopolitical analysis.4 And earlier this fall, the websites of several large U.S. financial firms were disrupted by a monster DDoS attack that reportedly exceeded 60 Gbps – much larger than the typical 5-10 Gbps attack.5
Indeed, it seems like security standards are being compromised every day, masked by the hasty assurances that the occasional breach is inevitable and that everyone takes network security as seriously as you do.
Or not. Lapses in security practices may not be obvious, especially when obscured by contract liability language and certain…ahem…unstated assumptions. But while no cloud provider can absolutely guarantee an ironclad defense against the threats of tomorrow, every cloud vendor should be expected to maintain robust procedures that anticipate and mitigate data security risks before they cause harm.
In order to ensure maximum protection from all of the existing and emerging threats to any network’s security whether in the cloud or on-premise, there are two major buckets that need to be filled with proper security measures: 1) physical construction and 2) architectural design.
Physical Construction – Critical components to ensure control and constant visibility
Fewer than 10% of cloud providers own and operate 100% of their own facilities and, instead, rely on partners to provide data center resources. As a result, you need to ask the right questions to ensure that they have selected the right organizations; ones that provide the necessary controls and visibility into the physical security measures in place to protect their service offerings.
Look for cloud providers that either own or work with Tier One data centers, those strategically located in regions with low risk of natural disasters. This helps ensure that the provider also maintains rigorous protocols for securing these centers from things like unauthorized access. For example, each data center should only be accessible at a single point of entry and exit, secured with a biometric scanner and/or a video call box that allows security guards to visually identify each visitor before granting entry. And, ask if the provider monitors each data center around the clock via closed-circuit TV cameras that also record all footage. Be sure to probe the cloud provider, also, about security within the facility. For example, are all areas individually segmented with badge-secured doors, two-factor authentication and biometric hand scanning systems? Inside the server rooms, are each rack, cage and cabinet individually locked with keys held in a monitored lockbox?
In addition to protecting a provider’s data centers from unauthorized access, each center should be safeguarded from environmental threats. Extensive environmental controls and back-up power units must be installed – complete with dual power grids, multiple battery lines, emergency generators, back-up fuel supply, fire-suppression system, smoke and thermal detectors, and a fail-secure door and alarm system. Do the data centers have adequate cooling and ventilation? Are they physically separated from underlying service providers and other third parties? These are important questions to ask when considering a new provider…whether in the cloud or not.
Last but not least, it’s critical to find out how thoroughly the provider checks the background of each employee that will be working on site. Does the provider enforce mandatory drug testing? Run full background checks? Vet each potential employee with a detailed interview process? If you’re not convinced of the reliability of their hiring process, reconsider.
Architectural Design – Protecting how data is moved, stored and transacted
Studies show that most data security compromises worldwide do not involve direct physical access to or theft of data volumes, but instead result from the exploitation of weaknesses in firewalls, data processes and other network design elements.
A first line of software defense is virtualization. This ensures that any malignant software process that emerges in one virtualized volume cannot infect or interact with any others. Virtualized networking processes, additionally, allows technical staff to easily monitor incoming and outgoing production traffic for any early signs of security risks.
Additionally, be sure to find out how network information is protected. Some providers leverage load-balanced firewalls, architected to deliver a full and detailed range of protection solutions that include port blocking, VPN, DDoS protection measures, automatic antivirus enforcement, real-time traffic reporting, intrusion detection, and more. Firewalls should be engineered for N+1 redundancy, guaranteeing that each unit has at least one backup component in case of equipment failure. Further, some providers censor their networks with security event systems that monitor and log traffic.
Most important, look for cloud providers whose networks are SSAE-16 SOC 3 audited regularly by independent, third-parties and compliant with the stringent demands of all major regulatory regimes, including HIPAA and PCI-DSS. Your organization may also require a company like Evolve IP that has the distinction of being designated as a Qualified Security Assessor (QSA) with the PCI council. Lastly, look for and see if your provider is a registered and participating member of the CSA Security, Trust & Assurance Registry (STAR). The CSA was formed to encourage transparency of security practices among cloud providers.
A Well-Lit Tour Removes All Fear
Creepy stories notwithstanding, everything is less frightening out in the open daylight. Nowhere is this truer than with the security of your cloud network provider, so insist on touring the facility to personally meet the provider’s team and review the data center design and operating procedures. Also, request to do a full security audit including application penetration testing and vulnerability analysis. If the provider balks, preferring to keep you in the dark, take that as a fearsome sign of trouble.
1. Wall Street Journal Online, “Survey shows majority of tech executives planning for cyber security attacks,” by Silicon Valley Bank, September 24, 2013.
2. Sophos Naked Security Blog, “Epsilon email address megaleak hands customers’ customers to spammers,” by Paul Ducklin, April 4, 2011.
3. Sophos Naked Security Blog, “Sony admits breach larger than originally thought, 24.5 million SOE users also affected,” by Chester Wisniewski, May 3, 2011.
4. Sophos Naked Security Blog, “Data leaks at Stratfor and Care2 mark the end of a year riddled with data theft,” by Chester Wisniewski, December 30, 2011.Categories: General