It’s no secret that the IT market has evolved in step with changing customer needs during the past decade.
In terms of infrastructure, a growing number of enterprises must grapple with increasingly hybrid workloads (think colocation, public cloud, and private cloud environments). Managing the support of multiple vendors in this disconnected landscape is a nightmarish prospect, making the job of an IT admin considerably more difficult and time-consuming.
The folks at DataBank know this and have spent the past 15 years providing proactive infrastructure management services in step with a rapidly changing industry.
“In terms of the hybrid cloud journey, there’s no one-size-fits-all solution for every customer,” said Vlad Friedman, CTO at DataBank. “It’s the amalgamation of all these different platforms — and as you start to put them together, they become incredibly powerful but complex.”
Behind the scenes, DataBank’s team of professionals combine such networks into cohesive solutions while ensuring they are secure, monitored, backed up, and available. This allows the customer to focus on essential business objectives rather than infrastructure concerns.
DataBank leverages top-notch facilities, a robust national network, scalable cloud infrastructure, and a multihomed secure internet access hub to deliver its datacenter, cloud, and connectivity services to enterprises. Between its infrastructure, frameworks, and internal talent, the company strives to provide flexible, customer-centric solutions united seamlessly via the company’s advanced support portal.
As for the future, DataBank is working to reach additional markets while enhancing the managed cloud, internet, and compliance solutions that alleviate infrastructure burdens for customers across the nation.
Leveraging 15 Years of Experience in Mission-Critical Infrastructure
DataBank, founded in 2005 to address market demand for personalized colocation solutions, is headquartered in the former Federal Reserve Bank in Dallas, which was converted into a datacenter six years prior.
From 2014 through 2018, the company experienced rapid growth due in part to an acquisition strategy that kicked off with the purchase of Arsalon Technologies. The move brought two additional datacenters, an extensive technical team, and a broad set of robust cloud and managed services into the fold.
In 2016, the company acquired Edge Hosting, a managed services provider founded in 1998 by Vlad himself.
“Edge Hosting was launched to focus on mission-critical managed services and application workloads that needed to be highly compliant, could never go down, and remain secure,” Vlad told us. “Today, Edge has enhanced the managed services arm of DataBank with a similar focus but on a much larger scale.”
An overview of Configuration scanning: The DataBank vulnerability scanning tool of choice.
Configuration scanning is a process for scanning operating system vulnerabilities to identify and mitigate vulnerabilities that threaten compliance, including software flaws, missing patches, malware, and misconfigurations across operating systems, devices, and applications. Our service allows security professionals to connect to a multitude of servers, run vulnerability scans, and generate an executive or detailed report based on vulnerability types, vulnerabilities by host/plugin, and by team/client in a variety of formats (HTML, CSV, and Configuration scanning XML).
External vulnerability scans only give visibility to part of the picture, while configuration scanning allows for internal credentialed scans to gain a more comprehensive picture. Internal vulnerability scanning is a requirement for FedRAMP and PCI-DSS environments.
Key features of Configuration scanning
We’ve selected only the best configuration scanning tools for vulnerability scanning because of the key features available within the tools that greatly benefit customers; specifically, those subject to FedRAMP and other high security compliance requirements.
Breadth and depth of coverage
These providers continually work with the information security community to identify new vulnerabilities while offering insights to assist businesses in advancing vulnerability assessment practices. Threat intelligence is built into configuration scanning using plugins.
Automatic plugin update
Our process is powered by the top-rated configuration scanning tools leveraging over 130,000 plugins that update automatically, in real-time. This ensures timely information on new vulnerabilities while reducing time to assess and remediate issues.
Vulnerability scanning with DataBank
As part of the base configuration management service offering, DataBank performs scans up to the operating system, but not the database and web application. However, database and web application scans can be ordered for an additional fee. It’s important to note that FedRAMP stipulates that cloud service providers must perform internal authenticated scans.
FedRAMP vulnerability scanning requirements
Authenticated and credentialed scans
Vulnerability scans must be performed using system credentials that allow full access to systems. Scanners must have the ability to perform in-depth vulnerability scanning of all systems where applicable. Systems scanned without credentials provide limited or no results of the risks. All unauthenticated scans are rejected unless an exception has been previously granted due to applicability or technical considerations.
Enable all non-destructive plug-ins
To ensure all vulnerabilities are discovered, the scanner must be configured to scan for all non-destructive findings. Any vulnerability scans with limited or excluded plug-ins are rejected. Exceptions may occur based on specific requests from the government for re-scans or targeted scans. These scans must comply with the directions provided by the government.
Full system boundary scanning
Each scan must include all components within the system boundary. Reduced number of components or missing categories will result in rejected scans. In some cases, sampling is acceptable; however, it must be approved as a part of the initial security assessment plan and approved as a part of the continuous monitoring plan.
Scanner signatures up to date
CSP must ensure the vulnerability scanner used is up to date and includes the latest versions of vulnerability signatures. Before scanning, each scanner must be updated to reflect the latest version of the scan engine, as well as signature files.
Provide a summary of scanning
Each scan submission must be accompanied by a summary of the scan performed. The summary must include a listing of all the scan files submitted, which scanning tools were used, and a summary of the purpose of the scan (e.g., monthly scans, re-scans, verification scans, etc.).
In addition, the summary should discuss the configuration settings of the scanner, including if signatures were limited for targeted, verification scans, or if the scope of the scans excluded certain components or IP addresses. IP address ranges and/or a description of the targets are required.
POA&M all findings
Findings within scans must all be addressed in a plan of action and milestones or other risk acceptance requests and maintained until vulnerabilities have been remediated and validated.
Types of scans DataBank runs for customers
1. Credentialed patch audit scan
-Vulnerability scans run monthly
-Check to determine what’s out of date on the server
-DataBank is responsible for OS patches only.
2. Host discovery scan
-Network discovery scans offered to FedRAMP environments only
-Scan runs daily
-Reviewed monthly
-Checks for new hosts in the environment
CIS Hardening scan
Configuration scanning is used with the Center for Internet Security (CIS) benchmarks and baselines to assess and harden all servers during the provisioning process to ensure all servers are in the optimal state at delivery. In production, scans are also scheduled on a recurring basis for continuous monitoring purposes.
Vulnerability scans are a critical component of an overall security program. They’re a non-invasive method of testing which allows your security team to gain feedback on the health of your network quickly. When entrusting DataBank with vulnerability scanning as part of your security program, your internal team will be better equipped to act on protecting your network and data.
By Raul K. Martynek | Chief Executive Officer
How DataBank and Zayo Networks are Teaming-Up to Deliver on the Promise of Edge Computing
In a previous post, I argued that despite all the buzz about micro-data centers at the base of cell towers, the first place “The Edge” will most likely materialize is inside traditional data centers located within secondary “NFL cities”. The incremental improvements in latency that come from deploying content and workloads locally in these large population centers (as opposed to distant cloud data centers), coupled with the ability of full-sized data centers to better scale and maintain infrastructure, actually make this approach far superior to alternatives like micro-data centers.
But while this thesis addresses the latency considerations and benefits of data center location, we all know that the effective delivery of bits depends on another critical element in the infrastructure chain: the network behind the data center. The connectivity available in a building, and the paths from which it enters and exits the property, are just as important as the redundancy and configuration of the mechanical, electrical and plumbing (MEP) systems in the facility. A weak link in this part of the chain can negate all the benefits of the data center’s proximity and redundancy to users in that metropolitan region.
Let me propose an analogy. Everyone knows that best practices dictate that a properly designed data center must have a minimum of two Points of Entry (POEs) for fiber, and a minimum of two Meet Me Room (MMRs) to terminate the fiber and distribute it to IT workloads. This ensures the proper degree of physical diversity both within and outside the data center.
And what is true for a data center needs to be true for a geographic market. If we imagine that interconnection data centers are effectively the “meet me rooms” of a metro area, and the long-haul fiber paths into and out of those data centers are the “Points of Entry” for that market, it stands to reason that on this macro scale we need the same level of diversity. Within a given metropolitan market, redundant interconnection locations and diverse long-haul fiber access must be available in order to provide the market level diversity our industry is accustomed to at the micro-level. As we will see, that’s not always the case, and it has the potential to slow the development of the edge for all providers and users.
In this article, we will explore the current problem with network interconnection and fiber redundancy in secondary markets. I will argue that multiple interconnection points and physically diverse long-haul fiber connectivity options must emerge for mission-critical deployments to flourish at the Edge.
Let’s start by looking at how most large Tier 1 markets are configured for data center interconnection and long-haul fiber. Figure 1 below depicts the Zayo fiber map in metro NYC. While New York is unique in many ways (and one that I have known for years) the broad configuration I will describe is the same in all Tier 1 markets. The three orange dots are the three main “carrier hotels” in the New York area – 60 Hudson St., 111 8th Ave., and 165 Halsey St. in Newark, NJ. In a market such as NYC, there are other significant interconnection points (32 Ave of Americas, 325 Hudson, 75 Broad, etc.) but most people would agree that these three locations form the “core” of peering and interconnection for the New York Metro market. The reason there are multiple locations is obvious: redundancy. With three locations, users have the ability to deploy in multiple locations to ensure uptime. A failure in one facility or portion of a facility will not impact traffic in another location. Similarly, each of these locations benefits from dozens of metro and long-haul fiber options that exit the New York area heading north, west, east, northwest and southwest from Manhattan. With multiple interconnection points and multiple routes coming into/out of the area, a provider can carefully construct a resilient architecture for connectivity and availability.
(Figure 1) NYC Metro Fiber Map
When you survey the landscape, all major Tier 1 markets also have 2-3 major interconnection points and diverse metro and long-haul fiber connectivity. Dallas (my new home) has three main locations – 1950 Stemmons, 2323 Bryan and 400 South Akard (DataBank’s DFW1 location). Long-haul fiber enters the market from multiple, physically separate routes. Chicago has 350 E. Cermak and 600 S. Federal. From each of these facilities or by tethering to a sub-tending datacenter in the same market, users can avail themselves of diverse data center locations and redundant metro fiber and long-haul fiber options to ensure that no one location can become a “single point of failure”.
Large cloud, content and technology providers understand this. DE-CIX is one of the world’s leading interconnection platforms. Until this year, their only location in Dallas was at the Infomart Building at 1950 Stemmons. As their traffic grew, they decided to create a secondary location that offers its customers an alternative peering point for diversity. In August, DE-CIX, deployed their fully redundant Apollon platform at our 400 South Akard location. In talking to the DE-CIX folks, the two main criteria for their selection were: (a) a robust data center location physically diverse from Stemmons with good fiber connectivity; (b) available long-haul fiber routes fully independent from Stemmons. South Akard checked both boxes. In addition to offering a diverse local data center facility, the 400 South Akard location provides access to fully diverse long-haul fiber routes to exit the Dallas region.
The situation is not the same in most secondary markets. In many of the markets that DataBank operates, multiple, diverse interconnection locations and physically diverse long-haul fiber routes have not yet developed. Figure 2 below shows the situation in Minneapolis. In that market, the Cologix facility located at 511 Main Street is the predominant carrier interconnection point. To exit the market, the main long-haul fiber routes go either south to Chicago or west to Seattle (we show the Zayo routes in this figure). A third route heads due south towards Omaha. Most of the peering in the Minneapolis market happens within the 511 building. Today, there does not exist another interconnection point within the market that has both direct access to all the diverse long-haul fiber routes and enough critical mass of local metro fiber providers to be a viable alternative location. For Minneapolis, the 511 building is the proverbial single point of failure and a bottleneck that must be addressed for the region to support fully diverse edge workloads.
(Figure 2) Current MSP Metro Fiber Map
Recently, DataBank’s lead investor, Digital Bridge Holdings, announced the acquisition of Zayo Networks in conjunction with EQT Equity Partners. Zayo owns and operates the largest fiber network in the United States with dense metro and long-haul fiber routes. At Digital Bridge, we believe that having complementary internet infrastructure assets in the same portfolio will foster the development of innovative solutions. DataBank and Zayo are doing just that. We have joined forces to bring alternative interconnection and long-haul fiber diversity to secondary edge markets, and we have picked Minneapolis as our initial market.
Figure 3 depicts the proposed new routes for long-haul dark fiber connectivity out of the Minneapolis market using Zayo fiber. Zayo will extend its Omaha long-haul route to terminate at DataBank’s MSP1 facility and its Chicago route to terminate at DataBank’s MSP2 location. Zayo metro dark fiber already connects MSP1 and MSP2. The key element of this route is that it bypasses the 511 Main location heading West, while also providing long-haul access to Chicago and Omaha via metro fiber splices. As an interconnection point, the DataBank MSP2 facility is the designated termination point. DataBank’s MSP2 facility is a certified Tier III data center location with over 15 onsite metro fiber providers. Recently, the Midwest Internet Cooperative Exchange (MICE) deployed an extension switch in MSP2. MSP2 is also located in Egan, a suburb in Minneapolis about 10 miles south of the downtown 511 Main Street location. MSP2 provides an alternative interconnection facility with diverse long-haul dark fiber options, giving Minneapolis the resilient internet infrastructure required to support the mission-critical workloads and make it a viable edge market. DataBank and Zayo intend to partner in other markets where there is a significant overlap in assets such as Kansas City, Indianapolis, and Salt Lake City. We will share those plans as we develop the solutions.
(Figure 3) New Zayo Long Haul Fiber Routes
At DataBank, we believe that for Edge markets like Minneapolis to fully develop, redundant interconnection and long-haul fiber options must emerge, so that providers of scaled, mission-critical applications can build the redundant architectures they have come to rely on in Tier 1 markets. In our conversations with large cloud, content and technology companies, this topic is a reality. With the exponential growth in internet traffic, large content providers and ISPs are increasingly looking to “regionalize” their traffic flows and drain traffic from Tier 1 markets into adjacent metropolitan areas. However, in our conversations with such users, they are reticent to expand their footprint without the availability of diverse options for colocation, peering and dark fiber transit. For edge workloads to fully evolve and deliver the 100% uptime that will be expected from these new technologies, a robust physical internet infrastructure topology will be required.
Diversity of options also provides another non-technical benefit: competition. As the importance of internet infrastructure grows, so does the importance of truly neutral interconnection locations. Yet we continue to hear stories of aggressive incumbent behavior, incessant price increases and anti-competitive terms of supposedly “neutral” operators of interconnection facilities. We believe that owning/controlling the dominant interconnection point in a market is not an excuse to abuse your customers, but an opportunity to foster and build a better internet, which will ultimately benefit all users and consumers of internet infrastructure.
All service providers who maintain compliance certifications for SSAE-18 and HIPAA-Hitec are required to undergo an annual audit of their compliance controls to ensure they meet the standards.
DataBank recently completed its annual audit and received an “Exception Free” rating, a fairly rare occurrence, but in our case, it was the 6th year in a row. (dating back to our acquisition of Edge Hosting).
We caught up with DataBank’s CISO, Mark Houpt, to better understand the audit process and what it means for us and our customers.
Mark, what does it mean to be “recertified” for HIPAA and SSAE-18 Compliance?
Audits are conducted on an annual basis. During these procedures, the auditors evaluate the effectiveness of service provider’s compliance controls, how suitable the design of the those controls are, and how fairly they are represented or presented to customers. Our recertification means that for the period of the examination (in this case, 10/1/18-9/30/19), DataBank had properly designed security controls, we fairly told our customers what we do with those security controls, and – by the auditors actually testing the controls – that we were operating those controls effectively.
What authority conducts these audits and re-certifications?
The audits we most recently completed were in accordance with the American Institute of Certified Public Accountants (AICPA) standards and completed by 360 Advanced.
What DataBank services or facilities does it apply to?
The recent audit and recertifications apply to all of DataBank’s colocation and managed services in all of our data centers. The PCI attestations, apply just to our colocation services in all data centers.
What process was required to achieve this re-certification?
Each year DataBank undergoes an extensive, 4-month audit process where auditors review approximately 300 artifacts and sources of evidence, interview our personnel, and visit our data centers for visual examination.
What does “exception free” mean and how common is that?
Exception free means that for each security control listed, the auditors could not find deviations or faults in how we design and operate our controls. This is rare in the industry, although this is DataBank’s second year in row and “legacy Edge Hosting’s” 6th year in a row of exception free examinations.
How does this benefit our customers?
An exception free audit and recertification provides assurances to our customers that the design of our security environment is in line with industry best practices. You can think of it as a measure of technical excellence. But it’s also a measure of operational excellence. The auditor’s test results demonstrate that our security design doesn’t just work on paper, it works in practice. Achieving this standard six years in a row demonstrates consistency in that practice. It’s part of our operational DNA. And that’s critical to any customer looking for a reliable partner for mission-critical colocation, security and compliance.
If you are looking into learning about how we can help you in your FedRAMP, HIPAA/HITECH, PCI-DSS, and GDPR needs give DataBank a call at 800.840.7533.
