Month: October 2020

In today’s data-driven world, security is an important aspect of data collection and storage. Just take a look at recent headlines and you’ll see that bad actors are constantly trying to breach internet security. It can be costly, time-consuming, and extremely inconvenient to deal with a data breach or hacking attack. But when that data is critical to the security and safety of the United States, a cybersecurity attack can be more than inconvenient. It can be dangerous or even deadly.

That’s why the Federal government has often been a key driver of IT security standards. As a huge consumer of private-sector IT infrastructure and services, the Federal government has a special responsibility to ensure its service providers meet the most stringent security and compliance certifications.

One of the most demanding of those standards is the Federal Risk and Authorization Management Program (FedRAMP). FedRAMP is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

DataBank has a strong pedigree in deploying secure and compliant solutions for mission-critical business systems governed by Federal security requirements, including FedRAMP. As the holder of an “Authorization to Operate” (ATO) for our cloud platforms, DataBank has undergone a 3PAO audit and validation process utilizing the latest NIST 800-53 security framework for its cloud and NIST-compliant security offerings. DataBank’s team of experts supports the full cycle of hosting and cloud infrastructure including design, deployment, testing, validation, and defense-in-depth protection.

However, a new certification will soon be available to service providers that seek to work with the U.S. Department of Defense (DoD). The Cybersecurity Maturity Model Certification (CMMC) will review and combine various cybersecurity standards and best practices under one security framework for the entire DoD. Although the DoD is going with the CMMC as their standard, they are not throwing out the FedRAMP model and will view certain levels of FedRAMP as compliant with the CMMC. These standards will be mapped across levels that range from basic cyber hygiene to advanced. For a given CMMC level, the associated controls and processes, when implemented, will reduce risk against a specific set of cyber threats.

Although CMMC is not formally released and ready for consumer use, DataBank is already CMMC qualified by virtue of our FedRAMP authorization. The leaders of CMMC have stated that FedRAMP authorizations will be accepted as reciprocity. By hosting your cloud application at DataBank under our existing FedRAMP authorization, and having your agency sponsor issue an ATO, your SaaS product can also be ready and qualified for CMMC when it is released.

Just another example of how DataBank stays ahead of the curve when it comes to security and compliance! To learn more about DataBank’s suite of security offerings, click here. To learn more about DataBank’s compliance ecosystem, click here.

“Just like oil was a natural resource powering the last industrial revolution, data is going to be the natural resource for this industrial revolution. Data is the core asset, and the core lubricant, for not just the entire economic models built around every single industry vertical but also the socioeconomic models.” -Ginni Rometty, Executive Chairman, IBM

Given its intrinsic core value, maintaining the security of data is crucial for the success of any business. Intentional or accidental exposure of proprietary data such as companies’ intellectual property and customers’ personal and financial information can lead to reputational damage and loss of customer trust, noncompliance penalties from industry regulations, and lost revenue. Moreover, when businesses around the world changed the way they worked in response to the pandemic, cybercriminals ramped up their efforts to breach corporate networks with increased phishing, malware, ransomware, distributed denial of service (DDoS), and other malicious attacks. One major telecom provider has seen DDoS attacks increase by 33 percent in the wake of the COVID-19.

Average Cost of Data Breach, by Industry

Healthcare: $7.13 million

Financial Services: $5.85 million

Pharma: $5.06 million

Technology: $5.04 million

Source: Ponemon Institute, Cost of a Data Breach Report 2020

Today, companies are so preoccupied with data loss from cyberattacks and data breaches in their own facilities, that they overlook risks in the data center. Consider the former Google engineer who plugged his work-issued laptop into a company server and proceeded to download thousands of proprietary files related to driverless car navigational systems, which he then transferred to an external drive and illegally provided to a ride-sharing firm that was developing similar technology.

So, let’s take a look at the top-five proven defenses data center providers should adopt to safeguard customer data and infrastructure.

1. Physical Security

Although most data centers implement extensive measures to secure the perimeter of a facility, breaches as a result of unauthorized access still happen. For this reason, the most fortified data centers deploy multi-layered security access methods including visual inspections from multiple 24×7 guard stations and video monitoring. Best practices also incorporate biometric access controls and keypads, double-locking mantraps at the data center entrance, and restrictive access policies for each customer’s space, providing security within each zone of the facility.

2. Maintaining Uptime

A recent survey by the Uptime Institute found that the leading cause of data center failures is power outages. Hence, it follows that organizations that opt to partner with a data center provider that addresses issues related to reliable and resilient power make one of the best decisions concerning data security.

The Uptime Institute classifies data centers based on their infrastructure capacity, system availability, redundancy, and concurrent maintainability. The Tier III classification indicates a highly-reliable facility with a fully redundant critical power distribution system and cooling components. Tier III data centers can lose an uninterruptible power supply (UPS) or generator power and maintain continuous operations. Additionally, a Tier III facility allows data center operators to perform regular maintenance on power equipment and regularly test capacity and failover without interrupting ongoing operations. Maintaining data center operations and staying online is therefore related directly to data security. So, too, is maintaining end-to-end visibility across the entire infrastructure so that IT staff can introduce the right mix of security layers and controls to ensure redundancies and create a protective environment.

3. Continuous Monitoring

Continuous monitoring is critical to data security, particularly to ensure successful compliance and efficient audits. Broadly defined, continuous monitoring, also known as continuous controls monitoring, CCM, or ConMon, enables management to continually review business processes for adherence to, and deviations from, their intended levels of performance and effectiveness. While new compliance requirements, unfamiliar compliance territory as a result of business expansion, or a failed audit are frequent rationales for embarking on a program of continuous monitoring, ConMon also provides innumerable ongoing benefits. Chief among these is preempting the need to be reactive and fix a problem or vulnerability quickly before a data breach or audit.

Continuous monitoring also enables companies to establish useful metrics for their computing environments, reduce costs through enhanced fraud and error detection and prevention, and preemptively identify potential points of IT equipment failure.

4. Maintain Compliance and Controls

For financial services and healthcare organizations as well as enterprises that market their services to the government sector, security, and regulatory compliance is non-negotiable. Any organization that must meet HIPAA, PCI, FedRAMP, or other types of compliance measures must ensure that their data center and cloud providers can satisfy stringent standards.

A critical step is to first conduct a comprehensive security and governance audit. This audit should include an evaluation of all data security policies as wells as user privileges and compliance regulations. In the age of hybrid IT, organizations also need to determine the workloads that could and should be migrated to the cloud. Equally important is to understand each workload’s security requirements and select the appropriate cloud platform and architecture. Companies should also understand the shared and discrete security responsibilities between them and their cloud service providers.

Among the major benefits of DataBank’s platform is that we can control colocation, private cloud, and public cloud, applying consistent security coverage and compliance to every one of these environments. Furthermore, we’re able to provision and maintain a company’s infrastructure, enforcing security to its platform while covering a far greater number of compliance controls than public cloud — 80 percent versus 20 percent — thereby freeing the organization’s resources to focus on revenue and innovation initiatives.

5. Access to Security Expertise

An indispensable element to maintaining data security is access to highly-experienced, proven security engineers, directed by a chief information security officer (CISO), who is dedicated to managing and monitoring customer environments. Particularly for companies that don’t have the internal resources, or whose resources are already strained, there simply is no substitute for the people, security processes, and technologies that a reliable partner brings to bear in protecting business-critical data and infrastructure.

These five attributes are hallmarks of DataBank’s defense-in-depth approach to the Data Center Evolved experience. If you’d like to learn more, contact us today!

Prepared by: Anthony Paladino

On October 13th, 2020, Microsoft released a security advisory for CVE-2020-16898, a vulnerability that researchers have named “Bad Neighbor.” Bad Neighbor is described as a vulnerability in Windows 10, Windows Server 2019, and Windows Server Core where an attacker could exploit the Windows TCP/IP stack of a target system with a specially crafted ICMPv6 Router Advertisement packet, causing a denial of service in the form of a fatal system error, the dreaded Blue Screen of Death. This vulnerability carries a CVSSv3 base score of 9.8, denoting it as a critical vulnerability, and the relative ease of exploit combined with the potential for it to become wormable has garnered particular attention from researchers.

On the same day as the security advisory release, Microsoft also offered a fix in the form of security updates issued as part of October’s Patch Tuesday. System administrators and support teams are encouraged to patch this vulnerability as soon as possible. If patching cannot be done immediately, it is recommended to employ the workaround of disabling the ICMPv6 Recursive DNS Server (RDNSS) until such time as the patch can be applied.

DataBank is deploying appropriate patches to all customers with managed Windows 2019 systems according to their normal maintenance windows. If you are a customer who would like an expedited application of this patch or have concerns about it, please reach out to DataBank Support.

For customers of DataBank’s Managed Internet with IDS/IPS offering, filters have been applied to monitor for potential exploits of this vulnerability, and DataBank Security will continue to monitor the situation.

Those teams supporting Windows 10 endpoints should work to ensure that all Windows 10 clients in their environment receive the appropriate patches as soon as possible.