By: Mark Houpt, Chief Information Security Officer, DataBank
While the holidays ring in family gatherings, parties, and the opportunity to reconnect with friends, it’s easy to fall into a more relaxed mindset — physically, mentally, and professionally. It’s an exciting time of year. Unfortunately, it’s an exciting time of year for cybercriminals, as well. While we’re shopping, they’re on their own shopping sprees. It comes in the form of phishing, scraping, password attacks, and zero-day exploits. These attacks increase at holiday time. It’s estimated that ransomware attacks go up by as much as 40% over the holidays.
Why the seasonal spike? For e-commerce sites, there’s more traffic and personal information being shared, including credit card and personal information. Also — and this is a reason many forgot or don’t consider — the holidays are a security distraction.
Distractions — Cybercriminals’ Best Friends
Over the holidays, people go on vacations, whether physical or mental. Starting the week of Thanksgiving and continuing through the end of the year, it’s not uncommon for people to take off more days than they work. Work teams lose members, leaving fewer people to mind the security store. In the case of online retailers, there is a dangerous combination at play: more site traffic and fewer people monitoring and managing cybersecurity, the opportunity cybercriminals seek.
It’s Not Too Late
If you’re thinking it’s too late to address security for the 2022 holiday season, think again. Yes, certain types of more involved security measures take more time to prepare and implement – keeping them in mind for 2023). However, there’s one thing you’ll definitely want to do: Remind your employees how they can keep themselves and your organization safe over the holidays.
Specifically, send out a company-wide security communique that includes the following tips and suggestions as a critically important reinforcement. Consider that as much as 70% of security incidents and breaches are employee related. That probably means an innocent email from an unrecognized source was opened and/or an imbedded link clicked. That’s only a fraction of the ways employees can open attack vectors and usher in threat actors excited about conducting their own brand of shopping during the holiday season.
Passwords, Authentication
A recent study found that almost 70% of respondents admitted to sharing passwords with co-workers and over 50% use the same login and password on multiple sites. Remind your employees of the array of password management applications available.
Collaboration Platforms
Collaboration tools, such as Teams and Slack, are now the lifeblood of company communications. Phones and traditional email were supplanted by them years ago, and they are cybercriminals’ favorite way to enter your company. Why? Because it’s the easiest. All it takes is one employee to click on a link that, in turn, launches a DDoS or ransomware attack. Remind your employees have spam filters turned on and that hovering over a link will display the URL. It will easily enable them to determine from whom or where the email originated. If they’re not familiar with the sender, they shouldn’t open it. Ever.
Social Engineering
Scams that target and rely on the curiosity of email recipients are called social engineering. Phishing is its most popular example. In phishing attacks, bad actors attempt to create a sense of urgency that they hope will tempt recipients to click on an attack-launching link or provide personal information to help rectify a situation. Pull up some social engineering examples online to share with your employees. Point out telltale phishing signs: misspellings, requests for personal information, an unbelievable or unrealistic sense of urgency. Because these attempts can be tricky, remind your employees to pay attention.
Mobile Security
For years, we’ve been working in a BYOD (Bring Your Own Device) world. This saves time and management costs for companies, and employees get to use a device that maintains personal information. Unfortunately, BYOD has introduced a number of security challenges.
If you don’t have a BYOD policy in place, you should. It needs to cover what employees can and cannot do on their mobile devices, the types of devices that can be used, password expectations and requirements, the external applications allowed, authentication information and the work-related functions that can be handled on mobile devices. Most importantly, this policy should clearly state that upon termination of employment, the device will be wiped clean. If you have such a policy, now is a good time to remind your employees about it.
Internet Browsing Done Safely
Reiterate to employees the importance of understanding which browser settings must be selected. Also, make sure they know how to find the settings page when there’s nobody around to help them. Ensure they understand how to verify the safety of a website and make sure its data is encrypted. As a reminder, if you don’t see an S after HTTP, it’s time to move on. That S stands for secure.
Questions About Cybersecurity? You Have Two Great Contacts to Choose From
For information about how to keep your organization and employees safe this holiday season — and beyond — contact the cybersecurity experts at DataBank and our long-time partner Radware.
About the Author:
Mark Houpt, DataBank’s Chief Information Security Officer, brings over 30 years of extensive information security and information technology experience in a wide range of industries and institutions.
(Originally published in Data Center Frontier magazine)
By: Jenny Gerson, senior director of sustainability, DataBank
There’s a lot of confusion about renewable energy use in the data center, what electricity is considered renewable, and who can claim its benefits. To help, this article looks at the factors related to reporting on grid-provided renewable energy in the data center and focuses specifically on the renewable power from grid rather than on-site or “behind the meter” generation of renewable power.
Companies today are under increasing pressure to “go green” in all facets of their business, both to reduce their environmental impact and to meet expectations from consumers, shareholders, specific regulations, or achieve their own corporate objectives. In the data center industry, it’s added up to a Catch-22: Customers need more power but they want it to be as emission-free as possible. What’s more, they want to be able to publicly claim that the energy consumed within their data centers is generated by renewable source as evidence of their progress towards their climate-change goals.
Yet, as Kermit the Frog once sang, “It’s not that easy being green.” This is especially true in the data center industry today, where there is a lack of consensus—and often confusion—about renewable energy and how a data center’s power use translates to its customers. To help, I will define renewable energy, explain the framework that tracks its use, and clarify what claims data center customers can responsibly make to accurately represent their power use.
Renewable Energy Sources
First, just what is renewable energy and where does it come from? Once again, without clear shared definitions, information varies from utility to utility, as do their claims regarding renewable energy generation.
The Intergovernmental Panel on Climate Change (IPCC) considers renewable energy to be the power that comes from solar, wind, geothermal, biomass, and hydropower sources. Additionally, nuclear power is considered to be zero-carbon emitting but not specifically included as a renewable source of power. To think of it another way, renewable energy comes from sources other than those that require the combustion of fossil fuels and emit greenhouse gases (GHGs), such as coal, natural gas, and oil.
No Way to Identify Renewable Electricity
Much of the confusion related to renewable energy use and “ownership” of its associated benefits comes from the fact that the electrical grid does not distinguish how the electricity is generated. For example, electrons produced from a wind turbine are no different from those created by a coal-powered power plant once on the grid.
Who Owns the Claim to Renewable Energy?
We look to power our data centers using as much renewable energy as possible. Our customers also like us to use as much renewable energy as possible. Not only is it the right thing to do to reduce our environmental impact and combat climate change, but many of these companies would like to publicly claim that they are using green power in the data center. Their logic seems to make sense:
“My data center provider uses energy from renewable sources to provide the power I use in the data center, so we should be able to say that we use renewable energy, too.”
Unfortunately, renewable energy accounting doesn’t work this way. It can be a maddening scenario because their rationale seems solid, and even experienced industry insiders can’t always provide satisfactory answers.
Once electrons are added to the grid, they blend in with all types of electricity. In other words, there is no way to differentiate electrons generated by renewable sources once they are on the grid and co-mingled with those from other sources.
Establishing Ownership with RECs
To respond to these challenges, the U.S. electricity market created a specific legal and economic framework to track the generation, sale, and use of renewable energy on the grid. When any type of renewable energy generator produces and adds one megawatt-hour of power to the grid, it creates two different types of value: The physical electricity and a legal instrument called an energy attribute certificate (EAC) that demonstrates the electricity came from renewable energy sources. In the U.S., EACs can be purchased in the form of a Renewable Energy Certificate (REC).
In this way, RECs divide renewable electricity into two separate attributes: electricity and the so-called renewable-ness of that electricity. Both can be sold as energy commodities: The electricity is sold as a megawatt-hour to physically power a building while the renewable attribute is sold as a REC, or the legal renewable claim. RECs have a 12-month lifespan, during which, they are retired on behalf of the purchaser.
When it comes to the use of renewable power, only REC owners can make claims related to reducing a company’s overall carbon emissions. Once a claim is made by the REC owner, the REC is retired and no other company can legally (or ethically) make claim to the renewable electricity associated with the REC.
Greening the Grid and Other REC Benefits
So unfortunately —and as much as it may not make immediate sense— data center customers may not make claim to the environmental benefits of this renewable electricity, even though their equipment is located in a facility whose data center provider has procured RECs. What they can claim, according to the GHG Protocol is that they are choosing to colocate their equipment in data centers that are powered by renewable sources. However, they may not claim that this power reduces their emissions directly.
Nonetheless, RECs still provide important benefits. For example, purchasing RECs supports renewable energy by providing a demand signal to the market. It’s a one-two punch: RECs can help companies meet their carbon reduction goals while also encouraging utilities and developers to generate and add more renewable energy to the grid from sources that don’t produce fossil fuel-based GHG emissions.
RECs can also help companies reduce their Scope 2 emissions. As part of GHG accounting, Scope 2 carbon emissions focus on indirect emissions from purchased and consumed energy, per the GHG Protocol. Purchasing RECs directly reduces the indirect emissions of purchased and consumed power which is reflected in the reduction of Scope 2 emissions total.
A Cleaner Future
Many multi-tenant data center providers are making commitments to a greener future. For example, DataBank has pledged to be Net Zero by 2030 – a directive by our parent company DigitalBridge. We understand that many customers have similar goals. By understanding renewable energy sources as well as how RECs can help reduce carbon emissions while promoting the next wave of renewable energy development, any company can make more accurate claims —and future decisions— about their power consumption. Whether or not they are able to make claim to RECs, a customer’s decision to use a data center provider who procures power from renewable energy sources contributes to the ultimate goal of a more sustainable future.
# # #
Featuring: Mark Houpt, DataBank’s Chief Information Security Officer
Listen to Mark Houpt as he discusses the latest trends in data security and privacy.
Here are a few things you’ll learn:
The trend in attacks from rogue groups vs. nation-states
The disbanding of ransomware groups
The trend in federal and state governments in developing new consumer privacy laws
The cost and implications of new privacy laws
Cyber Insurance
Run Time: 21 minutes
DataBank’s CISO Corner is for CISOs and security practitioners, where we discuss a variety of cybersecurity topics and current events from the CISO’s perspective. Our broadcast is designed for those who want to hear from security and compliance experts on the front lines.