Request Information

Request Information

or Call 1.877.459.4347

[Part 1] Scary Stories Impart Valuable Lesson for Network Security

October 30, 2013 / Joseph Pedano

Late one night, 911 operators received a harrowing phone call from a woman who heard strange noises at her front door. She grabbed her 6-month-old baby, a licensed pistol and locked herself in an upstairs bathroom, holding her breath while the intruder violently tore apart the first floor of her home and stole valuables. In minutes, he was gone: “like a ghost,” said the homeowner. Later, they found the crook along with over 100 different house keys, presumably, of other unsuspecting victims.

A creepy story and one that will likely remind you to set your house alarm tonight, but it’s the scary tales of network invasions that will make even the most powerful executive shudder. In fact, security is the number one greatest fear of IT Directors, according to Evolve IP’s recent survey. As alarming, a new report from Silicon Valley Bank reveals that only one-third of 200 tech executives surveyed are completely confident in the security of their information.1

Stories of cyber security attacks flood the news with disturbing frequency. A breach in Epsilon’s network leaked millions of names and email addresses from the customer databases of some of its biggest clients.2 Sony Corp.’s PlayStation Network and Sony Online Entertainment suffered a series of attacks that placed 100 million customer accounts at risk, costing the company up to $2 billion.3 A group of individuals claiming to be affiliated with the ‘hacktivist’ collective Anonymous stole 75,000 credit card numbers and 860,000 user names and passwords from Stratfor, a subscription-based provider of geopolitical analysis.4 And earlier this fall, the websites of several large U.S. financial firms were disrupted by a monster DDoS attack that reportedly exceeded 60 Gbps – much larger than the typical 5-10 Gbps attack.5

Indeed, it seems like security standards are being compromised every day, masked by the hasty assurances that the occasional breach is inevitable and that everyone takes network security as seriously as you do.

Or not. Lapses in security practices may not be obvious, especially when obscured by contract liability language and certain…ahem…unstated assumptions. But while no cloud provider can absolutely guarantee an ironclad defense against the threats of tomorrow, every cloud vendor should be expected to maintain robust procedures that anticipate and mitigate data security risks before they cause harm.

In order to ensure maximum protection from all of the existing and emerging threats to any network’s security whether in the cloud or on-premise, there are two major buckets that need to be filled with proper security measures: 1) physical construction and 2) architectural design.

Physical Construction – Critical components to ensure control and constant visibility

Fewer than 10% of cloud providers own and operate 100% of their own facilities and, instead, rely on partners to provide data center resources. As a result, you need to ask the right questions to ensure that they have selected the right organizations; ones that provide the necessary controls and visibility into the physical security measures in place to protect their service offerings.

Look for cloud providers that either own or work with Tier One data centers, those strategically located in regions with low risk of natural disasters. This helps ensure that the provider also maintains rigorous protocols for securing these centers from things like unauthorized access. For example, each data center should only be accessible at a single point of entry and exit, secured with a biometric scanner and/or a video call box that allows security guards to visually identify each visitor before granting entry. And, ask if the provider monitors each data center around the clock via closed-circuit TV cameras that also record all footage. Be sure to probe the cloud provider, also, about security within the facility. For example, are all areas individually segmented with badge-secured doors, two-factor authentication and biometric hand scanning systems? Inside the server rooms, are each rack, cage and cabinet individually locked with keys held in a monitored lockbox?

In addition to protecting a provider’s data centers from unauthorized access, each center should be safeguarded from environmental threats. Extensive environmental controls and back-up power units must be installed – complete with dual power grids, multiple battery lines, emergency generators, back-up fuel supply, fire-suppression system, smoke and thermal detectors, and a fail-secure door and alarm system. Do the data centers have adequate cooling and ventilation? Are they physically separated from underlying service providers and other third parties? These are important questions to ask when considering a new provider…whether in the cloud or not.

Last but not least, it’s critical to find out how thoroughly the provider checks the background of each employee that will be working on site. Does the provider enforce mandatory drug testing? Run full background checks? Vet each potential employee with a detailed interview process? If you’re not convinced of the reliability of their hiring process, reconsider.

In next week’s post I will look architectural design and protecting how data is moved stored and transacted in the Cloud. In the meantime for 10 Easy-to-Implement cloud security best practices click here!

Sources:

1. Wall Street Journal Online, “Survey shows majority of tech executives planning for cyber security attacks,” by Silicon Valley Bank, September 24, 2013.

2. Sophos Naked Security Blog, “Epsilon email address megaleak hands customers’ customers to spammers,” by Paul Ducklin, April 4, 2011.

3. Sophos Naked Security Blog, “Sony admits breach larger than originally thought, 24.5 million SOE users also affected,” by Chester Wisniewski, May 3, 2011.

4. Sophos Naked Security Blog, “Data leaks at Stratfor and Care2 mark the end of a year riddled with data theft,” by Chester Wisniewski, December 30, 2011.

Read Part 2 —->

Categories: Security & Compliance

Clients We Work With

  • Company Profile

    Based in Northern New England, ClearChoiceMD treats urgent, non-life-threatening medical needs.

    Testimonial

    "With Cloud Connect, we have eliminated intermittent phone and internet service drops, increased the reliability of daily business tasks like writing e-prescriptions. We’ve even resolved printing issues. We have zero down time now as a result of connectivity because we’re always up and running.”

    Alex Fuchs, IT Director for CCMD

  • Company Profile

    CCI Health & Wellness Services is a group practice, empowering patients to partner with staff for an unparalleled healthcare experience.

    Testimonial

    “Usability is one of the most important factors in selecting technology solutions. We needed a solution that our staff could learn quickly and rely upon each day through high call volumes. Evolve IP emerged as best choice and the deployment has been very successful.”

    John Torontow, MD, MPH Chief Operating Officer - CCI Health and Wellness Services

  • Company Profile

    Apple Vacations specializes in vacations to top destinations like Cancun, Punta Cana, the Bahamas, Costa Rica, Panama, Hawaii, and many others in the Caribbean and Mexico.

    Testimonial

    “The Evolved Call Center has given us maximum visibility, flexibility, and productivity in our daily call center operations.”

    Shannon McCain, Resource Development Manager Apple Vacations

Awards & Recognition

View More

Compliance & Certifications

View More

Latest Blog Posts

Things To Consider Before Moving To The Cloud | Part 1
February 14, 2017 / Rich Fox
Most I.T and business professionals can easily rattle off the many benefits of a cloud-based call center: the scalability, the…
To DaaS or not to DaaS
February 2, 2017 / Ryan Berg
My current role has me working with one of the largest agents in the US.  As one of many horses…
LIVE: Contact Center Demo | January 31st 1PM (EST)
January 12, 2017 / Evolve IP
Title: Insights that drive customer satisfaction Presenter: Rich Fox, VP of Contact Center Solution When: 1:00 PM EST | Tuesday,…
View More

Lastest Press Releases

Evolve IP and Nimble Storage Partner to Bring HIPAA-Compliant / HITRUST-Audited Cloud Services to Healthcare Organizations across the United States
February 16, 2017 / Evolve IP
Partnership allows an easy way to deploy on-premises Nimble Storage flash arrays supported by robust cloud infrastructure for hybrid cloud, backup, and disaster recovery solutions. WAYNE, Pa.— February 16, 2017…
Healthcare IT News Covers Evolve IP / Nimble Partnership
February 15, 2017 / Evolve IP
A key business driver for this partnership is the fact that healthcare organizations' demand for secure, HIPAA-compliant cloud services, is at an all-time high. The partnership allows healthcare organizations ease…
Evolve IP DRaaS Solution Recognized in Gartner’s Critical Capabilities Report
February 13, 2017 / Evolve IP
WAYNE, Pa. February 13, 2017 – Evolve IP, The Cloud Services Company™, today announced that its Disaster Recovery as a Service (DRaaS) offering was chosen for inclusion in Gartner’s 2016…
View More
close

Contact Us

or Call 1.877.459.4347