{"id":1353,"date":"2020-09-29T15:43:55","date_gmt":"2020-09-29T14:43:55","guid":{"rendered":"http:\/\/www.intelligentcio.com\/north-america\/2020\/09\/29\/ensuring-secure-data-centre-operations-and-avoiding-cyberattacks\/"},"modified":"2023-05-25T12:05:27","modified_gmt":"2023-05-25T11:05:27","slug":"ensuring-secure-data-centre-operations-and-avoiding-cyberattacks","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/north-america\/2020\/09\/29\/ensuring-secure-data-centre-operations-and-avoiding-cyberattacks\/","title":{"rendered":"Ensuring secure data centre operations and avoiding cyberattacks"},"content":{"rendered":"\n

Alex Tarter, Chief Cyber Consultant and CTO, Thales, and Matt Walmsley, EMEA Director, Vectra, discuss the different variables that contribute to secure operations in the data centre sector, and how effective detection and response can be the difference between a contained security incident or an organisational damaging breach.<\/em><\/p>\n\n\n\n

The COVID-19 pandemic has reshaped the way many industries operate and yet there is still great demand within the IT sector, particularly as the surge in data puts pressure on the need for data centres. However, Alex Tarter, Chief Cyber Consultant and CTO, Thales, says that even before the pandemic, cloud adoption was reshaping the way data centres operated and how CIOs kept their organisation\u2019s infrastructure secure. \u201cWith 93% of businesses using a multi-cloud strategy to store data, it\u2019s the go-to IT environment, especially now that a substantial amount of the UK workforce is logging on remotely,\u201d said Tarter. \u201cThis widely distributed workforce, based overwhelmingly on the cloud, is challenging security teams to adapt at an unprecedented rate. So, how can data centre leaders ensure they operate securely?<\/p>\n\n\n\n

\u201cAs remote working, or at least hybrid patterns, look set to stay well beyond the pandemic, it\u2019s vital that data centre leaders reduce their reliance on employees in data centres and hosting facilities. Fortunately, even on-site security solutions such as hardware security modules (HSMs), are now available as cloud services, which can be accessed remotely.<\/p>\n\n\n\n

\u201cAccess to cloud-based technologies has shifted the day-to-day operations of data centre leaders; for instance, the decline in on-premises \u2018traditional\u2019 IT infrastructure has been accelerated by the pandemic, with usage of these facilities decreasing by over half (54%) in 2020, when compared to 2018.\u201d<\/p>\n\n\n\n

Tarter said that the industry is also seeing data centres going \u2018dark\u2019 at an increasing rate \u2013 dark data centres ultimately help to manage costs and improve physical security, as they operate almost entirely remotely through lights out management (LOM).<\/p>\n\n\n\n

As businesses look to revisit earlier projects put on hold during the first months of lockdown, Tarter added that data centre leaders need to start focusing more heavily on securing their cloud infrastructure offerings. \u201cIt\u2019s time for organisations to adapt their security practices to these new conditions by reducing the reliance on employees being physically in data centres, while employing systems to keep their employee and customer data secure and encrypted in the cloud,\u201d said Tarter.<\/p>\n\n\n\n

\u201cIf businesses don\u2019t take these steps now and adapt to this new reality, it might be the case that they\u2019re much less agile and not able to pivot when faced with new threat vectors or external influences. For most organisations, the starting point for securing data on the cloud is being situationally aware. This means understanding what data it has, where it\u2019s stored, who can access it and the risks associated with storing it. From here, security teams can start to remotely implement access control, encryption, key management and key security.\u201d<\/p>\n\n\n\n

Tarter said that data centre leaders need to make sure that their infrastructure isn\u2019t just secure, but resilient to unexpected operational shifts.<\/p>\n\n\n\n

Matt Walmsley, EMEA Director, Vectra, is of a similar view when it comes to data centres being a tantalising target due to the wealth of information they contain. However, he believes that unless the attacker gets lucky and finds an Internet-facing vulnerability, directly compromising a data centre takes a significant amount of effort and planning. As a result, cyberattacks that target data centres tend to be patient, mature operations that emphasise persistence and require flying below the radar of security teams. Walmsley considers some of the critical attack vectors used to target data centres:<\/p>\n\n\n\n

Co-opting administrative access<\/strong> \u2014 Administrative protocols can give attackers backdoor access into the data centre without the need to directly exploit an application vulnerability. And by using standard admin tools such as SSH, Telnet or RDP, attackers easily blend in with normal admin traffic.<\/p>\n\n\n\n

Local authentication loopholes<\/strong> \u2014 Many data centres implement additional local authentication options that can be used in an emergency, to access the hosts and workloads they need to manage. However, these options are not logged and the same login credentials are often shared across hosts and workloads for the sake of simplicity. When attackers find the credentials by compromising an administrator, they can silently access the data centre.<\/p>\n\n\n\n

Hardware backdoors<\/strong> \u2014 Today\u2019s data centres are synonymous with virtualisation. Yet virtual disks are ultimately dependent on physical disks and the physical disks run in physical servers. Physical servers have their own management planes designed for lights-out and out-of-band management. These actions are often performed via protocols such as Intelligent Platform Management Interface (IPMI). IPMI has well-documented security weaknesses and are often slow to receive updates and fixes. Additionally, there is currently a worrying 88,336 hosts\u2019 IPMI interfaces exposed to the Internet. The combination of IPMI vulnerabilities and its immense power make it a significant attack vector for threat actors attempting to subvert the security of the data centre.<\/p>\n\n\n\n

Advanced attackers, including nation-states, increasingly target physical servers, routers, switches and even firewalls. At a fundamental level, the attackers use rootkits that sit below the level of the operating system, making them extremely difficult to detect using traditional methods. These techniques allow attackers to infect the very devices that are trusted and charged with protecting the network, and then use those devices to launch attacks deeper into the network.<\/p>\n\n\n\n

Hidden command-and-control traffic, the reconnaissance, the lateral movement, the compromise of user and admin credentials are all prerequisites that lead up to the intrusion into the data centre. An attack is typically at a mature stage by the time it reaches a data centre. Subtle attackers attempt to stay low and slow by patiently exfiltrating data at rates that are less likely to be noticed or arouse suspicion. Efforts can also be made to obscure data exfiltration in hidden tunnels within normally allowed traffic, such as HTTP, HTTPS or DNS traffic.<\/p>\n\n\n\n

Rapid detection and effective response to the evidence of a hidden attacker active in or approaching the data centre can make the difference between a contained security incident or an organisational damaging breach. The signals that betray hidden attackers through their immutable behaviour are there but hidden in the vast noise of legitimate communications and interactions. It\u2019s here that automation, powered by AI, is increasingly supporting security teams in protecting their data centre using Network Detection and Response (NDR) platforms to detect and respond to hidden attacks at speeds and scale unattainable by human efforts alone.<\/p>\n","protected":false},"excerpt":{"rendered":"

Alex Tarter, Chief Cyber Consultant and CTO, Thales, and Matt Walmsley, EMEA Director, Vectra, discuss the different variables that contribute to secure operations in the data centre sector, and how effective detection and response can be the difference between a contained security incident or an organisational damaging breach. The COVID-19 pandemic has reshaped the way […]<\/p>\n","protected":false},"author":21,"featured_media":1354,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[13,17,1645,43],"tags":[88,835,836],"class_list":["post-1353","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-centres","category-enterprise-security","category-insights","category-top-stories","tag-covid-19","tag-thales","tag-vectra"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/posts\/1353","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/comments?post=1353"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/posts\/1353\/revisions"}],"predecessor-version":[{"id":29016,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/posts\/1353\/revisions\/29016"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/media\/1354"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/media?parent=1353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/categories?post=1353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/tags?post=1353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}