When the datacenter of your provider goes down
Jan 25th, 2024 by Jesper Kråkhede
Last weekend a large IT service provider was hit by ransomware in one of its Swedish datacenters. The effects were felt all over the country. Municipalities, government agencies, hospitals, retailers and a cinema chain. Shops closed, a payroll and HR system used by many universities and government agencies went down, and people couldn´t report their sick leave.
Most of the affected organisations did nothing wrong themselves. Their systems were simply running in the same place as everyone else´s.
This is the supply chain risk in its purest form. And there are technical things you can do about it.
First, know where your systems actually run. Not just ‘at the provider’, but which datacenter, which platform and which other systems share it.
Second, keep your own copy. Backups that the provider can´t reach, ideally in another location and with immutability. If the provider´s environment is encrypted, your data shouldn´t be.
Third, separate the identities. Your provider´s admins should use accounts that only work in your environment, with a second factor and from devices they control. A single admin account that reaches all customers is a single point of failure for all of them.
Fourth, monitor the connections. Log what the provider does in your environment and send it to your own SOC.
Fifth, practise the day the provider is gone. Which systems must work, and how do you run them without the provider?
You can outsource the operation. You can´t outsource the consequences.