crowmoor.se

I might be a bit naïve when it comes to Service Provider but, normally, I would expect contracts to contain just a bit of clauses regarding intrusions and loss of data but apparently this is seldom the case. Only thing that is measured is uptime in the SLA and with todays very efficient malware and hacks an infrastructure will continue working, quite often undisturbed, until the hackers decides that it´s time for a ransomware.

It is very seldom that Service Providers add the extra cost of protecting against Credential Theft, with my full understanding as it can be quite costly for the first projects, but at the same time they are digging their grave at the same time. With smaller Service Providers having to compete with cloud based services their incentive to invest in security should be higher as a way to keep the customers but when the customers don´t understand the need what are you to do?

The most common scenario I see is that the customer understands the need for Credential Theft Mitigation (CTM) and asks their Service Provider how to manage this and either gets a ‘That´s not in the contract’ or, even worse, just a blanc stare of not understanding.

In those cases most of my customers decides to take matters in their own hands and move the critical servers (Tier 0) into another datacenter (preferably their own) and either run it by themselves or give it to a trusted Service Provider that have the needed protections for CTM.

I just hope that Service providers will understand the risks they are exposing their customers for with their unwilling to implement CTM.