After Texas I got the same question from a few managers: Could this happen to us? The honest answer is: Read your outsourcing contract and you\u00b4ll know.<\/p>\n
Most contracts I see measure uptime, response times and price per server. Very few say anything about how the provider protects the access they have to your environment. Even fewer say what happens if the provider is the way in. Who pays for the incident response? Who pays when your business is down for two weeks? And is the provider obliged to tell you about an intrusion at another customer that might affect you?<\/p>\n
Earlier this year I wrote about a customer that had to involve legal just to investigate their own Active Directory. That is the other side of the same coin. If the contract doesn\u00b4t give you the right to see and to act, you won\u00b4t be able to.<\/p>\n
So, for management: Put the security requirements in the contract, not only in an appendix that nobody reads. Demand the right to audit and to get the logs. Demand that the provider reports incidents to you within hours, not weeks. And make sure the price for all of this is part of the deal from the start.<\/p>\n
A cheap contract is only cheap until the day the ransom note arrives.<\/p>\n","protected":false},"excerpt":{"rendered":"
After Texas I got the same question from a few managers: Could this happen to us? The honest answer is: Read your outsourcing contract and you\u00b4ll know. Most contracts I see measure uptime, response times and price per server. Very few say anything about how the provider protects the access they have to your environment. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11],"tags":[38,44,41],"class_list":["post-1046","post","type-post","status-publish","format-standard","hentry","category-business","tag-business","tag-contracts","tag-service-providers"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1046"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1046\/revisions"}],"predecessor-version":[{"id":1058,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1046\/revisions\/1058"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1046"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}