In my previous post I wrote about a service provider that lost more than 50 Active Directory forests in one attack. This one is for management, and especially for those who outsource IT operations.<\/p>\n
When you outsource your IT you don\u00b4t outsource your risk. You change it. Your security now depends on how the provider protects its own admins, its tools and its other customers. If an attacker gets into the provider, he may get into all of its customers at once, including you.<\/p>\n
What does that cost? For the customers in my case it meant weeks without systems, rebuilding from scratch and a lot of questions from their own customers and regulators. The provider\u00b4s contracts did not cover anywhere near the real cost.<\/p>\n
So here are a few things to ask your provider. Are your admin accounts and tools separated per customer, or can one stolen account reach everyone? Do you protect your admins with a second factor and dedicated admin workstations? How fast will you tell us if you have an incident? Can we see the logs of what your staff do in our environment? And what happens to us if you go down?<\/p>\n
If the answers are vague, the risk is real.<\/p>\n
Outsourcing can be a good decision. But you need to pay for the security, either up front in the contract or later in the incident.<\/p>\n
Someone else\u00b4s hands still hold your keys.<\/p>\n","protected":false},"excerpt":{"rendered":"
In my previous post I wrote about a service provider that lost more than 50 Active Directory forests in one attack. This one is for management, and especially for those who outsource IT operations. When you outsource your IT you don\u00b4t outsource your risk. You change it. Your security now depends on how the provider […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,85,41],"class_list":["post-1268","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-outsourcing","tag-service-providers"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1268"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1268\/revisions"}],"predecessor-version":[{"id":1303,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1268\/revisions\/1303"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}