Hosting providers seem to be an often overlooked exposure area for many small and mid-size organizations. In the last several weeks, as we have been growing the use of our passive assessment platform for supply chain assessments, we have identified several instances where the web site hosting company (or design/development company) is among the weakest links. Likely, this is due to the idea that these services are commodities and they are among the first areas where organizations look to lower costs.
The fall out of that issue, though, can be problematic. In some cases, organizations are finding themselves doing business with hosting providers who reduce their operational costs by failing to invest in information security.* Here are just a few of the most significant issues that we have seen in this space:
“PCI accredited” checkout pages hosted on the same server as other sites that are clearly under the control of an attacker
Exposed applications and services with default credentials on the same systems used to host web sites belonging to critical infrastructure organizations
Dangerous service exposures on hosted systems
Malware infested hosting provider ad pages, linked to hundreds or thousands of their client sites hosted with them
Poorly managed encryption that impacts hundreds or thousands of their hosted customer sites
An interesting correlation of blacklisted host density to geographic location and the targeted verticals that some hosting providers sell to
Pornography being distributed from the same physical and logical servers as traditional businesses and critical infrastructure organizations
A clear lack of DoS protection or monitoring
A clear lack of detection, investigation, incident response and recovery maturity on the part of many of the vendors
It is very important that organizations realize that today, much of your risk extends well beyond the network and architectures under your direct control. Partners, and especially hosting companies and cloud providers, are part of your data footprint. They can represent significant portions of your risk, and yet, are areas where you may have very limited control.
If you would like to learn more about using our passive assessment platform and our vendor supply chain security services to help you identify, manage and reduce your risk – please give us a call (614-351-1237) or drop us a line (info /at/ MicroSolved /dot/ com). We’d love to walk you through some of the findings we have identified and share some of the insights we have gleaned from our analysis.
Until next time, thanks for reading and stay safe out there!
*Caveat: This should not be taken that information security is correlated with cost. We have seen plenty of “high end”, high cost hosting companies with very poor security practices. The inverse is also true. Validation is the key…
Check it out, and let us know if you would like help building, improving or auditing your program. In addition, if you would like to retain MSI for your third party oversight needs, please get in touch with your account executive or call us at (614) 351-1237. We have a strong history of program oversight across disciplines and would be happy to help keep your initiative on track!