Hosting providers seem to be an often overlooked exposure area for many small and mid-size organizations. In the last several weeks, as we have been growing the use of our passive assessment platform for supply chain assessments, we have identified several instances where the web site hosting company (or design/development company) is among the weakest links. Likely, this is due to the idea that these services are commodities and they are among the first areas where organizations look to lower costs.
The fall out of that issue, though, can be problematic. In some cases, organizations are finding themselves doing business with hosting providers who reduce their operational costs by failing to invest in information security.* Here are just a few of the most significant issues that we have seen in this space:
- “PCI accredited” checkout pages hosted on the same server as other sites that are clearly under the control of an attacker
- Exposed applications and services with default credentials on the same systems used to host web sites belonging to critical infrastructure organizations
- Dangerous service exposures on hosted systems
- Malware infested hosting provider ad pages, linked to hundreds or thousands of their client sites hosted with them
- Poorly managed encryption that impacts hundreds or thousands of their hosted customer sites
- An interesting correlation of blacklisted host density to geographic location and the targeted verticals that some hosting providers sell to
- Pornography being distributed from the same physical and logical servers as traditional businesses and critical infrastructure organizations
- A clear lack of DoS protection or monitoring
- A clear lack of detection, investigation, incident response and recovery maturity on the part of many of the vendors
It is very important that organizations realize that today, much of your risk extends well beyond the network and architectures under your direct control. Partners, and especially hosting companies and cloud providers, are part of your data footprint. They can represent significant portions of your risk, and yet, are areas where you may have very limited control.
If you would like to learn more about using our passive assessment platform and our vendor supply chain security services to help you identify, manage and reduce your risk – please give us a call (614-351-1237) or drop us a line (info /at/ MicroSolved /dot/ com). We’d love to walk you through some of the findings we have identified and share some of the insights we have gleaned from our analysis.
Until next time, thanks for reading and stay safe out there!
*Caveat: This should not be taken that information security is correlated with cost. We have seen plenty of “high end”, high cost hosting companies with very poor security practices. The inverse is also true. Validation is the key…
New Blog Post: Hosting Providers Matter as Business Partners https://t.co/E7XgTz9SBh