Cybersecurity for Rural Telecom and Broadband Sites

Greetings and welcome back.  This week, we continue our series on Cyber and Physical Security for Remote Telecom sites with our blog: Cybersecurity for Rural Telecom and Broadband Sites.  In our last blog, we discussed the availability of open network ports that are used by cybercriminals as back doors to steal data and destroy your equipment.  This week, we look at the ability of hackers to penetrate the front door of your network to wreak havoc with your operations.

To begin with, its important to realize that, whether you have a rural or urban telecom site, you’re a key target of hackers and data thieves.  Hackers get paid for disrupting your operations and data thieves get paid by stealing your customer’s data and selling it on the black market.  All the data that passes from your customers to and then from the Internet flows through your remote sites and for this reason, the bad guys put high value on your sites.

How Hackers can Attack Rural Telecom Sites

To give you an example of how hackers can target your rural sites, please look at this article of a hacker who brought-down hundreds of thousands of Deutche Telecom customers.  In this case, a hacker was paid $10,000 by a middle eastern company in order to take down the DT customer network.  The hacker modified the Mirai Botnet to attack the port 7547 – the port for Simple Online Access Protocol (SOAP) which is used to remotely manage a number of routers.  By using this port to overload the routers and then the network, the hacker was able to bring down the DT network.  The key thing here is that there are always people willing to pay to harm companies or their customers and you must consider that you are a potential attack candidate.

In making a scan of rural telecom sites via the Shodan Search Engine, I found a significant number of routers that have open ports that could be used to bring down their networks.  For obvious reasons, the names of those organizations will not be named but, it is clear that rural telecom sites are vulnerable to similar and perhaps much more destructive attacks.

How Data Thieves can Steal Data at Rural Telecom Sites

Stealing of data through a remote site is surprisingly easy.  To do so, one only need gain physical or virtual access to any remote telecom site.  From there, permissions can be created to allow selected packets of information to be duplicated and then sent to a cyber-thief’s awaiting server.  For security reasons, the particulars of this hack will not be shared but, I can say that I was able to find innumerable rural telecom site network systems online using Shodan.  Thousands of sites presented the option to remotely configure a switch at these sites and, once done, a data thief would be in control of that network site. This leaves those sites wide open to data thieves and leaves open huge liability to the telecom service provider.

What Can be Done to Protect Rural Sites?

Its imperative that the open ports of these systems be secured.  In terms of remote management, simply placing a firewall on that port is of little value.  The reason for this is that the firewall must decide to let those whom it believes to be “good guys” to have access to the units.  The problem with this is that its all-too-easy to spoof a good guy and take over the site.

What needs to be done is to completely lock down all remote management ports and to send all data from those ports into a secure location, accessible only by privileged individuals.  This is exactly what our RackGuardian product does.  It creates a stealth shield around any device that it monitors while it sends all monitoring data with respect to that device to our secure cloud portal.  The result is that you can remotely monitor and manage your critical network equipment while keeping its presence hidden from all Internet traffic.

Please think about this and give us a call if you would like assistance at your remote sites.  We would be happy to have a confidential discussion with you about your security options.

Until Next Time,

Be Well!

 

 

Cyber and Physical Security for Rural Telecom Sites

Greetings and welcome back.  This week we begin a study of the Cyber and Physical Security for Rural Telecom Sites. If you are a provider of telecom and broadband services to rural areas, you know that cybersecurity and physical security are large and growing concerns.  The huge geographic areas that your network covers and the relatively few personnel to cover them makes for serious security challenges and we will address the cyber and physical challenges of these sites during this blog series.

To begin with, there are roughly 1000 companies in the United States who are classified as rural telecom providers.  Having spent a good deal of my life in rural country, I have an appreciation for the companies who serve these large areas of our country and understand that the growing threats of cybersecurity and continuing threats to physical security are likely to increase over time.  In fact, several cyberattacks on rural municipalities and utilities show that rural operations are increasingly becoming cyber targets.  When you add to that the damage from physical attacks – such as this highly destructive cable cutting in rural Northern California – its clear that bad guys are targeting rural utilities and that these are not isolated instances.

In this first part of the blog series, we’re going to look at cybersecurity backdoors in your remote plant and equipment as well as in your head-end sites.    If we want to address this subject in a practical way, we must first ask: “What network ports within my sites could be used by a hacker as a back door?”

Security for Rural Telecom

We have done a thorough scan of rural telecom and broadband sites throughout the U.S. to find out the correct answer to this question.  While we will not release the total number of ports involved for security reasons, we can say that open ports with minimal security on rural utility networks total in the hundreds of thousands. The avenues most commonly used in attacks by the bad guys are remote management ports which see little traffic but, which are most often left open for the convenience of the user.  The ports which we found to be open in large numbers in rural telecom sites are:

  • Port 21 – FTP – File Transfer Protocol: an unencrypted protocol used for downloading firmware and other updates
  • Port 22 – SSH – Secure Shell: a well-secured means for remote login and command-line system changes
  • Port 23 – Telnet – an unencrypted protocol used for remote login and command-line system changes
  • Port 69 – TFTP – Trivial File Transfer Protocol: an unencrypted and non-passworded protocol for updates
  • Port 80 – HTTP – Hyper Text Transfer Protocol: an unencrypted protocol used for web-page access and system changes
  • Port 161 – SNMP – Simple Network Management Protocol: a modestly encrypted protocol used for remote management
  • Port 443 – HTTPS – the encrypted version of HTTP that allows for the encrypted transmission of web-page access
  • Port 502 – Modbus – an unencrypted protocol designed for remote management of power and cooling systems
  • Port 47808 – BACnet – a lightly encrypted protocol designed for mechanical and electrical systems

Looking at this list, the first thing that comes to mind is: That’s a LOT of open ports and a LOT of options for hackers to target!  Granted, each device typically only has 2-4 ports open but, as the thief says: “I only need one…”

In studying open ports that can be seen directly on the Internet through the Shodan Search Engine, the most numerous systems on your network are NOT computers but, rather:

  • Routers
  • Network Switches
  • Power Distribution Units
  • Backup Power Systems
  • Telecom Systems

Because open ports on these systems have minimal security, they are not a challenge for even a hacker of modest skill to gain access.  Once a cybercriminal accesses one of these ports, they can then take control of that system and can then begin to hop from one system to the next until a value-rich-target system is penetrated.  When they arrive at their high-value target destination, they can then:

  • Harm, shutdown or destroy one or more of your systems directly
  • Place Malware into your systems that can constantly scan and steal interesting data over long periods of time
  • Place Ransomware on your system to force you to pay Ransom of his choosing and in his timing
  • Steal data immediately from a data source such as a server or desktop computer and then cover their steps

OK – that’s a lot of information to absorb for now so, at this point, its time to summarize this first blog about rural telecom security.  The first point is that your remote and local sites have many types of systems, each which likely has at least one open port with little or no security.   These systems are, therefore, easily penetrated by a cybercriminal and can be used to harm your systems and to steal data from your our customers.

The question to be asked is: “What can be done to stop this?”  Our RackGaurdian and CyberGuardian products are unique in this field because they block the cybercriminals from even be able to see your systems while, at the same time, allowing you to securely manage your systems from any location.  They create a stealth-shield around your systems making them invisible on a network but, provide you with a secure, encrypted channel of communications with those units.  All of this power is tied-together with our secure cloud-based system, meaning that there is no limit to the number of devices that you can protect and manage.

Please think about these things and, if you would like to have a confidential discussion about your security needs, please feel free to give us a call.  We’re here to help and we understand the needs of rural utility providers.

Until Next Time,

Be Well!

 

 

Secure, Unified Monitoring for All Your Network Closets

Many organizations have dozens, even hundreds of network closets, server labs and other small IT and Telecom rooms in their facility or campus.  All-too-often, these rooms have been monitored by multiple applications with a Network Management System (NMS) monitoring the SNMP devices, a Building Management System (BMS) monitoring the environmental and power conditions and a Security Management System (SMS) monitoring the entrance to these rooms.  RackGuardian is the first product built to provide Secure, Unified Monitoring for All Your Network Closets.  For the first time, you can monitor all your SNMP, Environmental, Power and Security Systems on a single, secure, cloud-based platform.

RackGuardian is a secure, cloud-based management appliance which you place in each of your network rooms.  It has a secure port from which to gather information from any SNMP, Modbus or other network device.  It also contains 4 environmental monitoring ports which can connect to temperature, humidity, water leak detection, fire alarm or other sensors. In addition, it also includes two Wiegand access control ports which can interface with most any card-access or biometric access system.  This gives you total scope monitoring capabilities for each room in which you place a RackGuardian.

As RackGuardian gathers data, it continuously monitors this data with self-learning analytics.  This allows the system to eliminate nuisance alarms from traditional high-low alarm set points by using its patent-pending alarm analytics.  The self-learning analytics literally learn the normal operating parameters of each device and each data-point within each device.  By doing this, you know that,  when the RackGuardian system does send you an alarm, a statistically significant event is near.

RackGuardian pushes all its statistical data to the AlphaGuardian secure cloud server once per minute – unless an alarm is spotted, in which case it pushes this data immediately to the cloud for alarm notification.  All data pushed to the cloud is done by secure 2048 bit encryption – Military grade protection.  In addition, the data is pushed because the RackGuardian acts as a data diode, one-way communication device.  It pushes data to the cloud securely but it will NOT allow any device to connect to itself or to any of the devices that it is protecting.  In fact, once a device is connected to the RackGuardian, it becomes stealth to your network.  No one can see the device or even knows that it exists.

Having a secure, cloud system that unifies all of your devices is a strategic advantage.  When you use different systems to monitor the same rooms, you have a potential for confusion and even disaster.  RackGuardian has a heirarchical, stratified access system that allows multiple departments and multiple levels within those departments to see only the items under their control.  In this way, the facilities department can securely see the environmental and power conditions, the network manager can see their servers, switches and other SNMP devices and the security officer can see when and by whom each room is accessed.

By eliminating multiple systems with a single, unified system, RackGuardian saves money both in the short and long term.  By offering all data in a secure, cloud-based platform, you have the ability to scale from a small number of rooms in one site to thousands of sites on a national or even global scale.  RackGuardian’s power can be seen in the diagram below which slows its security, simplicity and power.

a Secured, Unified Platform for Monitoring Your Network Closets

 

Until Next Time,

 

Be Well!

 

Securing Network Closets in Healthcare Facilities

Greetings and welcome back.  In today’s blog we look at a subject that is all-too-often overlooked in hospitals, doctors offices, and other medical facilities: Securing Network Closets in Healthcare Facilities.  The fact is, healthcare records have the largest value of any type of record in the black market for Personally Identifiable Information (PII).  Because of this, healthcare facilities will always be prime targets for data thieves and network closets are one of the most poorly secured part of most healthcare facilities.

In a study of all network closets in a large university, this excellent paper published by East Tennessee State University by Nathan Timbs shows that there were, on average, more than 1 threat, hazard or vulnerability for each of the 82 network closets surveyed.  Not surprisingly, data thieves have become very accomplished at using vulnerabilities in the cyber/physical security of wiring closets to steal large quantities of valuable data.  Another excellent paper published online by Towson State University shows how easily a person can gain physical access to a network closet to place an eavesdropping device into most any network.  This device – which can be a simple switch that is converted to their own nefarious purposes – then sends data offsite to their data capture system, completing the theft process.

This process, known as a man-in-the-middle attack system, is surprisingly fast and easy to add to any network closet.  In fact, some of the largest data thefts recorded have been accomplished by cyber/physical man-in-the-middle attacks such as those discussed by these two excellent papers.   This creates a significant challenge to healthcare facilities because HIPAA requires security of all your Physical, Cyber and Operational assets as is shown in the following graphic and, network closets are definitely a key to being secure and HIPAA Compliant.

Securing Network Closets in Healthcare Facilities

 

Because of these issues, it is vital that Physical, Cyber and Operational security need to be addressed in the network closet, preferably with a single unified solution.  RackGuardian was build from the ground-up to be a system that provides full physical and cybersecurity to your network closets and all of the equipment within them.

RackGuardian does all the following:

  • Interfaces and securely manages any Wiegand-Based Access Card System
  • Interfaces and protects any SNMP-based computer, network or power system
  • Provides full physical and operational monitoring of the network closet

Please think about this and take a look at RackGuardian.  We would be happy to confidentially discuss the security of your network closets for your facility.

Until Next Time,

Be Well!

Network Closet Vulnerabilities – Cybersecurity

Greetings and welcome back!  In today’s blog we will look at the problem of cybersecurity in network closets and small server rooms.  This is of particular importance to those who fall under the requirements of HIPAA, PCI-DSS or Gramm Leach Bliley as they make no distinction in where the data is located or the size of the data room.  In fact, while larger data centers often have layers of physical and cybersecurity, smaller network closets and server rooms have little, and in some cases no meaningful physical or cybersecurity.

There are a large group of smaller network rooms whose only cybersecurity is an inexpensive firewall box, which is easily evaded by a hacker.  Hackers or professional cyber criminals do not like to leave a trail to follow so, once they enter a network they often look for a device in which to hide-out while they explore the network and look for targets from which to steal data.  We have found that a favorite place to hide for these criminals in inside the network card of a Rack UPS or Power Distribution Unit (PDU).  In fact, one of the most spectacular data thefts in the past couple of years was executed through the Rack PDU of a cloud service provider.  This excellent article shows how the Rack PDU’s were used as a jumping-off-point into the servers in order to steal data.

In addition to using a Rack UPS or PDU as a hiding place from which to launch an attack on the servers within that rack, these networked power units can also be used to shut down servers and even to destroy the data in the servers.  The widely-publicized Ukrainian Power Plant hack was an excellent example of how a UPS system can be used to shut down and then wreak havoc on servers.  In this case, Malware was used to program two UPS units to shut down at exactly the same time, cutting power to all critical servers and desk tops in the power plant.

If your systems are covered under security regulations, they must have backup power systems and, if they have backup power systems, they also must be protected from hackers.  It is wishful thinking to assume all cyberattacks on a server will be from the front-door.  In today’s world of increasingly sophisticated bad guys, back doors to servers – such as those offered by UPS and PDU systems – make perfect cover for a data thief.

Fortunately, RackGuardian was designed from the ground-up to both monitor your network/server room power and environment and to provide full firewall protection at the same time.  That’s because RackGuardian includes a private network port on which to query any SNMP or Modbus system securely in its own cyber-safe envelope.  The RackGuardian seals-off all units that it monitors because its second network port pushes data to the cloud but it will not accept ANY attempts to connect with it.  All of your SNMP and Modbus systems that are being monitored by RackGuardian are invisible to the outside world because there is no way to get through the RackGuardian to see them.

If you have network closets and server rooms that need to be protected, please don’t just protect the front-door of your servers, protect the back door of your UPS and PDU units and keep the bad-guys at bay!

Until Next Time,

Be Well!

 

Network Closet Security Vulnerabilities – Physical Security

Greetings and welcome back.  In this blog, we take a close look at Network Closet Security Vulnerabilities – Physical Security.  This is the first in a new series on the key types of network closet security flaws.  This is a key topic, especially for all those of you who are covered under HIPAA, PCI-DSS, FERPA, Gramm Leach Bliley and other data security regulations.  The fact is, as more data shifts to the cloud, that means that more data is transported through your network closets to the various cloud providers that you employ.  Because cloud services tend to be well-fortressed, cyber criminals are turning to the easiest way to get to that data – your network closets.

To begin with, all of the key data security regulations require you to physically secure your data.  Here are some key provisions with which we should all take time to familiarize ourselves:

HIPAA Section 164.310: “Facility Access Controls. Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.”

PCI-DSS Requirement 9.1: Verify the existence of physical security controls for each computer room, data center, and other physical areas with systems in the cardholder data environment. Without physical access controls, such as badge systems and door controls, unauthorized persons could potentially gain access to the facility to steal, disable, disrupt, or destroy critical systems and cardholder data. 

GRAMM LEACH BLILEY: “Management should deploy adequate physical security in a layered or zoned approach at every IT operations center commensurate with the value, confidentiality, and criticality of the data stored or accessible and the identified risks.”

Its clear from these sections of security codes that you need to provide a secure card-based access system in order to be compliant with major data security regulations.  What isn’t clear is which physical security system is the best for your application.  Fortunately, our RackGuardian system is one of the only systems that supports virtually any access card on the market.  That means that, if you are already using a card access system for your main door at your facility, chances are very good that RackGuardian can support that card on a plug-and-play basis.  If, on the other hand, you need a new access card system, then we also have you covered.

In the next 2 blogs, we plan to look at cybersecurity and also backup power and environmental security for your data.  Please take a good look at RackGuardian and we believe that you will find that its the most powerful security product for data security on the market.  We welcome you to contact us with any questions about your individual security needs.

Until next time,

Be Well!

Network Closet Security – Physical Security

Greetings and welcome back.  In this blog, we take a close look at Network Closet Security Vulnerabilities – Physical Security.  This is the first in a new series on the key types of network closet security flaws.  This is a key topic, especially for all those of you who are covered under HIPAA, PCI-DSS, FERPA, Gramm Leach Bliley and other data security regulations.  The fact is, as more data shifts to the cloud, that means that more data is transported through your network closets to the various cloud providers that you employ.  Because cloud services tend to be well-fortressed, cyber criminals are turning to the easiest way to get to that data – your network closets.

To begin with, all of the key data security regulations require you to physically secure your data.  Here are some key provisions with which we should all take time to familiarize ourselves:

HIPAA Section 164.310: “Facility Access Controls. Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.”

PCI-DSS Requirement 9.1: Verify the existence of physical security controls for each computer room, data center, and other physical areas with systems in the cardholder data environment. Without physical access controls, such as badge systems and door controls, unauthorized persons could potentially gain access to the facility to steal, disable, disrupt, or destroy critical systems and cardholder data. 

GRAMM LEACH BLILEY: “Management should deploy adequate physical security in a layered or zoned approach at every IT operations center commensurate with the value, confidentiality, and criticality of the data stored or accessible and the identified risks.”

Its clear from these sections of security codes that you need to provide a secure card-based access system in order to be compliant with major data security regulations.  What isn’t clear is which physical security system is the best for your application.  Fortunately, our RackGuardian system is one of the only systems that supports virtually any access card on the market.  That means that, if you are already using a card access system for your main door at your facility, chances are very good that RackGuardian can support that card on a plug-and-play basis.  If, on the other hand, you need a new access card system, then we also have you covered.

In the next 2 blogs, we plan to look at cybersecurity and also backup power and environmental security for your data.  Please take a good look at RackGuardian and we believe that you will find that its the most powerful security product for data security on the market.  We welcome you to contact us with any questions about your individual security needs.

Until next time,

Be Well!

 

New York Cybersecurity Law & Your Rack Systems

Greetings and welcome back!  This week we continue our series on the effect of the New York Cybersecurity Law for Financial Services Companies on the need to protect Information Technology (IT) systems as well as Industrial Internet of Things (IIoT) systems.  Specifically, we look at the New York Cybersecurity Law & Your Rack Systems.

New York State authorities took significant input from experts in IT security and IIoT security in formulating this Law.  As we discussed last week the key thing to remember about this law is the following:

Under the New York Cybersecurity Law, “Information Systems” are defined to include all IT systems as well as all IIoT power, cooling and security systems that support them.

Many notable examples of cyberattacks have already taken place through IIoT power and environmental control systems including:

  • Ukrainian Power Plant Cyberattack – an Uninterruptible Power Supply (UPS) system used in combination with switchgear caused a massive blackout throughout much of the Ukraine.
  • Staminus Cloud System Cyberattack – a rack-mounted Power Distribution Unit (PDU) used to enter the cloud-based servers in a rack, stealing millions of dollars-worth of data records.
  • SCADA/BMS Cyberattacks – case studies of 5 attacks on industrial systems and the results on the affected businesses

The ease with which UPS, PDU and Environmental Control Systems is well documented by the related links. In addition, a thorough review of attack vectors against UPS, PDU and Air Conditioning Systems was well documented fully 5 years ago in a White Paper written by Dr. Patrick Traynor of the Georgia Institute of Technology.  In this paper, the vulnerability of the SNMPv3 communication protocol is thoroughly discussed.  SNMPv3 is the latest version of SNMP and was largely believed by users to be secure.

Other possible attack sequences on various types of IIoT systems have also been proven to be possible.  A number of government and university studies that have documented vulnerabilities to such attack sequences as shown below:

Because actual attacks are taking place and because new vulnerabilities to attacks are continually being discovered, the US Government has launched a branch of the Department of Homeland Security to provide information in this area.  This organization is known as the Industrial Control System Computer Emergency Response Team (ICS-CERT) and it publishes alerts, advisories and regular reports on the latest products which have been found to have cyber or physical vulnerabilities.  The ICS-CERT website contains a searchable database for present and historical reports written on IIoT power, cooling and control systems.

So what does this mean for securing your rack systems?  The New York Cybersecurity Law says the following:

you must secure all IT and IIoT support systems from each of the following threats:

  • Confidentiality – protecting the cyber and physical security of all data. This includes both data that is at rest and data that is in transit
  • Integrity – protecting the intended state of the data from being compromised by cyber or physical means or altered in any way
  • Availabilityensuring uninterrupted operations of all systems that support the continuous access to data for all hours and times in which it is needed on a continuous basis

This means that you Must secure all communications to and from each of the following rack IIoT systems:

  • Rack Power Distribution Units (PDUs)
  • Rack Uninterruptible Power Supplies (UPS)
  • Rack Cooling Systems 

It is clear from the attacks that have already taken place through these types of systems that they must be protected with a firewall that is specifically suited to protect the confidentiality of their communications and the integrity of the systems themselves.  It is also clear that these power and cooling systems must be monitored to protect their availability to ensure the uptime of all IT systems.

RackGuardian stands alone in the market as the only product to include the ability to protect and monitor any type of rack IIoT system.  This insures the security and availability of the IT systems that these IIoT systems support.  RackGuardian is simple to install and use and affordable for all budgets.  Please feel free to call one of our experts to see how RackGuardian can protect your rack systems, whether you have one rack or hundreds.

Until Next Week,

Be Well!

 

 

Server & Telecom Racks and New York Cybersecurity Law

Greetings and welcome back!  Beginning this week, we are going to dovetail our discussions of the Federal Gramm Leach Bliley Act (GLBA) for financial services companies together with the New York Cybersecurity Regulations for Financial Services Companies.  Because New York is the home to many of the country’s financial services companies, it seems natural to address both the Federal Standards of GLBA with the State Standards for financial companies in one logical set of blogs.  So today, we begin this series by looking at Server & Telecom Racks and New York Cybersecurity Law.

The timing of beginning our discussion is centered around the enforcement of the New York Regulations, which began last week on August 27th.  The NY Cybersecurity regs are an extremely comprehensive set of requirements that cover all in-state and international operations for a financial entity of over $5 million in revenue.  While not having the power to regulate operations in other states, the Department of Financial Services (DFS) in New York makes it clear that any branch office in another state that impacts the operations of a New York office will be dealt with accordingly.  This is a polite way of saying that if security is truly needed in New York then it only makes sense to follow the same procedures for all locations, regardless of location.

To begin with, let’s talk about what the NY Regulations cover.  Specifically, the regulations require securing 6 different types of systems from affecting information stored by a covered entity in 3 different ways.  The 6 types of systems that must be protected are as follows:

500.01 (e) Information System means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic information, as well as any specialized system such as industrial/process controls systems, telephone switching and private branch exchange systems, and environmental control systems.

The 3 types of coverage for the information that these systems support are as follows:

500.02 (a) Cybersecurity Program. Each Covered Entity shall maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the Covered Entity’s Information Systems.

When we combine these regulations, we see that  the integrity and availability of IT and Telecom systems must be protected by actively securing and monitoring backup power, cooling and physical security systems.  Any interruption in power or cooling to an IT or Telecom system can corrupt or destroy the data that is to be protected.  This means that the following systems must be protected in order to be in compliance with the law:

  • Uninterruptible Power Supply (UPS) and Power Distribution Units (PDU)
  • Cooling Systems for the Data, Network or Telecom Racks
  • Physical Access Systems

These regulations make it clear that your racks of servers and telecom systems together with their UPS, PDU, Cooling and Physical Access systems must be secured and monitored.  While protecting these types of systems in a large data center can be done in a more centralized fashion, the ability to protect distributed racks and support systems is a much more difficult task. These racks are found in places like:

  • Network Rooms and Closets including all IDF and MDF Rooms
  • Telecom Rooms and Closets including PBX and Telecom Switch Rooms
  • Small Server Rooms

Virtually all the systems in these server, network, telecom, power and cooling systems found in these rooms are rack-mounted systems.   Because of this, the security regulations require a rack-based system that is able to both secure and monitor all of these systems.  We designed RackGuardian do be a fully-enabled Smart Firewall unit that both provides integrated firewall security and analytic monitoring for any server, telecom system, UPS, PDU and cooling unit.

In coming blogs, we will discuss the specific ways in which UPS and PDU units have already been used to attack information systems.  We will also address attacks on telephone switching and PBX systems and how they have had disastrous effects on their owners.  In addition, we will take a look at how the GLBA regulations integrate with the New York State regulations and how complementary they are to one another.

If you would like to have a confidential discussion on protecting your server and telecom racks from cyber, physical and operational attacks, we would be happy to work with you to provide the protection and compliance you need for your company.

Until Next Time,

Be Well!

 

Gramm Leach Bliley Requirements for Data Rack Security

Greetings and welcome back!  In this week’s blog we look at the Gramm Leach Bliley Requirements for Data Rack Security.  The Gramm Leach Bliley Act (GLBA) covers security requirements for all organizations that handle confidential information related to loans.  This Act is broad-based and covers everything from data about student loans, auto loans and home mortgages.  In short, just about everyone from college age and above has at least one set of data stored somewhere that is covered by GLBA.

Who are the companies that are specifically covered by GLBA?  These include the following:

  • Insurance companies, brokers and their agents
  • Colleges and universities, student loan providers and brokers
  • Mortgage providers, brokers and title insurance companies
  • Stock brokers, financial advisors and banks

Because GLBA covers such a large group of organizations, many may not be fully aware of the specifics of the GLBA requirements as they relate to the protection of data security.  The protections required by GLBA include:

  • Physical Security of the room and data rack(s) in which data is stored
  • Cybersecurity for all networked devices (regardless of type) that are on the data network
  • Operational Security for all servers and supporting power and environmental systems

Under GLBA Safeguard Rule, all specific security requirements for financial organizations are listed under the Federal Financial Institutions Examination Counsel’s (FFIEC) IT Examination Handbook.  This is literally “The Book” that an examiner uses to judge whether financial records are being kept in accordance with the GLBA.  This book is fully online and can be seen in full here.  Over the next few weeks we will be looking at the specifics in what we will simply refer to as the Handbook.   As we will see, it provides very specific requirements and leaves little to the imagination in the 3 areas of security listed above.

Because the Handbook for GLBA requirements is so specific, courts do not look kindly on the excuse of “I didn’t know about that requirement”.  Its a classic case where the judge says: “Ignorance of the Law is NO Excuse.”  Just as the HIPAA regulations are now very clear and penalties are very harsh, so too, penalties under GLBA are quite severe.  Here is a summary of the penalties for a violation of GLBA:

  • The organization can be for fined for up to $100,000 for each violation. 
  • Officers and directors of the financial institution can be fined up to $10,000 for each violation.
  • Criminal penalties include Imprisonment for up to 5 years IN ADDITION to the fine.
  • Fines and penalties can be DOUBLED if shown that another law has also been violated in the process.

In sum, the Gramm Leach Bliley Act was put in place to protect the private financial information for individuals.  Significant fines have been levied because of data breaches and other actions are likely.  In addition, the government is studying further requirements to GLBA that would require organizations to put in place a written plan to protect customer data and a written plan to respond in case of a data breach.

We want our readers to know that GLBA means business and we at AlphaGuardian mean business as well.  We are the only company that provides full physical, cyber and operational security solutions for GLBA.  The unique blend of both financial and IT backgrounds of the principals of the company allow us to address your needs as no other company can do.  Think about this and, if you would like a confidential discussion on how you can better protect the data that has been entrusted to you, please feel free to give us a call.

Until Next Time,

Be Well!