Cyber and Physical Security for Rural Telecom Sites

Greetings and welcome back.  This week we begin a study of the Cyber and Physical Security for Rural Telecom Sites. If you are a provider of telecom and broadband services to rural areas, you know that cybersecurity and physical security are large and growing concerns.  The huge geographic areas that your network covers and the relatively few personnel to cover them makes for serious security challenges and we will address the cyber and physical challenges of these sites during this blog series.

To begin with, there are roughly 1000 companies in the United States who are classified as rural telecom providers.  Having spent a good deal of my life in rural country, I have an appreciation for the companies who serve these large areas of our country and understand that the growing threats of cybersecurity and continuing threats to physical security are likely to increase over time.  In fact, several cyberattacks on rural municipalities and utilities show that rural operations are increasingly becoming cyber targets.  When you add to that the damage from physical attacks – such as this highly destructive cable cutting in rural Northern California – its clear that bad guys are targeting rural utilities and that these are not isolated instances.

In this first part of the blog series, we’re going to look at cybersecurity backdoors in your remote plant and equipment as well as in your head-end sites.    If we want to address this subject in a practical way, we must first ask: “What network ports within my sites could be used by a hacker as a back door?”

Security for Rural Telecom

We have done a thorough scan of rural telecom and broadband sites throughout the U.S. to find out the correct answer to this question.  While we will not release the total number of ports involved for security reasons, we can say that open ports with minimal security on rural utility networks total in the hundreds of thousands. The avenues most commonly used in attacks by the bad guys are remote management ports which see little traffic but, which are most often left open for the convenience of the user.  The ports which we found to be open in large numbers in rural telecom sites are:

  • Port 21 – FTP – File Transfer Protocol: an unencrypted protocol used for downloading firmware and other updates
  • Port 22 – SSH – Secure Shell: a well-secured means for remote login and command-line system changes
  • Port 23 – Telnet – an unencrypted protocol used for remote login and command-line system changes
  • Port 69 – TFTP – Trivial File Transfer Protocol: an unencrypted and non-passworded protocol for updates
  • Port 80 – HTTP – Hyper Text Transfer Protocol: an unencrypted protocol used for web-page access and system changes
  • Port 161 – SNMP – Simple Network Management Protocol: a modestly encrypted protocol used for remote management
  • Port 443 – HTTPS – the encrypted version of HTTP that allows for the encrypted transmission of web-page access
  • Port 502 – Modbus – an unencrypted protocol designed for remote management of power and cooling systems
  • Port 47808 – BACnet – a lightly encrypted protocol designed for mechanical and electrical systems

Looking at this list, the first thing that comes to mind is: That’s a LOT of open ports and a LOT of options for hackers to target!  Granted, each device typically only has 2-4 ports open but, as the thief says: “I only need one…”

In studying open ports that can be seen directly on the Internet through the Shodan Search Engine, the most numerous systems on your network are NOT computers but, rather:

  • Routers
  • Network Switches
  • Power Distribution Units
  • Backup Power Systems
  • Telecom Systems

Because open ports on these systems have minimal security, they are not a challenge for even a hacker of modest skill to gain access.  Once a cybercriminal accesses one of these ports, they can then take control of that system and can then begin to hop from one system to the next until a value-rich-target system is penetrated.  When they arrive at their high-value target destination, they can then:

  • Harm, shutdown or destroy one or more of your systems directly
  • Place Malware into your systems that can constantly scan and steal interesting data over long periods of time
  • Place Ransomware on your system to force you to pay Ransom of his choosing and in his timing
  • Steal data immediately from a data source such as a server or desktop computer and then cover their steps

OK – that’s a lot of information to absorb for now so, at this point, its time to summarize this first blog about rural telecom security.  The first point is that your remote and local sites have many types of systems, each which likely has at least one open port with little or no security.   These systems are, therefore, easily penetrated by a cybercriminal and can be used to harm your systems and to steal data from your our customers.

The question to be asked is: “What can be done to stop this?”  Our RackGaurdian and CyberGuardian products are unique in this field because they block the cybercriminals from even be able to see your systems while, at the same time, allowing you to securely manage your systems from any location.  They create a stealth-shield around your systems making them invisible on a network but, provide you with a secure, encrypted channel of communications with those units.  All of this power is tied-together with our secure cloud-based system, meaning that there is no limit to the number of devices that you can protect and manage.

Please think about these things and, if you would like to have a confidential discussion about your security needs, please feel free to give us a call.  We’re here to help and we understand the needs of rural utility providers.

Until Next Time,

Be Well!

 

 

Secure, Unified Monitoring for All Your Network Closets

Many organizations have dozens, even hundreds of network closets, server labs and other small IT and Telecom rooms in their facility or campus.  All-too-often, these rooms have been monitored by multiple applications with a Network Management System (NMS) monitoring the SNMP devices, a Building Management System (BMS) monitoring the environmental and power conditions and a Security Management System (SMS) monitoring the entrance to these rooms.  RackGuardian is the first product built to provide Secure, Unified Monitoring for All Your Network Closets.  For the first time, you can monitor all your SNMP, Environmental, Power and Security Systems on a single, secure, cloud-based platform.

RackGuardian is a secure, cloud-based management appliance which you place in each of your network rooms.  It has a secure port from which to gather information from any SNMP, Modbus or other network device.  It also contains 4 environmental monitoring ports which can connect to temperature, humidity, water leak detection, fire alarm or other sensors. In addition, it also includes two Wiegand access control ports which can interface with most any card-access or biometric access system.  This gives you total scope monitoring capabilities for each room in which you place a RackGuardian.

As RackGuardian gathers data, it continuously monitors this data with self-learning analytics.  This allows the system to eliminate nuisance alarms from traditional high-low alarm set points by using its patent-pending alarm analytics.  The self-learning analytics literally learn the normal operating parameters of each device and each data-point within each device.  By doing this, you know that,  when the RackGuardian system does send you an alarm, a statistically significant event is near.

RackGuardian pushes all its statistical data to the AlphaGuardian secure cloud server once per minute – unless an alarm is spotted, in which case it pushes this data immediately to the cloud for alarm notification.  All data pushed to the cloud is done by secure 2048 bit encryption – Military grade protection.  In addition, the data is pushed because the RackGuardian acts as a data diode, one-way communication device.  It pushes data to the cloud securely but it will NOT allow any device to connect to itself or to any of the devices that it is protecting.  In fact, once a device is connected to the RackGuardian, it becomes stealth to your network.  No one can see the device or even knows that it exists.

Having a secure, cloud system that unifies all of your devices is a strategic advantage.  When you use different systems to monitor the same rooms, you have a potential for confusion and even disaster.  RackGuardian has a heirarchical, stratified access system that allows multiple departments and multiple levels within those departments to see only the items under their control.  In this way, the facilities department can securely see the environmental and power conditions, the network manager can see their servers, switches and other SNMP devices and the security officer can see when and by whom each room is accessed.

By eliminating multiple systems with a single, unified system, RackGuardian saves money both in the short and long term.  By offering all data in a secure, cloud-based platform, you have the ability to scale from a small number of rooms in one site to thousands of sites on a national or even global scale.  RackGuardian’s power can be seen in the diagram below which slows its security, simplicity and power.

a Secured, Unified Platform for Monitoring Your Network Closets

 

Until Next Time,

 

Be Well!

 

Network Closet Security Vulnerabilities – Physical Security

Greetings and welcome back.  In this blog, we take a close look at Network Closet Security Vulnerabilities – Physical Security.  This is the first in a new series on the key types of network closet security flaws.  This is a key topic, especially for all those of you who are covered under HIPAA, PCI-DSS, FERPA, Gramm Leach Bliley and other data security regulations.  The fact is, as more data shifts to the cloud, that means that more data is transported through your network closets to the various cloud providers that you employ.  Because cloud services tend to be well-fortressed, cyber criminals are turning to the easiest way to get to that data – your network closets.

To begin with, all of the key data security regulations require you to physically secure your data.  Here are some key provisions with which we should all take time to familiarize ourselves:

HIPAA Section 164.310: “Facility Access Controls. Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.”

PCI-DSS Requirement 9.1: Verify the existence of physical security controls for each computer room, data center, and other physical areas with systems in the cardholder data environment. Without physical access controls, such as badge systems and door controls, unauthorized persons could potentially gain access to the facility to steal, disable, disrupt, or destroy critical systems and cardholder data. 

GRAMM LEACH BLILEY: “Management should deploy adequate physical security in a layered or zoned approach at every IT operations center commensurate with the value, confidentiality, and criticality of the data stored or accessible and the identified risks.”

Its clear from these sections of security codes that you need to provide a secure card-based access system in order to be compliant with major data security regulations.  What isn’t clear is which physical security system is the best for your application.  Fortunately, our RackGuardian system is one of the only systems that supports virtually any access card on the market.  That means that, if you are already using a card access system for your main door at your facility, chances are very good that RackGuardian can support that card on a plug-and-play basis.  If, on the other hand, you need a new access card system, then we also have you covered.

In the next 2 blogs, we plan to look at cybersecurity and also backup power and environmental security for your data.  Please take a good look at RackGuardian and we believe that you will find that its the most powerful security product for data security on the market.  We welcome you to contact us with any questions about your individual security needs.

Until next time,

Be Well!

New York Cybersecurity Law & Your Rack Systems

Greetings and welcome back!  This week we continue our series on the effect of the New York Cybersecurity Law for Financial Services Companies on the need to protect Information Technology (IT) systems as well as Industrial Internet of Things (IIoT) systems.  Specifically, we look at the New York Cybersecurity Law & Your Rack Systems.

New York State authorities took significant input from experts in IT security and IIoT security in formulating this Law.  As we discussed last week the key thing to remember about this law is the following:

Under the New York Cybersecurity Law, “Information Systems” are defined to include all IT systems as well as all IIoT power, cooling and security systems that support them.

Many notable examples of cyberattacks have already taken place through IIoT power and environmental control systems including:

  • Ukrainian Power Plant Cyberattack – an Uninterruptible Power Supply (UPS) system used in combination with switchgear caused a massive blackout throughout much of the Ukraine.
  • Staminus Cloud System Cyberattack – a rack-mounted Power Distribution Unit (PDU) used to enter the cloud-based servers in a rack, stealing millions of dollars-worth of data records.
  • SCADA/BMS Cyberattacks – case studies of 5 attacks on industrial systems and the results on the affected businesses

The ease with which UPS, PDU and Environmental Control Systems is well documented by the related links. In addition, a thorough review of attack vectors against UPS, PDU and Air Conditioning Systems was well documented fully 5 years ago in a White Paper written by Dr. Patrick Traynor of the Georgia Institute of Technology.  In this paper, the vulnerability of the SNMPv3 communication protocol is thoroughly discussed.  SNMPv3 is the latest version of SNMP and was largely believed by users to be secure.

Other possible attack sequences on various types of IIoT systems have also been proven to be possible.  A number of government and university studies that have documented vulnerabilities to such attack sequences as shown below:

Because actual attacks are taking place and because new vulnerabilities to attacks are continually being discovered, the US Government has launched a branch of the Department of Homeland Security to provide information in this area.  This organization is known as the Industrial Control System Computer Emergency Response Team (ICS-CERT) and it publishes alerts, advisories and regular reports on the latest products which have been found to have cyber or physical vulnerabilities.  The ICS-CERT website contains a searchable database for present and historical reports written on IIoT power, cooling and control systems.

So what does this mean for securing your rack systems?  The New York Cybersecurity Law says the following:

you must secure all IT and IIoT support systems from each of the following threats:

  • Confidentiality – protecting the cyber and physical security of all data. This includes both data that is at rest and data that is in transit
  • Integrity – protecting the intended state of the data from being compromised by cyber or physical means or altered in any way
  • Availabilityensuring uninterrupted operations of all systems that support the continuous access to data for all hours and times in which it is needed on a continuous basis

This means that you Must secure all communications to and from each of the following rack IIoT systems:

  • Rack Power Distribution Units (PDUs)
  • Rack Uninterruptible Power Supplies (UPS)
  • Rack Cooling Systems 

It is clear from the attacks that have already taken place through these types of systems that they must be protected with a firewall that is specifically suited to protect the confidentiality of their communications and the integrity of the systems themselves.  It is also clear that these power and cooling systems must be monitored to protect their availability to ensure the uptime of all IT systems.

RackGuardian stands alone in the market as the only product to include the ability to protect and monitor any type of rack IIoT system.  This insures the security and availability of the IT systems that these IIoT systems support.  RackGuardian is simple to install and use and affordable for all budgets.  Please feel free to call one of our experts to see how RackGuardian can protect your rack systems, whether you have one rack or hundreds.

Until Next Week,

Be Well!

 

 

Server & Telecom Racks and New York Cybersecurity Law

Greetings and welcome back!  Beginning this week, we are going to dovetail our discussions of the Federal Gramm Leach Bliley Act (GLBA) for financial services companies together with the New York Cybersecurity Regulations for Financial Services Companies.  Because New York is the home to many of the country’s financial services companies, it seems natural to address both the Federal Standards of GLBA with the State Standards for financial companies in one logical set of blogs.  So today, we begin this series by looking at Server & Telecom Racks and New York Cybersecurity Law.

The timing of beginning our discussion is centered around the enforcement of the New York Regulations, which began last week on August 27th.  The NY Cybersecurity regs are an extremely comprehensive set of requirements that cover all in-state and international operations for a financial entity of over $5 million in revenue.  While not having the power to regulate operations in other states, the Department of Financial Services (DFS) in New York makes it clear that any branch office in another state that impacts the operations of a New York office will be dealt with accordingly.  This is a polite way of saying that if security is truly needed in New York then it only makes sense to follow the same procedures for all locations, regardless of location.

To begin with, let’s talk about what the NY Regulations cover.  Specifically, the regulations require securing 6 different types of systems from affecting information stored by a covered entity in 3 different ways.  The 6 types of systems that must be protected are as follows:

500.01 (e) Information System means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic information, as well as any specialized system such as industrial/process controls systems, telephone switching and private branch exchange systems, and environmental control systems.

The 3 types of coverage for the information that these systems support are as follows:

500.02 (a) Cybersecurity Program. Each Covered Entity shall maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the Covered Entity’s Information Systems.

When we combine these regulations, we see that  the integrity and availability of IT and Telecom systems must be protected by actively securing and monitoring backup power, cooling and physical security systems.  Any interruption in power or cooling to an IT or Telecom system can corrupt or destroy the data that is to be protected.  This means that the following systems must be protected in order to be in compliance with the law:

  • Uninterruptible Power Supply (UPS) and Power Distribution Units (PDU)
  • Cooling Systems for the Data, Network or Telecom Racks
  • Physical Access Systems

These regulations make it clear that your racks of servers and telecom systems together with their UPS, PDU, Cooling and Physical Access systems must be secured and monitored.  While protecting these types of systems in a large data center can be done in a more centralized fashion, the ability to protect distributed racks and support systems is a much more difficult task. These racks are found in places like:

  • Network Rooms and Closets including all IDF and MDF Rooms
  • Telecom Rooms and Closets including PBX and Telecom Switch Rooms
  • Small Server Rooms

Virtually all the systems in these server, network, telecom, power and cooling systems found in these rooms are rack-mounted systems.   Because of this, the security regulations require a rack-based system that is able to both secure and monitor all of these systems.  We designed RackGuardian do be a fully-enabled Smart Firewall unit that both provides integrated firewall security and analytic monitoring for any server, telecom system, UPS, PDU and cooling unit.

In coming blogs, we will discuss the specific ways in which UPS and PDU units have already been used to attack information systems.  We will also address attacks on telephone switching and PBX systems and how they have had disastrous effects on their owners.  In addition, we will take a look at how the GLBA regulations integrate with the New York State regulations and how complementary they are to one another.

If you would like to have a confidential discussion on protecting your server and telecom racks from cyber, physical and operational attacks, we would be happy to work with you to provide the protection and compliance you need for your company.

Until Next Time,

Be Well!

 

PCI-DSS Requirements for Backup Power Security

Greetings and welcome back!  In today’s blog we are going to look at a critical segment of PCI-DSS security that is often overlooked: PCI-DSS Requirements for Backup Power Security.  To begin with, PCI PIN Security Requirements and Testing Procedures require the use of an Uninterruptible Power Supply (UPS) as given in the following section:

32-5 All access-control and monitoring systems (including intrusion-detection systems) are powered through an uninterruptible power source (UPS).

This makes good sense because, in the event of a power failure, if security access control and monitoring systems are offline, someone could easily force their way into a network closet and your data rack and simply pick up the server and walk out with it.  Needless to say, you must have enough power to ride-through a significant power outage but, how much backup power is enough?  PCI-DSS standards do not say but, it is interesting to note that the FCC now requires telecom providers to supply 8 hours of backup power to any IP-based telephone system or line.  While that may seem like a long time, consider this: the loss of power for a utility customer in the US can average nearly 5 hours in length as this annual report from the US Energy Information Agency shows.

PCI-DSS Requirements for Backup Power Security

Let’s take a look at the detail of this chart.  The total time of an outage is broken down into “non major events” and “major events”.  Non major events tend to be local outages caused by such things as a blown transformer within a utility system.  Major events are normally related to weather such as significant thunderstorms.  As the graph shows, major events are always longer, on average, than are non-major events within a utility’s own system.  But, even the best performance for outages – from municipally owned utilities – shows a nearly one hour power outage for a system-caused problem and the municipal utility average for a major event was 2 hours.

The long and short of this is that, if you fall under PCI-DSS, you need to backup the security systems protecting your server’s data for a minimum of 2 hours.  If you are within an investor-owned utility’s service area, the average outage with a major event is 3.5 hours and with a co-op, its nearly 5 hours.  So, if you fail to provide the proper backup and someone simply walks in and steals your server, you would be liable under the “reasonable man” concept of law from any credit card lawsuits that result from this type of data loss.

In addition to purchasing a UPS with sufficient battery backup time, you also need to monitor that UPS and its battery time.  Why do you need to do this?  The answer is that batteries, whether in your car or in a UPS, degrade over time.  With each passing year they provide less and less ability to generate the power that you need.  In addition, batteries degrade with each cycle in which they are used.  So, if your site is located in an area where there are lots of power flickers, those sub-second flickers actually cause the UPS to go onto battery and will also affect the backup battery life.

Fortunately, most UPS system provide a serial or network port that allows you to monitor the battery conditions and ensure that you will have the necessary battery backup time if it is needed.  Our RackGuardian product was designed with securing a rack and protecting its power systems from physical, operational or cyber problems.  RackGuardian integrates with any type of card-key or biometric door locking system, allowing you to be fully compliant with PCI-DSS physical security requirements.  In addition, RackGuardian plugs into the network or serial port of your UPS as well as your Rack Power Distribution Unit (PDU) to secure these systems from a cyber or physical attack and to monitor their system integrity.  RackGuardian’s exclusive and patented power analytics will provide you with an early warning to any problem with your battery system, ensuring that you have the battery backup time available when you need it.

Think about these things a bit and, we would be more than happy to have a confidential discussion about protecting your data and your backup power systems.  In fact, our experts can actually help you choose the best power system for you from the numerous sources available to us.  So, until next time,

 

Be Well!

PCI-DSS Breaches and Data Rack Security

Greetings and welcome back!  In this week’s blog, we begin a new series on PCI-DSS Breaches and Data Rack Security.  Every retailer must keep their systems secure and PCI-DSS standards require strict control on the cyber, physical and operation security of data racks.  But as we shall see in today’s blog, there is a huge gap in what individual retailers believe suffices for PCI-DSS compliance and in actual compliance with these standards.

To begin with, there are 12 individual security requirement categories in PCI and each must be followed carefully to be in compliance.  If a user is in compliance will all 12, statistics show that they will be much less likely to have a breach.  In addition, if a breach does occur, the liability to the user is substantially less if all 12 requirements had been followed carefully.  Unfortunately, many organizations believe that they are complying with these 12 standards when in fact, they are not.

A great example of this comes from the most recent Verizon PCI Compliance Report.  In this report, all users were asked if they were in compliance with all 12 categories of PCI compliance.   Then, users who suffered a breach were asked to provide a post-breach assessment of their actual compliance levels.  It is an eye-opening report to say the least and one thing that jumped out to me was the overall compliance levels in Requirement 12 – Maintaining an Information Security Policy Standard.  As you can see from the chart below, while 65% of overall users had a 3rd party compliance certification for Requirement 12, only 10% of users that were breached were actually compliant in this area.  In other words, those who are relying on a mere certificate are taking enormous risks with their data.

PCI-DSS Data Rack Security Requirements

Let’s look at a couple of areas in Requirement 12 that have lead to some serious data breaches in the past few years.

“Malicious individuals may breach physical security and place their own devices on the network as a ‘back door.’ Personnel may also bypass procedures and install devices.”

It is all-too-common to have a data rack that is not physically secured and where any individual with the will to do so can open the rack door and place a device that can be used as a back-door into a credit card data server.  This type of attack is sometimes known as a Man-In-The-Middle (MitM) attack.  One way that this is done is for a user to place a router that is different from the existing Internet router as described in this excellent research article by Towson University’s computer science department.  By this simple procedure, anyone with even modest hacking skills can create a back door into a retailer’s credit card data servers and can essentially steal data at will.

Another item pointed out in the text of Requirement 12 is that data thieves can create back doors by using existing devices that provide remote access to systems within a data rack.  One way that this is being done is to use the networked Uninterruptible Power Supply (UPS) or Power Distribution Unit (PDU) to create a back door to the credit card server’s data.  Again, the text in Requirement 12 specifically addresses this issue as follows:

Remote-access technologies are frequent “back doors” to critical resources and cardholder data. By disconnecting remote-access technologies

This type of attack has been successfully carried out already in a recent attack that caused millions of dollars in losses as can be seen here.  Because PCI-DSS standards require the use of UPS systems to protect system data, all users should have a UPS and should have a remote monitoring package for their backup power to ensure that their backup systems are working.  However, any remote monitoring system for the UPS MUST be implemented in a way in which no one would have the ability to connect to the UPS without authorization.

Our RackGuardian system is a perfect answer to solving both the Physical Access Security issues that can be used to create a man in the middle attack and in protecting and securely monitoring your Uninterruptible Power Supply.  Please think about these things and, feel free to give us a call to have a confidential discussion about how we can help you become PCI compliant and greatly reduce your chances of having your credit card data stolen.

Until Next Time,

Be Well!

 

 

 

HIPAA Breaches and Data Rack Security

Greetings and welcome back!  This week, we begin a look at HIPAA Cyber/Physical/Operational security, specifically addressing the HIPAA Breaches and Data Rack Security.  This last week, the Federal Government’s Health Care Industry Cybersecurity Task Force released a stinging report on the continuing rise in HIPAA breaches and the failure of cyber/physical/operational security solutions being employed.  Over the next few weeks, we hope to address some key points of data protection that are largely ignored by the large companies servicing the HIPAA marketplace.  We will begin this week with an overview of the 3 key aspects of HIPAA security:

  • Cybersecurity
  • Physical Access Security
  • Operational Security

The cyber security, physical security and operational security of your electronic Protected Health Information (ePHI) is all covered by HIPAA and the HITECH Act – where the penalties for HIPAA and there violations receive their teeth.  And as the following graph shows, the actual data breaches reported during 2016 by Health and Human Services reflected a broad variety of indigents from each of these three areas.   As you look at this graph – several things may strike you as surprising:

  1. Unauthorized Physical Access (this means by a person who has been given access to the physical data) and Physical Theft comprise more than 1/3rd of all HIPAA violations.
  2. Unauthorized Cyber Access (again, meaning network access by someone who has been given access to the data) is nearly 1/5th of all HIPAA violations.
  3. Operational Incidents – where data is destroyed or lost accounts for a significant amount of HIPAA violations

HIPAA Regulations for Your Data Rack

 

Thinking about these facts for a minute, let’s now dive one step deeper to seeing exactly where these data breaches have come from. research from Protenus shows, insiders actually accounted for more than 40% of all data breaches!  These are the unauthorized cyber and physical access and part of the physical theft and operation incidents.

Let’s digest all of this information for a minute.  We know from the new government report that HIPAA breaches despite companies spending more money on cybersecurity.  What we have learned from the actual breaches reported last year is the following:

  • 43% of all HIPAA Breaches were Physical or Operational Incidents
  • Most all of these Physical and Operational Breaches were related to Insiders

These facts make it very clear that looking purely at cybersecurity firewalls to protect your organization against data breaches is literally only covering about half of the problem.  The data in your system is largely located at rest and in transit through your data rack in your network room and anyone who can gain access to that rack can steal data at will.  This is exactly the reason that we built RackGuardian – to protect from ALL threats – cyber as well as Physical and Operational.  We encourage the reader to look deeply at the full-spectrum of security protection offered by RackGuardian and we are always more than happy to confidentially chat with you about your own security needs.

Until next time,

Be Well!

Server and Telecom Rack Physical Security Compliance

This week, we continue our series on: The 3 Functions of Rack Security Compliance. As a quick reminder, these 3 functions are the following:

  1. Cybersecurity
  2. Physical Network Security
  3. Operational Security

This week, we focus on the second function of data center security compliance, namely: Physical Network Security. Physical Network Security systems in most data centers are comprised of 3 layers:

  1. Perimeter access security
  2. Rack physical access security

Its important to understand that most physical access security systems use standard protocols to make communication easy. Just like SNMP is the most common protocol used for network management communications, the Wiegand protocol is the most common protocol used for security management communications. Since few have heard of Wiegand, the first question is: what is the Wiegand protocol? The answer is that it is actually a group of standards all under one collective heading. It includes a method of communication between the card or fob reader and the controller unit as well as methods for storing data on both the card or fob and the controller. We are focusing on the communication aspect of the system as that is where much of the vulnerability lies.

Much of what I am sharing today comes from several well documented research projects that target Wiegand-based access systems. Brad Antoneiwicz from the Open Security Research group at Foundstone Security, a part of Intel Security has done excellent research in this area. You may want to link to his blog post about Wiegand vulnerabilities here and you may see an excellent presentation that he did gave that is posted online here. Brad shows in his blog and his presentation that it is easy to establish a man-in-the-middle attack on an card access system. That’s because the process is very easy execute in a small time frame and with limited tools and resources. Just as SNMP is vulnerable to virtual man-in-the-middle (MitM) attacks on network systems, so too card access systems can be attacked by a physical MitM gain entry to data centers and data racks.

With a simple Arduino board and some good logic, Antoneisicz shows us that you can easily gain access to any Wiegand-based card access system. The protocol is trivial to duplicate and you can use something as simple as a battery-powered Arduino to hijack a card access system and gain entrance into a data rack and its valuable data. It turns out that, while some parts of card access systems do offer some level of encryption (for example, the server usually offers https for remote management security) the serial communications from the card reader to the card controller is almost always open to intercept. This allows you to read, communicate and ultimately, hijack the card reader to gain full access to that facility or rack.

For those of you who really want to take a deep dive on the subject of access card reader hacking – including hacking the actual RFID signal from the access card – here is a truly detailed report from Bishop Fox Security.  This presentation was very well received at the DefCon hackers convention in the summer of 2015 and it considered the definitive published work of all the easiest means to hack access security cards.  Everyone who uses a security access card system should familiarize themselves with this report.

So what is the bottom line here? It is that access cards are easily hacked.  The serial communications on a card access system are NOT supervised or encrypted but, are allowed to pass freely in open protocol format from point to point.  Similarly, the RFID signal on an access card floats freely and anyone can grab that signal and use it to create a duplicate card or otherwise hack an access system.   Anyone who can gain access to the wire or wireless data from a card can gain access to whatever that card system is supposed to be protecting.

Fortunately, there is an answer to this huge security hole. Our RackGuardian has an plug-in product known at the EnviroScout which can inspect and supervise ALL communications from the Wiegand-based reader to the controller. If this device sees any signs of tampering, the RackGuardian will immediately send a message to our server and then to our IOS device within 2 seconds of detection.  The combination of instant notification to your mobile device coupled with our on-board analytics to catch any signs of tampering gives you the security that you need in your data center.

As a reader of this blog, you know that security compliance is serious business and its getting more pervasive all the time. We have shown through peer-reviewed research that existing card access systems fail to pass a simple third-party security test. Please consider discussing your physical security needs with one of our experts and lock-down your data center and data racks today.

Until next time,

Be Well!

Server and Telecom Rack Cybersecurity Compliance

Welcome back! We continue this month on the 3 keys for Server and Telecom Rack Security Compliance.  This month’s blog is: Server and Telecom Rack Cyberecurity Compliance. To begin with, whether you remotely host your servers offsite or you have your own data center(s), you need to have the ability to remotely manage the systems in your racks. These systems include the following groups of items:

Processing and Storage
Networking Systems
Power, Environment and Security

All of these systems need to be managed remotely at some point. Each of these systems is typically managed by SNMP from a central console system. Sadly, as this peer-reviewed paper demonstrates, even the supposedly secure SNMPv3 is full of vulnerabilities. That is, both can be taken-over by unauthorized individuals or groups and the results are devastating. As this peer-reviewed paper from Georgia Tech shows, its amazingly east to hack SNMPv3 because of flaws that are inherent in the protocol.  The bottom line is that, while you need to remotely manage your systems to keep them working, the very process of remote management can expose your data to cyber criminals. The question then becomes: What can SNMP exploits do to my data?  The answer can be seen in the chart below:

Server and Telecom Rack Security Compliance

As you can see, it is mainly the power environmental and security systems that are at risk.  Processing/Storage and Networking systems are typically open to ports 80 and 443 and are normally guarded by the perimeter firewall and often by a locally resident firewall.  However, Power Environment and Security systems are normally not protected or, if they are protected, such protection often fails to inspect the SNMP packets being sent to and from these systems. The simple fact is, as Table 1 from the Georgia Tech paper demonstrates, its easy to enter SNMP-enabled systems and change settings in ways that can destroy data stored in the servers and storage systems to which these systems are attached. As the Table also shows, its possible to launch Denial of Service (DoS) attacks through several of these systems, effectively shutting down that network segment and access to its data.

 

Your Data Racks, you need to protect your rack infrastructure. AlphaGuardian’s RackGuardian system is the only system on the market that is uniquely focused on protecting your data by protecting the security of your rack infrastructure. Power systems such as Rack PDU’s and UPS’s, cooling systems such as In-Rack Cooling, and security systems rely on SNMP. Our RackGuardian unit attaches to these systems and locks out ANY attempt to communicate with them.  At the same time, it securely gathers all the information that you need about your power, environment and security via its secure private network port. All information is then sent via an encrypted, push communication to a certificate-based data server. The result is you get all the information that you need for remote rack management while keeping all of your systems – and your data – completely safe.

Please think about this for a bit and let us know how we can help you.

Until next time,

Be Well!