CrowdStrike 

Back in July, a global IT outage caused by a faulty update impacting Windows systems, from the cybersecurity firm CrowdStrike significantly affected multiple sectors in the UK, including data centres, the NHS, and the financial industry. It led to widespread disruptions and, although it was not a cyberattack, it does appear to be a motivating factor for the UK government’s announcement of a change classification of UK data centres.

Not Just Protection against Cyber Criminals 

Although the CrowdStrike effects may have been a major catalyst for the new classification of data centres, their classification as CNI should also help create provision to give them more protection from major environmental disasters and other IT blackouts.  This new classification is part of a wider movement to give them the special protection they merit. As highlighted in the government’s announcement, much of the data housed and processed in UK data centres, from photos taken on smartphones to patients’ NHS records and sensitive financial investment information, could be considered as “powering the economy”.

How does the New Classification Compare? 

The idea to now classify UK data centres as CNI will mean that in terms of added protection, they have been put on an equal footing to water, energy and emergency services systems. This means that they can, as the government says: “now expect greater government support in recovering from and anticipating critical incidents, giving the industry greater reassurance when setting up business in UK and helping generate economic growth for all.” 

Also, as Technology Secretary Peter Kyle says: “Bringing data-centres into the Critical National Infrastructure regime will allow better coordination and cooperation with the government against cyber criminals and unexpected events.” 

More specifically, the government says this “support” will mean:

• The setting up of a dedicated CNI data infrastructure team of senior government officials who will “monitor and anticipate potential threats, provide prioritised access to security agencies including the National Cyber Security Centre, and coordinate access to emergency services should an incident occur”. 
• The government intervening, for example in the event of an attack on a data centre hosting critical NHS patients’ data. In this event, with the new classification of data centres, the government says it will “ensure contingencies are in place to mitigate the risk of damage or to essential services, including on patients’ appointments or operations.” 
• The UK is already home to the highest number of data centres in western Europe. Giving CNI status to data centres in the UK could increase business confidence in investing in data centres in the UK, an industry which already generates an estimated £4.6 billion in revenues a year.

Deterrent? 

It appears that the government believes that the status will also deter cyber criminals from targeting data centres that may house vital health and financial data, minimising disruption to people’s lives, the NHS, and the economy. Presumably, this deterrent effect would come from increased penalties, greater cybersecurity investment, and enhanced monitoring and better threat detection efforts.

Just in Time 

With the UK government recently welcoming a proposed £3.75 billion investment in Europe’s largest data centre, DC01UK in Hertfordshire, and with this expected to create over 700 local jobs and support 13,740 data and tech jobs across the country, the new CNI status for data centres appears to have been given just in time.

The Cyber Security and Resilience Bill Too

As an additional measure, earlier this summer the government’s Department for Science, Innovation and Technology (DSIT) also announced it will be introducing the Cyber Security and Resilience Bill. It is thought that this will strengthen the country’s cyber defences by enhancing incident reporting requirements, helping safeguard vital sectors such as healthcare and finance, ensuring stronger protections against cyber threats like ransomware, and “mandating that providers of essential infrastructure protect their supply chains from attacks”. 

Support 

Support for the re-classifying of data centres as CNI has come from several key data centre industry players. For example, Bruce Owen, UK Managing Director of digital infrastructure provider Equinix, said: “We welcome today’s announcement by the government which recognises the critical nature of data centres and digital infrastructure to the economy and society.” 

What Does This Mean For Your Business? 

The reclassification of UK data centres as CNI is a strategic response to immediate threats, like the CrowdStrike outage, and a forward looking move to secure the country’s digital infrastructure. By placing data centres on par with essential services like energy and emergency systems, the government appears to be trying to recognise their pivotal role in supporting the digital economy and vital public services such as the NHS.

As CNI, data centres now gain access to increased government resources, including the support of the National Cyber Security Centre (NCSC), and a dedicated CNI data infrastructure team to monitor and anticipate threats. This could ensure quicker responses to vulnerabilities and a stronger defence against cyberattacks, particularly for centres hosting critical data, such as health and financial information. The new classification also aims to protect against broader risks, such as natural disasters or IT blackouts, which could severely impact businesses and public services alike, thereby trying to provide protection that takes account of any serious eventuality.

The government’s commitment to boosting this sector is clear, as evidenced by the approval of a £3.75 billion investment in Europe’s largest data centre project in Hertfordshire. The new status, could, therefore encourage further investments, reinforcing business confidence and supporting sustainable growth in the tech industry. The Cyber Security and Resilience Bill, expected to be introduced soon, may also further strengthen these protections by enforcing stricter incident reporting and ensuring supply chain security for essential services.

Support from industry leaders reflects the importance of securing the country’s digital infrastructure, as more businesses rely on data centres to manage sensitive information. This reclassification is not just a reactive measure, but many would argue it is a necessary step in ensuring the continuity of services that millions rely on daily.

By classifying data centres as CNI, the UK is laying the groundwork for a more secure and resilient digital future. With increased investment, enhanced government support, and forthcoming legislative measures, this decision may help position the UK as a leader in digital infrastructure protection, helping to safeguard its economy, public services, and reputation as a global hub for technological innovation.

The post Data Centres Now ‘Critical National Infrastructure’ appeared first on Quayside Technical Services.

The Move To SaaS and Cloud 

In the rapidly evolving digital landscape, one of the key drivers enabling attackers to compromise an organistaion without needing to touch the endpoint or conventional networked systems and services is the increased reliance on cloud based services and software as a service (SaaS) applications, to drive efficiency and innovation. This shift, while beneficial, has also created new cybersecurity challenges for businesses, primarily due to the decentralisation of ‘digital identities’ and the interconnected nature of cloud services.

The SaaS Revolution and Its Impact on Security 

The proliferation of SaaS applications is a direct result of the digital transformation that has reshaped the business world. For example, companies can now be using hundreds, if not thousands of cloud applications to perform daily operations, from customer relationship management to financial operations. This shift is driven by the convenience and scalability of SaaS solutions, however it comes with inherent security risks.

The new risk that businesses are facing is that each application potentially serves as an entry point for malicious actors, and the interconnectivity between these apps can allow a breach in one service to cascade through to others.

Why Digital Identities Are The New Security Battleground 

As the traditional network perimeter dissolves, digital identities become the new security frontier. Put simply, a digital identity can be a user account created for services that someone in the business has signed up for using a username or email and password. More broadly, it can also mean other personal data used to identify and authenticate users online.

These digital identities, which provide access to a myriad of cloud applications, are now central targets for attackers. Securing them has become increasingly complex due to the sheer number of them that businesses may be using and their dispersion across various cloud platforms, each with its own security environment. This decentralisation not only makes consistent security policies harder to enforce but also increases the complexity of monitoring these identities for potential breaches.

How Attackers Are Exploiting Vulnerabilities in Cloud Identities 

Attackers have adapted to this new environment by developing sophisticated techniques to exploit vulnerabilities in cloud identities without ever touching the physical endpoints or traditional networked systems.

Examples of techniques include AiTM (Adversary in The Middle) phishing, SAMLjacking, and Oktajacking, all of which exploit weaknesses in the authentication processes and session management of cloud services.

AiTM phishing involves intercepting and manipulating real time data during a session to steal credentials or manipulate transactions. SAMLjacking and Oktajacking focus on manipulating Single Sign On (SSO) processes to gain unauthorised access.

Security stats now reveal increasingly that attackers are deliberately targeting cloud services as a way into organisations. For example, malware used to be one of the main threats, but CrowdStrike figures show that three out of four attacks last year were malware free, and that the targeting of cloud services has increased 110 per cent. This helps to illustrate why cloud identities are the new digital perimeter and that cloud apps and identities now give attackers the same result as old style attacks without them having to try and breach a network perimeter via the endpoint.

The Security Gap in Identity Management 

Despite advances in cybersecurity, it’s clear to see why many businesses are now vulnerable to identity based attacks. Traditional security measures like endpoint detection and response (EDR) systems and firewalls, for example, are less effective in a cloud centric world where applications are accessed primarily through web browsers. This gap is exacerbated by the reactive nature of many security strategies, which focus on mitigating threats after they have been detected rather than preventing them proactively.

What Does This Mean for Your Business? 

For UK businesses, their move to the cloud and the usage of a wide range and complicated combination of SaaS apps, digital identities, and the interconnection and decentralisation of these have meant that they are now vulnerable to networkless attack techniques, perhaps without realising it until now. The shift to cloud computing has not only expanded the attack surface but also highlighted the inadequacies of traditional security models in protecting digital identities. This means that UK businesses must now take a much closer look at the security of these identities as part of their overall cybersecurity strategy.

To mitigate the risks associated with networkless attacks, businesses should perhaps consider adopting a zero trust security model, which assumes that threats could be internal or external and verifies each identity and device continuously, regardless of their location. Additionally, enhancing visibility across all cloud services and implementing advanced security measures like multi factor authentication (MFA), behavioral analytics, and more sophisticated identity and access management (IAM) solutions could help.

In short, as these networkless attacks continue to evolve, UK businesses must be proactive with security, stay vigilant and adapt their security strategies. By understanding the vulnerabilities associated with digital identities and cloud services, and implementing security measures accordingly, businesses can safeguard their assets in the cloud era.

The post ‘Networkless’ Attacks? appeared first on Quayside Technical Services.

AnyDesk, the remote desktop application company has reported that it recently suffered a cyberattack where hackers gained access to its production servers.

The post AnyDesk Hacked appeared first on Quayside Technical Services.