A Message from our CEO
.jpg?width=150&name=Bob-Desteno-18-Edit%20(1).jpg)
With 2021 drawing to a close and the holidays almost here, I want to take a moment to reflect on what has been an unforgettable year here at Archive360. While the global pandemic continues to present us all with challenges both at work and at home, our team has once again achieved new heights with our products and our business.
Customer Spotlight
How DLA Piper Transformed their Information Governance
Experts' Advice
Whitepaper: Why Zero Trust is Important
.jpg)
Blog: Modern Attachments – An eDiscovery Quagmire?
Podcast: The Changing Information Governance Environment in the Age of COVID-19
%20(1)-1.jpg)
Blog: CapEx versus OpEx - On Premises versus the Cloud
Microsoft 365 Migrations and Inactive Mailboxes (2-part blog series)
Product News - Security Update
In this edition’s Product News:
- Log4j vulnerability – what it is and why Archive360 customers are not impacted
- Cybersecurity threats and updates from the United States Cybersecurity and Infrastructure Security Agency (CISA)
- Cloud data migration trends and issues
- Why your SaaS vendor leaves you vulnerable to cyber attacks
- How to take control of your data security
Log4j Vulnerability Highlights Importance of Strong Cloud Security Controls
Organizations worldwide have been scrambling to respond to yet another potential cybersecurity threat to global computer networks. This time the threat comes from a bug inside software known as Log4j which hackers could use to steal data, install malware or take control. Log4j is just another security vulnerability in what seems like an endless stream of cybersecurity vulnerability disclosures.
Archive360 Chief Architect, Glenn Luft, discusses why the Archive360 Archive2Azure platform was not impacted by the Log4J vulnerability named Log4Shell CVE-2021-44228.
What is the Log4j vulnerability?Apache Log4j is a ubiquitous, open-source Java logging library used widely across a huge variety of enterprise and open-source software. Last week, it was publicly disclosed that a security flaw existed in this library. The vulnerability was named Log4Shell and given the identifier CVE-2021-44228. The vulnerability can be exploited remotely without authentication, meaning threat actors can access it on a network without requiring any login data, authentication or credentials. Once an attacker gains access, they can quickly exfiltrate data or deploy ransomware to the vulnerable system. Since millions of applications and services use this logging system, it makes this risk that much more dangerous. Microsoft has recommended a series of steps to mitigate the risk of exploitation, including contacting your software application providers to be sure they are using the most up-to-date version of Java, which would include patches. |
Is your SaaS vendor meeting your security requirements?
While the Log4j vulnerability has no impact on Archive360 customers, it has impacted many SaaS archive solutions. As we’ve seen with other cyberthreats, the Log4j vulnerability highlights the importance of proactively ensuring your cloud vendors have up to date security controls in place or offer the ability for customers to customize their individual security processes/technology to better mitigate the ever evolving security threat landscape.
Sharing security responsibilities, particularly when you have a mix of IaaS, PaaS, and SaaS – each with different security requirements and capabilities – can be challenging. Multi-cloud makes matters worse. In fact, over 90% of the technology leaders surveyed by Pulse say their SaaS providers don’t meet all their company’s security requirements. And more than a third (37%) of tech leaders say they have had to make a security policy exception for one or more of their SaaS-based vendors.
The problem with SaaS archiving and information management solutions is their shared tenancy and one-size-fits-all security model that limits your security options. You must trust SaaS vendors to:
- Manage their software’s security configurations and rotate encryption keys appropriately
- Store encryption keys in a different location from where the data resides
- Strictly limit access to encryption keys
- Limit data access to only those identities–both human and non-human–who absolutely need it
- Limit data access duration to only the times it is essential
- Actively monitor their users’ job status and manage their entitlements accordingly
- Train their personnel on best security practices and for personnel to follow protocols
- Seek your consent before turning it over to the government using secrecy warrants
- Adequately test software updates for vulnerabilities before, during, and after deployment
In the Media
Help Net Security: Cloud compliance: Falling out of it could spell doom
Government Technology Insider: FOIA in the COVID-19 Era: When Government Agencies Can’t Comply with Government Mandates
Get the answers you need.
