Are Current Hosting Threat Models Outdated? Understanding Modern Hosting Security Risks

[johny899]

You've probably noticed that we continue to hear about server hacking and cloud security breach. It appears as though hosting providers are relying on traditional methods of keeping data secure. For example, I have used VPS for a long time, and it appears we are fighting against today's hackers with rules developed ten years ago? It's odd, isn't it?

The Old Model of Threats​

The basis of nearly every hosting provider's security plan is thwarting DDoS attacks, weak passwords and running old software. All of which are relevant today; however, the methods hackers are using have advanced, and there are new ways to hack.

Examples of current hacker techniques include: Memory Theft, (e.g. RAM) Container Escape (e.g. Docker) and Hypervisor Bugs. Old Models do not adequately cover any of these. Have you ever wondered how a brand new VPS can be hacked? The answer is simple.

The Way I Perceive Gaps​

There are VPS Providers that would appear to be secure that do not:

• Detect memory attacks that can compromise data.
• Consider the impact to shared servers with others.
• Keep their risk models updated with emerging hacking techniques.

Older risk models assume that a hacker is going to conduct a simplistic attack, but this is not the case in today's environment.

Need For New Risk Models​

Hosting Providers that have updated risk models:

• Identify and fix the most critical security issues as a first priority.
• Recognize and defend against the most common modern attack vectors.
• Provide customers with an accurate understanding of their true risks and not just weak password policy.

Using a horse-cart safety manual while trying to drive a race car is not going to cut it.

Conclusion​

The hosting industry is still using outdated threat models. The real issue is whether hosting providers are willing to update their risk models and address new threats or continue to be reactive. Until that time, we should remain vigilant and consider adding additional security measures to our systems.