Provider of data center pretends Tier 4 data host certificate to secure $11M SEC contract

Impact on supplier credibility and verification of certification

The scenario illustrates the weaknesses organizations encounter when depending on third-party endorsements. The forged certificate brings up significant worries for CIOs and IT executives who rely on accredited data centers to assure reliability and protection for crucial data.

“In view of this incident, firms will need to conduct a more thorough investigation to confirm the claimed credentials, including certifications, of a new supplier. A basic verification of the certifying body should provide insight into the probable validity of the certification assertion,” stated Abhishek Gupta, CIO at DishTV, a prominent Indian broadcasting company.

CIOs commonly utilize various resources while assessing potential data center collaborators. Customer testimonials, physical visits to the site, and informal validation within the CIO community all play a role in the evaluation process.

“Even now, IT executives aim to assess the real-world performance of a prospective partner before bringing them on board as a data center collaborator,” Gupta remarked. “While certifications play a crucial role in evaluating fault tolerance levels, additional steps like validating the credibility of the certifying organization are likely to become more critical.”

“Data center tier certifications have traditionally served as a standard for dependability and durability,” as stated by Saurabh Gugnani, head of cyber defense, IAM, and application security at TMF Group, a Dutch professional services firm. “However, if a certified data center underperforms or faces a significant outage, it can impact the credibility of these certifications.”

Certification legitimacy is just one aspect of the overall decision-making process, Gupta mentioned. According to him, this incident should not lead to a shift in the assessment approach.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts