Security incidents

Security incidents – analysis options through STACKIT

For systems on the STACKIT platform, STACKIT can take measures to detect vulnerabilities at an early stage.

If vulnerabilities are identified, the customer is informed about them, provided that this is possible via the stored data. Depending on the severity of the vulnerability (based on the assessment by STACKIT), the customer is obliged to promptly patch the systems for which it is responsible or to take suitable measures to avoid the vulnerability. If systems are not secured by the customer with the latest patches or workarounds, STACKIT reserves the right to take appropriate countermeasures if necessary.

STACKIT also reserves the right to take appropriate countermeasures if it is made aware of vulnerabilities or compromised systems by external service providers, e.g. “BSI abuse”, which could potentially cause damage to external or other internal systems of the STACKIT cloud, or if this has already occurred.

Security incidents – data collection for analysis options through STACKIT

To detect potential security incidents, log data of customer systems or perimeter data (e.g. firewalls, switches, routers and others) can be evaluated for anomalies and potential security incidents based on rules. Appropriate vulnerability scans (proactive and reactive) can also be performed for systems available on the Internet. This also involves the collection and processing of personal data, such as MAC and IP addresses.

Possible countermeasures in case of (suspected) security incidents by STACKIT

To protect the cloud platform and our customers, STACKIT reserves the right to take appropriate measures without prior consultation with the customer in the event of suspected cases or proven vulnerabilities and corresponding severity. Of course, the customer will be informed separately, provided that the relevant contact details are available. In particular, measures include:

• The disconnection of affected systems from the network to prevent damage to systems.
• In coordination with the customer, a forensic analysis of possible affected systems is possible (in particular to gain knowledge for law enforcement, criticality or damage assessment).
• Other activities to avoid or reduce interference with other customer systems of the STACKIT Cloud Platform or external systems.

The protection of your data and systems is very important to us.

However, the above mentioned measures do not result in any claim to performance by the customer and also no possibility of holding STACKIT responsible for a (damage) event that has occurred or which has not been avoided (i.e. dealing with security incidents is not a “managed service” on the part of STACKIT).