How can we be so sure?
As Sr. Director Infrastructure Operations, Symantec Authentication Services (including SSL, PKI, VIP, FDS), my team is responsible for operating and maintaining the infrastructure, which makes up the Authentication Services business. This is the same role I had while at VeriSign at the time when Symantec acquired the Authentication Services business in 2010.
In light of the recent announcement from VeriSign, Inc. that their corporate network was breached, people are wondering how we can be so certain in our public statements that the authentication networks were not compromised by the breach since the Authentication Services business was a part of VeriSign in 2010.
First, let me underscore that Symantec did not acquire VeriSign, Inc. Symantec and VeriSign, Inc. are separate entities. Symantec acquired assets from VeriSign that include the Trust Services (SSL) and User Authentication (PKI, VIP, FDS) businesses.
In keeping with industry best security practices, we have always segregated networks based on usage and function. A corporate network typically allows employees access to corporate functions such as mail, shared document sites, and the Internet.
At the time the breach occurred, VeriSign was running a separate production network to host the Authentication Services “Cloud” of SSL, PKI, VIP, and FDS. When the Authentication Services business moved over to Symantec, we continued to employ the practice of this separate production network. This segregation prevents breaches on the corporate network from infecting the production network.
Some of the ways that we protect our production network include: restricting access only to authorized production personnel; filtering access to the production network to IP addresses assigned only to authorized production personnel; requiring indirect system access via stand-alone “jump” servers; using a separate authentication source from that used by the corporate network; and requiring strong passwords which are changed regularly in accordance with industry Information Security standards. Finally, we run regular internal and external audits against our production systems to ensure we’re protected against ever evolving threats.
People have also asked about the fact that Symantec still uses VeriSign’s datacenter for their operations and if it has an impact. As a security precaution, Symantec’s production network is completely separate from VeriSign Inc.’s corporate network. Additionally, our development environment also resides on a separate network from the corporate systems network, and is hosted only in a Symantec-owned facility. Finally, the VeriSign root keys, which form the basis of SSL trust, are kept in an offline state and are never accessible on a network.
We have spent years developing and honing our security practices, and we make sure that our production environment, where our most sensitive data is stored, is always the most secure area of our network.
Developing and maintaining a high security posture is not easy and it’s not convenient for our employees. However, as a good friend of mine often tells me “Security by convenience is no security at all.” In times like these, it’s good to know that that policy remains a good practice.