Zendegi

Nasim had been hoping that Falaki would identify some simple, foolish error that she or one of her colleagues had made, leaving Zendegi vulnerable to intrusions by any sufficiently resourceful stranger. Having found the hole in their defences they could have worked out how to plug it, and that would have been the end of it. It might not have told them who the intruder had been, but then, it would have left them with no urgent need to know their enemy’s identity. The embarrassment of having to admit to some shoddy programming would have been worth it. Anything was better than having to deal with full-blown industrial counter-espionage.

‘So where do we go from here?’ she asked. ‘We have thirty-seven providers in our pool, all with impeccable reputations, all audited and certified as thoroughly as…’

‘As thoroughly as each other?’ Falaki suggested. ‘The standard industry protocols are valuable, but they’re not a watertight guarantee of anything. What you really need to do is put pressure on them to install third-party hardware monitoring.’

Yeah, right. The major providers of Cloud computing took security very seriously, allowing independent auditors to perform snap inspections and random integrity tests. But yanking thousands of processor chips right out of their sockets and forcing them to talk to their circuit-boards through extra hardware that watched and verified their every move would not only be hugely expensive; in some of their customers’ eyes it would amount to a stark admission that there really was a problem demanding that level of overkill. For one company alone to adopt those measures would be commercial suicide. For the whole industry to adopt them, all at once, would require a miracle.

‘We don’t have the clout to make that happen,’ Nasim said bluntly. ‘If we banded together with all the other high-end users, we might be able to start negotiating the introduction of hardware monitoring… maybe ten years down the track. But pointing the finger at thirty-seven companies and saying “The blame lies either with one of you, or with us” is not going to cut it. They’re not going to invest millions of dollars to fix a problem that might have nothing to do with them, when they can pass the buck between themselves – or even better, pass it right back to us.’

Falaki said, ‘I understand. It’s the ideal solution, but we’re not living in an ideal world.’

Nasim turned the USB stick over in her hand. Most of the report’s weighty appendices would be automated analyses of log files, software settings, and hardware tests for Zendegi’s own equipment. Falaki’s team had scrutinised everything from personal notepads – her own included – to the company’s workstations. They’d found no evidence of an external hacker gaining access, but then they’d found no evidence of impropriety by any of her staff either.

‘So short of hardware monitoring, what’s the next best thing?’ she asked Falaki.

‘Software overseers,’ he replied. ‘Every process you run in the Cloud gets twinned with a supervisor process that watches its back – preferably from the vantage point of a different provider. It’s not foolproof and it’s quite expensive; maybe a fifty per cent resource increase if you don’t want your customers to experience lags.’ ‘But it would make life complicated for whoever’s screwing with us?’ ‘Absolutely,’ Falaki replied. ‘And it would make it far more likely that we’ll either end up with evidence against them, or succeed in blocking them out completely.’ ‘Unless they’re geniuses who can subvert anything.’

Falaki smiled. ‘No one has magic shortcuts for every possible challenge. Even if one of your providers is completely corrupt and is messing with your processes more or less at will, we can still make it very costly for them to do that and look innocent.’

‘More than it costs us?’

‘I believe so,’ Falaki said carefully.

Nasim was doing her best to put off imagining sharing this news with the board. A fifty per cent increase in their computing outlays would be painful, but it would be money well spent if it led them swiftly to a lone saboteur. At the opposite extreme, though, if Cyber-Jahan had decided to play dirty, the prospects could be very different. A company like that would have the expertise and resources to bleed Zendegi from two wounds at once – customer losses and expensive countermeasures – and to keep it up for months, even years.

She held up the memory stick. ‘I will read this, I promise, but we might as well get as far as option three.’

‘All right.’ Falaki cleared his throat. ‘This only pertains to the possibility that a member of your own staff is involved, but you might want to consider it, for peace of mind.’

‘Go on.’

Falaki said, ‘I sometimes find it useful to bring in another firm, run by an old business partner of mine, that employs some skilful interrogators. They could interview your staff and pursue the issue more robustly than we’ve been able to so far.’