Christine Davis

Director, Marketing

Stellar Technologies Successfully Completes a SOC 2 Assessment to Further Data Security

At Stellar Technologies (“Stellar”), we continually invest in security best practices to ensure that our client’s data stays safe and secure. As a part of an on-going effort, we are excited to
announce that we’ve successfully completed our SOC 2 report.  

, a technology-enabled security and compliance firm trusted by more than 4,000 global organizations to help mitigate cybersecurity risks. 

 “Stellar’s SOC 2 report validates its commitment to data security and protection, as well as compliance with critical standards to mitigate cybersecurity threats.”  

 and what does it mean for Stellar?  In this article, we will walk you through the ins and outs of a SOC 2 report and how the report symbolizes trust to clients.

 addresses risks associated with the handling and access of data, and can be used by a variety of organizations of any size (e.g. SaaS, colocation, data hosting, etc.) Rather than a cybersecurity assessment that evaluates specific technical configurations, a SOC 2 report focuses more on how an organization implements and manages controls to mitigate the identified risks to the different parts of an organization.

⁠The 

, which are used to identify various risks (points of focus) an organization should consider addressing. Based on the TSCs the organization selects to be in-scope, the third-party compliance and audit firm (in our case, 

) evaluates whether the organization has the appropriate
policies, procedures and controls in place to manage the identified risks effectively.

There are five Trust Services Criteria. The first criteria, Security, must be included with every SOC 2 report and is referred as the “Common Criteria”.  The remaining four are optional to include:

In order to pass a SOC 2 examination and receive a letter of attestation successfully, it means an organization is addressing controls in areas such as information security, access control, vendor management, system backup, business continuity and disaster relief, 


Organizations of all sizes and industries can benefit from a SOC 2 Examination, as the audit can be performed for any organization that provides a variety of services to its customers. A SOC 2 report highlights the controls in place that protect and secure an organization’s system or services used by its customers. The scope of a SOC 2 Examination extends beyond the
systems that have a financial impact, reaching all systems and tools used in
support of the organization’s system or services. 



Today, many organizations outsource their business operations and services to third-party vendors, possibly putting client data at risk. For this reason, organizations request that their vendors achieve SOC 2 compliance to demonstrate rigorous IT security standards.  Some 

Know your data is safe and secure with Stellar


⁠Stellar will make the SOC 2 report available to current or potential customers upon execution of a non-disclosure agreement.  We hope the steps we have taken help you and your IT teams remain confident in knowing that your data is secure with Stellar.  To learn more about our security policies and initiatives, please contact our 


⁠In an age where cyber threats evolve daily, Stellar’s Managed Security Services offer peace of mind. With Stellar by your side, you’re fortified by top-tier security measures, from proactive threat hunting to real-time monitoring and instant response. We act as your vigilant sentinels, ensuring that your data, assets, and reputation remain uncompromised. For more information about Stellar, visit:  


A-LIGN is the only end-to-end cybersecurity compliance solutions provider with readiness to report compliance automation software paired with professional audit services, trusted by more than 4,000 global organizations to help mitigate cybersecurity risks. A-LIGN uniquely delivers a single-provider holistic approach as a licensed CPA firm to SOC 1 and SOC 2 Audit services, accredited ISO 27001, ISO 27701 and ISO 22301 Certification Body, HITRUST CSF Assessor firm, accredited FedRAMP 3PAO, authorized CMMC C3PAO, PCI Qualified Security Assessor Company, and PCI SSC registered Secure Software Assessor Company. Working with growing businesses to global enterprises, A-LIGN’s experts and its compliance automation platform, A-SCEND, are transforming the compliance experience. For more information, visit 

21972-312_SOC_NonCPA.png

Stellar Technologies Successfully Completes a SOC 2 Assessment to Further Data Security

Matt Love

Chief Operating Officer

Over the weekend, Cloudflare released a tool called 

, to "track deployments and filtering of invalid routes by the major networks". The release has managed to get some notoriety (both positive and controversial) — more than one might expect for such a technical topic.

If you haven't seen or heard of the website, this is what it looks like as of April 20, 2020:

2020-04-20-is-bgp-safe-yet-1.png

Looks kind of alarming, doesn't it? In case you're not familiar with some of the terminology being thrown around, let's review these concepts. If you're already familiar with BGP & RPKI technologies, feel free to 

BGP is the dynamic routing protocol that quite literally runs the internet. ISPs, cloud providers, and larger enterprises use BGP to advertise their networks to one another, which is how anything on the internet knows how to get to anything else. Take the below example:

$ traceroute -a -n www.google.com
 1  [AS22773] 172.19.10.126
 2  [AS22773] 10.96.48.1
 3  [AS22773] 100.125.108.70
 4  [AS22773] 100.99.28.32
 5  [AS22773] 68.1.4.252
 6  [AS22773] 68.105.30.142
 7  [AS15169] 108.170.247.129
 8  [AS15169] 108.170.247.193
 9  [AS15169] 216.239.41.4510
10 [AS15169] 108.170.234.41

In this traceroute, the highlighted hop 7 shows where BGP is happening. AS22773, or Cox Communications (my home's ISP), directly interconnects with AS15169, or Google. My home network can reach Google through this interconnection, which is commonly referred to as a 

As you can probably imagine, there's a lot more to BGP than this, very little of which is in-scope for this article. There are lots of great resources out there to learn more about BGP and internet peering; 

, is a security mechanism introduced via 

To understand RPKI, one must first understand the problem it's trying to solve: 

 controversial website actually does a fantastic job of illustrating what BGP Hijacking is:

2020-04-20-is-bgp-safe-yet-2.png

In a nutshell, an attacker can advertise networks they don't own to ISPs and cause traffic to web resources within those networks to route through the attacker's network. This can lead to the web resources appearing completely down, or worse, the traffic can be intercepted and sent on to its original destination with the end-user being none the wiser.

, but it's up to the network operators and providers to prevent it.

 is a certificate system which may be used by an organization to cryptographically sign which networks they own, and from where they should originate. These certificates are called 

There are two primary requirements to ensure RPKI is effective:

A BGP-operating organization must sign and issue ROAs for their networks, which are validated and maintained by Regional Internet Registries. While this is a critical first step, it doesn't solve any problems by itself.

For this organization's ROAs to do anyone any good, internet providers upstream from the organization have to reject any route advertisements that are signed by the organization, but advertised by someone else.

 should only originate from Google (AS15169) via their ROAs, and 

 is suddenly advertised from an attacker (whether maliciously or by mistake), internet providers should reject the route so that the traffic is never sent to the attacker:

2020-04-20-is-bgp-safe-yet-3.png

You might be wondering why a provider would accept a route to a network they don't own in the first place. This is an important question! 

Network providers should never accept route advertisements from customers or peers unless the organization is authorized to advertise that prefix

. Unfortunately, it's impossible to enforce such a statement on a global scale.

RPKI's goal is to provide a mechanism through which participating networks can prevent these hijacks from happening, or at least reduce their impact.

If you've read the above background information, or are already familiar with these technologies, you can see that RPKI adoption is an important step to improving the security of the internet. The discussion has been ongoing in the community for nearly a decade. Many content providers (like Cloudflare) have championed the implementation of RPKI, and some major internet carriers have recently taken a major step by rejecting RPKI-invalid route advertisements from ever entering their networks (

To date, Cloudflare has been doing fantastic work related to routing security in the internet operator community; they're probably the largest vocal advocate of RPKI adoption in the world. However, the release of 

 has been very controversial in the community, and with good reason.

Public shaming is rarely a successful or healthy catalyst for change, and Cloudflare's new tool enables potentially under-educated end-users to quickly (2 clicks) call out their service providers for not "implement[ing] BGP safely", which isn't necessarily accurate.

A couple of highly-respected network engineers (

 Cloudflare's own claim to "implement BGP safely", and found some interesting results. They intentionally advertised a network onto the internet — 

 — from an invalid ASN, which should be considered an RPKI-invalid network. Cloudflare's own 

Cloudflare confirms 194.32.71.0/24 is invalid

2020-04-20-is-bgp-safe-yet-4.png

If Cloudflare truly rejects all invalid RPKI networks as they claim to, traffic originating from this network (from the "attacking" source) should be unreachable for Cloudflare. In other words, you shouldn't be able to reach Cloudflare from that network. And yet:

Cloudflare can still reach 194.32.71.0/24

2020-04-20-is-bgp-safe-yet-5.png

This screenshot shows that traffic originating from the "attacker" can reach Cloudflare's network, and that Cloudflare's network has reachability back to the "attacker" network. Another engineer set up a site using 

We love Cloudflare. This site is served over Cloudflare's CDN, we exclusively use their DNS services, and we recommend them to just about all our customers.

 is a well-intentioned, poorly-implemented scare tactic that will only serve to raise RPKI awareness in a negative light, at a very sensitive time in the global internet community due to the COVID-19 pandemic. And, if Cloudflare is going to be the RPKI standards bearer for everyone to follow, shouldn't they implement RPKI correctly themselves?

Cloudflare's method of testing a network's "safe" implementation of BGP is reachability to their network 

, which is intentionally advertised with an invalid ROA. However, reachability to this network isn't a sole indicator of an unsafe BGP implementation. Not all network providers accept a full routing table from their upstream carriers. Indeed, many providers only accept routes local to a particular region, with a default route to cover the rest. In these cases, the provider has no control over its reachability to an RPKI-Invalid network. This further illustrates that the attitude of Cloudflare's 

 tool is not the right approach to fostering the adoption of RPKI.

At Stellar, we place extremely high importance on routing security. You can read more about our routing policies 

We ensure invalid routes never enter our network from customers and peers by only accepting routes that are either a) listed in an 

, b) manually validated by our engineering team, or both.

We also use BGP policies to ensure only routes we or our customers are authorized to advertise ever leave our network.

As a cloud provider, our primary objective in the RPKI ecosystem is to prevent the hijacking of our own networks by a third party. This is accomplished by signing and issuing ROAs, which inform upstream RPKI participants of valid paths for the containing networks. 

At Stellar, we issue ROAs for our address space:

2020-04-20-is-bgp-safe-yet-6.png

> show bgp ipv4 unicast 103.21.244.0/24 bestpath
BGP routing table entry for 103.21.244.0/24, version 24720714
BGP Bestpath: deterministic-med
Paths: (6 available, best #3, table default)
  Advertised to update-groups:
     14
  Refresh Epoch 1
  174 13335, (aggregated by 13335 162.158.140.1)
    38.104.117.177 from 38.104.117.177 (154.26.7.144)
      Origin IGP, metric 2020, localpref 150, weight 200, valid, external, best
      Community: 174:21001 174:22013 14525:0 14525:20 14525:1021 14525:2840 14525:3001 14525:4001 14525:9001
      rx pathid: 0, tx pathid: 0x0

The above is the BGP routing table entry for Cloudflare's intentionally invalid RPKI test network. The fact that it exists in our routing table means that we do not yet reject RPKI-Invalid routes from our upstream providers.

While it's been on our roadmap for some time, we've placed a higher priority on other objectives, such as our customer & peer routing policies, global network redundancy, and making our network faster and more reliable. Additionally, there are very few options available for the server implementation of RPKI - all of them open source. While we fully support and contribute to the open source community, the use of open source software in production networks requires a great deal of testing, validation, and architecture effort to ensure what we implement meets our 

We do plan to implement an RPKI solution to reject invalid routes, but it is still in progress at this time.

Does this really happen?

Comments & Education on Cloudflare's new BGP Tool

Is BGP Safe Yet?

Launch into Stellar's product updates, company news, and educational content on how to leverage the 

The Interstellar Connection

Your Portal to Technology's Future

Stellar Technologies Successfully Completes a SOC 2 Assessment to Further Data Security

Stellar completes SOC2 Audit

Is BGP Safe yet?

Comments & Education on Cloudflare's new BGP Tool

Learn More about What We Do