When I first started at Cloud Heroes, one of the first tasks I learned how to do was to create hosting accounts for customers. Hosting accounts consist of space for website hosting, DNS, and email storage. Setting up hosting accounts is very common when it comes to setting up new customers for one of our resellers, Expert Agent. They are a company that provides a platform for estate agents to run their business on.

When we first receive the request, we add it to our job system. We then go to the web interface of our web server and create a new hosting account. We first have to set up the user account, adding the details of the new customer Expert Agent has provided us with. We continue with adding the web hosting element to the user account by adding the domain to the hosting account so that the web space is designated to the domain. Once we have added the domain, we can assign a subscription to it. A subscription tells the server how much space a domain can use on the server and can automatically block usage if over the limit or is taking advantage of the Fair Use Policy.

No DNS or email set-up is required on these, as Expert Agent complete these themselves. We do have to provide login details and FTP details so that Expert Agent can transfer websites to the new hosting account. Passwords are added securely to our customer portal, where they are viewable for 30 days before they are erased from the server. Once Expert Agent have completed this, we install an SSL to ensure the site stays secure.



In the Occupational Brief, this covers:

Remote Infrastructure: In most cases, we only require a desktop to complete the set-up. Sometimes we need to point a domain to a new hosting account, we may need to access Nominet or Total Reg, which is where we manage domain names. Total Reg is a single sign-on website, however, Nominet requires MFA (multi-factor authentication). We require an iPad to generate a code via Google Authenticator, which is entered into the website.

Security: Cloud Heroes have a secure process of sending passwords, which erases them after 30 days. This process meets ISO standards. This is to protect Expert Agent and their end users. We also install an SSL, which adds a layer of security to their websites. This is part of the hosting account setup process, shown above.

Problem-solving: We must be compliant with Cloud Heroes guidelines to complete tasks, as the Cloud Heroes guidelines are in accordance with ISO standards.

Workflow Management: We receive these requests daily, so they are allocated to either myself or my colleagues, depending on the work each of us is working on. Setting up a hosting account only requires one person.

Performance: In this situation, we are setting up a hosting account, which will be held on a shared system. This will be using a GUI, or a piece of software installed onto a server to make it easier for the user to navigate around.

AgencyUK is a company that provides websites using our infrastructure for Hosting Accounts, with SEO and marketing for companies across the UK.

A recent order from AgencyUK from us had been a hosting account for a well-known charity. A few days after sending over the details to access their new hosting account and setting them up with a new WordPress website to edit, we received a phone call from their account management team in regards to a potentially malware-stricken website. After analyzing the website, the website files, and any logs that were created by the website, I was able to discover that extra files had been uploaded from an alternate source.

The most common vulnerability in WordPress that could be used to upload files is the XML-RCP vulnerability. XML-RPC is a file, included in the base install of WordPress, which allows remote connections to the WordPress website. This allows tools and applications to access the website, such as RSS Feeds. Because this allows remote connections without any authentication, this file can be exploited and used to upload malicious content to the website.

After we found this, we completed a restoration of the website. Although the website is a few days old, our infrastructure completes a backup in order to catch any changes. We contacted AgencyUK via email and a follow-up phone call with some advice. In this case, we advise that XML-RPC is disabled on this website and any future website they create. If the file is needed, it can be enabled again. We also advised that they install a WordPress plug-in called WordFence, a security plug-in that detects malicious activity, blocks intrusions, and ensures your WordPress website is secure.



In the Occupational Brief, this covers:

Communication: This exchange had originally been over the phone, however, any summaries or updates were also sent via email, to ensure AgencyUK had the correct details to inform their customers. Sometimes we are required to talk to their customers as a third party, however, in this case, we were not required to contact their customers.

Security: Unfortunately, WordPress isn't the most secure, however, it is one of the best free website builders for inexperienced website designers. We are aware that there is a demand for WordPress-friendly hosting, so we need to have safety features installed alongside our infrastructure. We have a firewall between servers that hold customers' websites and the outside world, to be the first defence in case of an attack. In the event that an attack reaches the website itself, we have an antivirus installed on our web servers to scan website files for malicious code constantly.

Problem-solving: We must comply with Cloud Heroes guidelines to complete tasks, as the Cloud Heroes guidelines are in accordance with ISO standards. We use a 3rd party tool to scan for and resolve malware intrusions, along with a backup/restore service as an alternative.

Workflow Management: These types of issues are rare, however, these issues are documented thoroughly in tickets. In case the issue becomes more problematic and requires escalating, the ticket needs to include every step both I and the customer completed, with the results of those steps. Escalation would be immediate if any results show that the malware is more widespread, and could affect other websites on the same server.

Performance: In this situation, we are investigating and resolving website issues, so we will need to access websites held on a shared system. This will be using a GUI, or a piece of software installed onto a server to make it easier for users to navigate around. Some pieces of software we use are via command line (CLI), are not accessible by users, and can only be accessed by users in the local network. This means me and my co-workers can complete tasks that customers cannot.

Cloud Heroes have two server cabinets stored at a local data centre, based on a MOD site. Because of this, any visitors to the site require security clearance and an access request to be approved two days prior. I have been tasked many times to complete jobs at the data centre by the CTO, including hardware replacements and infrastructure upgrades.

The support team were receiving alerts via email over 3 days in regards to a failing hard drive at the data centre. This hard drive belonged to one of our internal backup servers, which backed up our in-house intranet, email service and our file sharing server. After monitoring this over the 3 days, we agreed that the server required attention, and the hard drive needed to be replaced.

I was tasked to complete this, and I sent an access request over to the data centre. I received the confirmation the same day that I was able to complete the work at the location. Two days later, I went to the data centre with a replacement hard drive that had been purchased by the CTO from a supplier on our approved company supplier list. I had been provided a keycard previously, which allows me access to the data centre, along with a 4 digit code and biometrics for security. I only have access rights to the location of our cabinet for 24 hours, in order to protect both us and other users of the data centre.

Once I gained access to our cabinet in the data centre, I had to locate the server. All the servers are labelled either with small stickers or a digital LCD screen, which shows the server's name. The server in question had an LDC screen, which had been flashing red. Usually, the display is blue and only flashes red when there is an issue. With this, I was able to locate the problem drive, as 5 of the 6 drives that were attached had a blue LED next to them, with the faulty drive flashing a red LED. I was able to remove the drive and replace it with the hard drive I had with me. A blue light started to flash, which meant that the drive is trying to rebuild itself, and replicate the failing drive I had removed.



In the Occupational Brief, this covers:

Communication: We do not receive any contact from the data centre, however, we do require contact with them when we request access to the data centre. We send Purchase Orders via email to our authorised suppliers when we purchase a piece of kit. I received training face-to-face with the CTO in regard to the installation of the new hard drive and data centre standards, expectations and processes.

Security: As the server we are trying to maintain is in a secure data centre, we are required to complete their security process along with our own. If there is an issue with access to the data centre, this will need to be escalated to the security staff. If there is an issue with a server at the data centre, this will need to be escalated to the CTO, who will be able to determine whether he is required to be on-site, or if there is a fix available remotely. The data centre has policies that can be accessed as a physical folder around the building, and our policies in regard to data centre access are freely accessible to the technical team via shared storage.

Problem-solving: We must comply with Cloud Heroes guidelines to complete tasks, as the Cloud Heroes guidelines are in accordance with ISO standards. We also need to comply with data centre guidelines and comply strictly with ISO standards. We use an alert tool which alerts the support team when a service or device goes down, with reasons why this would be. To troubleshoot the service or device, we use either Remote Desktop or an SSH tool called SecureCRT, which allows access to a server or device. We can then complete troubleshooting measures via Windows Control Panel or the Linux terminal.

Health and Safety: In completing hardware changes, we need to understand health and safety procedures. We need to complete the correct manual handling when picking up large boxes or items, to protect ourselves from a spinal injury. We also need to comply with HSE's DSA regulations, which are regulations regarding display screen equipment implemented daily. This includes daily screen time, screen brightness and chair positioning.

WEEE: We deal with an electronic disposal company who can correctly complete the disposal procedure on our behalf. Every few months, we order a collection of kit, such as used servers, laptops and small devices, They are recorded internally via their make, model and serial number before being shipped off for record keeping. We have a choice whether or not we receive back recycled kit, or if it is disposed of. This allows us to securely reuse kit in accordance with ISO regulations.

Cloud Heroes Review

David Shears - Helpdesk Co-ordinator:

Jade has grown significantly in her role at Cloud Heroes since joining us in early 2021. She has developed a polite and professional manner when communicating with customers on the phone and electronically. Jade is able to deal with most first-line requests independently and is capable of covering the helpdesk single-handedly when required. She has had the opportunity to visit customer sites and we receive positive feedback following her interactions with clients. Jade is quick to volunteer for work that is appropriate to her role and has a willingness to learn and contribute to shaping internal work practices.



Michelle Walker - Operations Manager:

Since joining Cloud Heroes in early 2021, Jade has become a highly valued member of the team. Her confidence has grown significantly, and she has developed a gracious and professional manner when communicating with customers. Jade is very quick to volunteer for tasks/projects and has demonstrated her ability to be organised and diligent when managing workloads. She is able to resolve the majority of first-line support requests independently and has recently completed a couple of customer site visits which has resulted in very positive feedback.



My thoughts:

Over the past few years at Cloud Heroes, I have had the privilege of learning particular skills which may not be possible in other businesses. I can take a hands-on approach to most situations and find out how to resolve a real-life query, in a fast-paced environment. I hope to continue assisting users and my colleagues, using the knowledge that I have learned. I would also like to learn new tasks, which could allow me to be more independent in the workplace. I would like to be involved in larger projects, with the ability to learn how to effectively manage a team.