Cloud security threats come in all shapes and sizes, so we asked eight experts to weigh in on what they see as the top threat to Cloud security. The answers run the gamut, but in all cases, our Cloud security panelists believe that these threats can be addressed.
Public cloud security remains MISSION IMPOSSIBLE
1. Application-layer denial of service attacks
By Rakesh Shah, Director of Product Marketing and Strategy, Arbor Networks
The biggest security threat to the Cloud is application-layer distributed denial of service (DDoS) attacks. These attacks threaten the very availability of Cloud infrastructure itself. If a Cloud service is not even available, all other security measures, from protecting access to ensuring compliance, are of no value whatsoever.
Hackers have found and are actively exploiting weaknesses in Cloud defenses, utilizing cheap, easily accessible tools to launch application-layer attacks. A major reason they have been successful is that enterprise data centers and Cloud operators are not well prepared to defend against them.
Existing solutions, such as firewalls and IPSs are essential elements of a layered-defense strategy, but they are designed to solve security problems that are fundamentally different from dedicated DDoS attacks.
As DDoS attacks become more prevalent, data center operators and Cloud service providers must find new ways to identify and mitigate evolving DDoS attacks. Vendors must empower data center operators to quickly address both high-bandwidth attacks and targeted application-layer DDoS attacks in an automated and simple manner. This saves companies from major operational expense, customer churn, revenue loss, and brand damage.
2. Loss of confidential data
By Guy Helmer, CTO of Palisade Systems
Confidentiality of content is the top Cloud security threat and concern for information security and IT leaders.
Companies of all sizes and across all industries, especially healthcare and financial industries, have taken steps to protect confidentiality of their content in their legacy data centers because of high costs from disclosures, penalties resulting from breaches, and loss of reputation.
8 ways to become a cloud security expert
However, in the Cloud, unbeknownst to many organizations, content can't be monitored, controlled, and protected as easily, because of lack of visibility, sharing systems with other Cloud customers, and potential for malicious insiders at Cloud providers.
Cloud environments pose different obstacles for safeguarding content. In information-as-a-service (IaaS) environments, customers have the ability to create corporate infrastructure in the Cloud. Encryption, access control and monitoring can reduce the threat of content disclosure. However, modern content security monitoring and filtering solutions may be difficult or impossible to deploy due to architectural or other limitations in this Cloud environment.
In platform-as-a-service (PaaS) environments, customers can quickly spin-up new Web, database and email servers, but will find they have even fewer ways to do any monitoring or protection of content than in an IaaS environment.
Customers with confidential content are at the greatest mercy of vendors in SaaS environments. With few exceptions, there is no way for a customer to ensure security of content at a SaaS provider - the SaaS provider must be completely trusted and trustworthy (and bound by a strong contract) to maintain security on behalf of the customers.
3. Managing complexity and risk
By John Thielens, Chief Architect, Cloud Services, Axway
The biggest threat in the Cloud - certainly for large, mature enterprises - is managing complexity and risk.
When organizations manage on-premise deployments the old-fashioned way, they tend to break down the basic components (network, firewall, storage fabric, computing servers, disaster recovery), and identify the types and levels of risk around each piece - both separately and as part of the entire infrastructure. This way of analyzing an infrastructure generates a tremendous amount of transparency in general, and for risk management in particular.
But when you go to the Cloud, elements you have typically been able to analyze for complexity and risk are now being built and managed by someone else, with a potential hit to transparency that can hobble your overall strategy for complexity and risk management.
So, enterprises must "raise the bar" with Cloud providers when they are looking to consume Cloud-based services. And one key question to ask is: What level of transparency can you offer me (including predictive service-level agreements) so that I can leverage that into my existing risk management directives?
The challenge for Cloud providers is to balance the magic of providing a Cloud service - which is supposed to deliver a clean, simple, easily consumed interface - with the ability to integrate an enterprise's existing IT fabric. And that includes providing a level of technical disclosure (transparency) that gives enterprises the power to manage the complexity and risk of blending the Cloud into their infrastructure.
4. Downtime due to a Cloud outage
By Peter Glock, Cloud Service Director, Orange Business Services
Like a well tuned symphony orchestra, there is strength in numbers, a collective force to be harnessed to create opportunities for the composer and drive your audience into your concert hall. But sometimes when just one of those players is slightly out of tune, or when your horn section is late for a great performance, the whole orchestra can come to a complete grinding halt.
The same can be said of cloud computing. In the Cloud you can leverage the best design, harness flawless operations, and leverage the power of the few to benefit the many. However, just like a professional orchestra, the benefits of Cloud services can come crashing down on top of you if it is not correctly designed, operated and maintained.
The attraction of the Cloud is being on a platform that appears to offer unlimited computing resources. However, the same controls that are managing your enterprise infrastructure are also managing others at the same time, all on the same network. This high-wire act can create a scenario where even a minor glitch or breach could set off a string of consequences. The challenge then for Cloud providers is whether they can keep on top of a complex and sizable network. The more users on that network, the more difficult it is to troubleshoot, the greater likelihood of a Cloud blackout that impacts all the infrastructures tied throughout it. Even a successful incident response will likely involve shutting down large parts of the network, impacting you even if your infrastructure is not the source or primary victim of the problem.
Recent headlines has shown this to be true as commercial service providers have experienced wide-reaching Cloud outages that have knocked out Websites and caused revenue loss for both customer and provider alike. However, if you chose wisely, the Cloud is still a compelling business proposition.
We see customers adopting a hybrid approach, mixing public Cloud services with private, and limiting reliance on a shared platform. In addition, we find that most business operations in the Cloud are not mission-critical, so even if an event occurs there is limited loss on the customer side. This is especially evident among large enterprises. Small-to-mid sized businesses that are dependent on a public Cloud for all of their resources are usually the most hurt during an outage.
Operational risk from Cloud services can be mitigated through good process management and service-level agreements (SLA) that preserve uptime and provide workarounds in case of downtime.
5. Employee `personal clouds'
By Simon Crosby, Co-founder and CTO of Bromium
When I talk to CIOs about their use of Cloud computing, they are focused on building a private Cloud - an enterprise-owned, virtualized and automated IT-as-a-service capability that will help them respond more readily to changing business needs, and achieve greater efficiency and availability. Why build a private Cloud? The answers are remarkably consistent: public Cloud services are viewed as a security risk.
But there aren't any significant technology barriers to building a public Cloud service that is far more secure than any enterprise private Cloud. It is easy, for example, to implement a system in which all data is encrypted at rest, and available in decrypted form only to the application consuming it, using keys provided by the enterprise owner of the data (and not the Cloud provider).
But the perceptions remain - driven by the growing stream of reports of successful attacks against companies and governments. The risks are real, and deeply worrying, but in the vast majority of cases, involve compromise of enterprise private Clouds from compromised enterprise PCs.
To restate this: the enterprise is far more vulnerable to attack via its employees and their use of poorly secured enterprise clients than to direct attacks on its data centers. The RSA attack in which the seeds of the RSA tokens were stolen, started with an employee opening an infected Microsoft Excel spreadsheet. The first attack from China on gmail used a poisoned URL and Internet Explorer 6. So, the biggest security threat in the Cloud results from the employee's "personal Cloud" - the merging of their personal and enterprise interests in a single device with a monolithic OS that fails to isolate and separate different domains of trust.
6. Lack of visibility
By Paul Henry, Security expert and forensic analyst at Lumension
The biggest threat to Cloud security is a lack of visibility, which has opened the door to liability concerns.
Many traditional security providers were late in joining the shift to virtualization and it took years for them to offer solutions that could actually act upon data that flowed seamlessly between virtual machines without physically touching a network interface. In virtualization this has caused a serious lack of visibility and control that has further worsened by vulnerabilities or flaws within a neighbors' multi-tenant Cloud environment making the liabilities of who is responsible a constant battle.
Given that Cloud was built on the promise of being cheaper, we must now consider that this environment we are creating holds no acceptance of liability on the part of the provider. Providers are offering their Cloud services "as is," without assuming any risk at all, some even providing an exclusion for all liability-leaving anyone facing a Cloud security issue solution-less.
What is interesting about the Cloud environment is that because of these liability issues, providers of Cloud will have to institute a security service-level agreement (SLA). Whereas in the past we have been conditioned to accept flaws and vulnerabilities from software vendors, in order for costs to remain low within the Cloud environment, providers must now push back on any security related issues to avoid accepting any potential legal liabilities.
7. Changes in governance and operational security
By Joe Leonard, Security Practice Manager at Presidio
The two main concerns for Cloud security are changes in governance and operational security.
Organizations must evaluate their existing governance against the Cloud security model and understand the residual risks and what compensating controls need to be implemented. Governance areas for concern include risk management, legal and compliance, life-cycle management and portability.
Operational security concerns include business continuity, disaster recovery, incident response, encryption, vulnerability assessment, identity access management and virtualization.
The Cloud multi-tenant environment security controls are developed for a general service offering which may or may not provide adequate security for every organization. Organisations need to assess their vulnerabilities and implement threat prevention policies and technologies; otherwise, reacting to breaches will become more the rule than the exception.
The Cloud plays a critical role in helping organizations capitalize on the efficiency, flexibility and ease of operation. Companies must invest in people with the technical skills necessary to assess their readiness for implementing different Cloud architectures that help move data in and out of public/private Clouds and understand the security risks associated with changes related to Cloud architecture.
Because of the organizational and cultural complexities of executing Cloud strategies, companies are opting to "out task" certain aspects of their operations because skilled resources are in short supply. Companies who understand the organizational impacts of Cloud and who can acquire these skills, set the right security policies, and build closer relationships with the lines of business will be the best able to mitigate the two big risks associated with Cloud security.
8. Easy access to Cloud resources
By Tomer Teller, Security researcher and evangelist at Check Point
When it comes to Cloud security the number one threat is the abuse of Cloud power by cyber-criminals.
Today, there is a low barrier to entry, which makes it easy for hackers to launch security attacks on Cloud computing resources.
For some companies, the nature of the Cloud allows any person with a valid credit card to register and use Cloud services. Spammers, malicious code authors and other criminals can use these platforms to launch denial-of-service attacks, host botnet command and control servers, perform password and key cracking and other malware and infect legitimate tenants in the Cloud systems.
In addition, today's attackers can create massive distributed DoS attacks, even without having any zombies. All they have to do is buy or obtain access to a few servers and blow some service off for a few minutes.
This also allow criminals to build "Rainbow Tables", which are pre-computed hashes used for offline password cracking -- in addition to CAPCHA breaking and decryption that are often involved. Hackers can take advantage of such techniques to rapidly change locations and keep their business alive.
Some Cloud services even provide trial versions that grant access for short periods of time, allowing criminals to be completely anonymous.
While the Cloud is profoundly changing the way companies leverage technology for business, it's important to be aware of the opportunities it can create -- in both positive and negative respects. Sometimes you have to think like a criminal in order to prevent one from threatening your business.
Read more about cloud computing in Network World's Cloud Computing section.
