Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

How to make cloud more secure

Five key lessons.

Article comments

While many companies are considering moving applications to the cloud, the security of the third-party services still leaves much to be desired, according to experts at the recent Black Hat Security Conference.

The current economic downturn has made cloud computing a hot issue, with startups and smaller firms rushing to save money using virtual machines on the Internet and larger firms pushing applications such as customer relationship management to the likes of Salesforce. Yet, companies need to be more wary of the security pitfalls in moving their infrastructure to the cloud, experts say.

"Guys at the low end are using (cloud infrastructure) to save money, but the danger is that the guys at the top end start to use it without any auditing," says Haroon Meer, technical director at security firm SensePost, who discussed his team's research into some aspects of Amazon's Elastic Compute Cloud (EC2) at the Black Hat security conference.

Their experiments showed that companies frequently do not scan the third-party machine instances available from some providers. A malicious instance could easily be created as a Trojan horse to gain access to a company's internal network, Meer said.

With those pitfalls in mind, here are five lessons from the presentations at Black Hat.

1. Cloud offers less legal protection
Companies need to realise that data in the cloud is subject to a lower legal standard in terms of search and seizure. The government, or an attorney focused on discovery, may be able to subpoena the data without a search warrant.

Cloud providers are more concerned with protecting themselves and not the client, says Alex Stamos, a principal security consultant at iSec Partners, so don't expect the legalese in service agreements to favor your company.

"All of these (cloud-services) companies have very active and very well-trained legal departments," Stamos said. "And as a result, the agreements you agree to when you sign up for these services, basically promise you absolutely nothing."

If someone breaks in because of the provider's mistake, the client agrees not to hold the firm responsible. If there is a data loss because of a data center failure, the provider are not obligated to do anything for you, Stamos says.

It would be nice, he adds, if there were language that said they will attempt to help you.

"It would be nice if they had language in there that said if there is a security breach, we will try to give you a hand up," he says. "This seems to be where there is a disconnect between the cold heartless world of the lawyers, and the nice warm security (ethics) of the company."

2. You don't own the hardware
Companies who want to audit their providers and do their own testing need to remember that they don't own the hardware. Conducting a vulnerability scan or a penetration test requires the explicit permission of the cloud-service provider, Stamos warns. Otherwise, the client is hacking the providers' systems.

While some service agreements, such as Amazon's, specify that the client can conduct testing of their software running on the provider's systems, getting explicit permission is key, he says.

"The recommendation ... is that, if you are asked to pen-test applications in the cloud, they (the legal experts) recommend that you get permission from someone at the company," he said. "Because certainly, by the letter of the law the legal ownership of those machines is very important."

3. Strong policies and user education required
While cloud computing offers companies immense benefits, such as allow access to data from anywhere and removing maintenance headaches from the IT staff, the always-on service also means that phishing attacks that hit workers at home could threaten the company.

Thus, educating users about the dangers, not only to themselves but to their company, is key, said iSEC's Stamos.

"It is very difficult to teach all the non-technical users in your company about how to not be phished, but the fact of the matter is, with software-as-a-service, phishing attacks are going to be something that stops being a personal issue and starts becoming a enterprise-wide security issues," he said.

4. Don't trust machine instances
When using a virtual machine from a provider, such as the third-party instances created on Amazon's Elastic Cloud Computing (EC2) infrastructure, companies should never trust the system, says SensePost's Meer.

The company's researchers scanned a number of pre-configured instances and found authentication keys in the caches, credit-card data and the potential for malicious code to be hidden within the system. Yet, they found most of their customers did not consider the security implications of using a machine image created by the third-party developer.

"Some customers have based an entire authentication server off of pre-configured images," SensePost's Meer said.

Companies should either create their own images for internal use, or protect themselves technically and legally from potentially malicious third-party developers, Meer says.

5. Rethink your assumptions
In all cases, when considering security, corporate information-technology managers need to reconsider their assumptions in the cloud.

For example, when deploying an application to run on a computing instance in a virtualized data center, features that rely on random number generation will not necessarily work as expected. The problem is that virtual systems have much less entropy than physical ones, so random numbers could be guessable, iSEC's Stamos says.

"You need to consider the non-obvious," he says.


Share:

More from Techworld

More relevant IT news

Comments

Ben said: There are even more pitfalls when considering whether to use SaaS providers for your business Consider what would happen if you lost Internet connectivity to you provider or if the provider went bust I have done a longish write-up on these issues here httprobsonphblogindexph



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *