Welcome!

Cloud Security Authors: Liz McMillan, Elizabeth White, Pat Romanski, Jose Diaz, Derek Weeks

Related Topics: @CloudExpo, Open Source Cloud, Containers Expo Blog, Cloud Security, SDN Journal, @DevOpsSummit

@CloudExpo: Blog Feed Post

Top Cloud Security Threats

To say that cloud security for cloud computing is gaining traction would be the understatement of our era

To say that cloud security for cloud computing is gaining traction would be the understatement of our era.  Whether in public clouds, private clouds, or hybrid scenarios – it seems like everyone is in the cloud.  Healthcare providers, eCommerce, disaster recovery services, data storage . . . the types of cloud services available seem to cover every base.  What would Darwin think about his “Survival of the Fittest” evolving from animal species to businesses who take advantage of the flexibility, elasticity, and cost-effectiveness of cloud computing?

cloud security threats cloud security breaches Cloud Security  cloud security threats Top Cloud Security ThreatsBut, there are dangers in the cloud computing jungle and cloud security measures must be put in place to eliminate and resolve them.  According to the Cloud Security Alliance, three types of threats have worsened between 2010 and today.

  1. Data Breaches
  2. Data Loss
  3. Account or Service Traffic Hijacking

Let’s explore how proper cloud security can protect you from these top threats.

1. Data Breaches

The attack can originate from many sources:

  • Malevolent hackers
  • Fierce competitors
  • Insiders: employees, subcontractor, vendors, etc.

Regardless of the origin, the attack must be stopped before it causes damage.

Of course, you must put in place cloud security measures like anti-virus, firewalls, strict password policies, and accurate logs.  But hackers can be deviously conniving.  In November 2012, researchers from the University of North Carolina, the University of Wisconsin and RSA Corporation released a paper describing how a virtual machine could use side channel timing information to extract private cryptographic keys being used in other virtual machines on the same physical server. Whether your potential attackers are as sophisticated, there are ways to stop them from causing damage.

Encrypting your data, for example, is a security measure you MUST insist on.  If you do it right, even if a breach does occur, your data will not be readable – and will therefore not be usable.

Encrypting data is relatively easy.  Adhere to best practices like AES-256 and SHA-2. These techniques provide the best assurance that data has not been tampered with.  SSL/TLS must always be enabled.  IPsec communications should be allowed.

But once your data is encrypted, the cloud security challenge is to ensure the data cannot be decrypted.  If your data is encrypted well, but the encryption keys are also accessible to attackers (stored in the same location or stored with a cloud provider, for example), the encryption does not matter.

The best practice here is to use split key management and homomorphic key encryption.  The first splits your encryption key in parts.  One part is handled by the cloud security application and one part is always handled only by you.  BOTH parts are required to decrypt your data.  This way, even if one part is used illicitly, your data cannot be breached.  The second measure, homomorphic key encryption, is the only way to ensure that the key itself is encrypted, even while in use.

By using these two best practices, your cryptographic keys cannot be compromised.

2. Data Loss

Almost as terrifying as your data being accessed by outsiders (or insiders gone bad) is losing your data.  Of course, losing data doesn’t allow anyone else to use it, but it also does not allow you to use it.  Can your business perform without its data?

Data loss can occur as a result of virus or hacker attack, but it can also come from an accidental deletion by a cloud provider, a natural disaster like an earthquake, fire, flood, tornado…

Best practice here, of course, is backup.  You could back up your data on physical devices outside of the cloud, but then you lose a lot of the benefits of using the cloud.  Opting for an online backup and disaster recovery protocol is a great solution, but it opens another possible entry point for attackers (see the data breach section, above).

Solving this challenge does not have to be . . . well, challenging.  The same best practices we dexcribed above apply here as well.  Encrypt data before uploading or transferring it to a cloud backup or cloud disaster recovery platform.  And always use split key management and homomorphic key encryption.

3. Account or Service Traffic Hijacking

Phishing, fraud, and exploitation of software vulnerabilities can cause your credentials to be stolen.  With stolen credentials, attackers can often access critical areas of deployed cloud computing services, allowing them to compromise the confidentiality, integrity and availability of those services.  In April 2010, Amazon experienced a Cross-Site Scripting (XSS) bug that allowed attackers to hijack credentials from the site. Even Amazon is a target!

How do you eliminate the risk of your credentials being stolen?  Easy!  Don’t trust anyone with them.  Your encryption keys should always be under your own control.  Do not allow your cloud provider to control your keys.  Ever.

Another important factor to consider here is not avoiding such hijacking, but also mitigating the damages in case it occurs.  A way to do this is to segment your encryption.  Each encryption project can contain as much (or as little) data as required, across multiple disks, databases, file servers and object storage.

Conclusion: Top Threats and Top Solutions

Yes, there are threats to operating in the cloud (let’s face it: there are threats to operating any business), but with current technologies offering ways to thwart the top threats of data breaches, data loss, and hijacking, the benefits of cloud computing far outweigh the risks.

The time to institute strong cloud security and encryption is now – before an attack.  Don’t think that it cannot (or will not) happen to you because you are too powerful or too big (or too small).  It happened to Amazon.  It happens to businesses every day.  And these types of catastrophes have the ability to exhaust budgets, destroy reputations, and in some cases – eradicate a business.


The post Top Cloud Security Threats appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@ThingsExpo Stories
What a difference a year makes. Organizations aren’t just talking about IoT possibilities, it is now baked into their core business strategy. With IoT, billions of devices generating data from different companies on different networks around the globe need to interact. From efficiency to better customer insights to completely new business models, IoT will turn traditional business models upside down. In the new customer-centric age, the key to success is delivering critical services and apps wit...
SYS-CON Events announced today BZ Media LLC has been named “Media Sponsor” of SYS-CON's 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. BZ Media LLC is a high-tech media company that produces technical conferences and expositions, and publishes a magazine, newsletters and websites in the software development, SharePoint, mobile development and Commercial Drone markets.
WebRTC is bringing significant change to the communications landscape that will bridge the worlds of web and telephony, making the Internet the new standard for communications. Cloud9 took the road less traveled and used WebRTC to create a downloadable enterprise-grade communications platform that is changing the communication dynamic in the financial sector. In his session at @ThingsExpo, Leo Papadopoulos, CTO of Cloud9, will discuss the importance of WebRTC and how it enables companies to fo...
SYS-CON Events announced today TechTarget has been named “Media Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. TechTarget is the Web’s leading destination for serious technology buyers researching and making enterprise technology decisions. Its extensive global networ...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York and Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty ...
The essence of data analysis involves setting up data pipelines that consist of several operations that are chained together – starting from data collection, data quality checks, data integration, data analysis and data visualization (including the setting up of interaction paths in that visualization). In our opinion, the challenges stem from the technology diversity at each stage of the data pipeline as well as the lack of process around the analysis.
The 19th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Containers, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit y...
Internet of @ThingsExpo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with the 19th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world and ThingsExpo New York Call for Papers is now open.
SYS-CON Events announced today that ContentMX, the marketing technology and services company with a singular mission to increase engagement and drive more conversations for enterprise, channel and SMB technology marketers, has been named “Sponsor & Exhibitor Lounge Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York City, New York. “CloudExpo is a great opportunity to start a conversation with new prospects, but what happens after the...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, will provide an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life ...
There are several IoTs: the Industrial Internet, Consumer Wearables, Wearables and Healthcare, Supply Chains, and the movement toward Smart Grids, Cities, Regions, and Nations. There are competing communications standards every step of the way, a bewildering array of sensors and devices, and an entire world of competing data analytics platforms. To some this appears to be chaos. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will discuss the vast to...
SYS-CON Events announced today that Enzu, a leading provider of cloud hosting solutions, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Enzu’s mission is to be the leading provider of enterprise cloud solutions worldwide. Enzu enables online businesses to use its IT infrastructure to their competitive advantage. By offering a suite of proven hosting and management services, Enzu wants companies to foc...
Customer experience has become a competitive differentiator for companies, and it’s imperative that brands seamlessly connect the customer journey across all platforms. With the continued explosion of IoT, join us for a look at how to build a winning digital foundation in the connected era – today and in the future. In his session at @ThingsExpo, Chris Nguyen, Group Product Marketing Manager at Adobe, will discuss how to successfully leverage mobile, rapidly deploy content, capture real-time d...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, wh...
IoT generates lots of temporal data. But how do you unlock its value? How do you coordinate the diverse moving parts that must come together when developing your IoT product? What are the key challenges addressed by Data as a Service? How does cloud computing underlie and connect the notions of Digital and DevOps What is the impact of the API economy? What is the business imperative for Cognitive Computing? Get all these questions and hundreds more like them answered at the 18th Cloud Expo...
SYS-CON Events announced today that 24Notion has been named “Bronze Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. 24Notion is full-service global creative digital marketing, technology and lifestyle agency that combines strategic ideas with customized tactical execution. With a broad understand of the art of traditional marketing, new media, communications and social influence, 24Notion uniquely understands how to con...
Whether your IoT service is connecting cars, homes, appliances, wearable, cameras or other devices, one question hangs in the balance – how do you actually make money from this service? The ability to turn your IoT service into profit requires the ability to create a monetization strategy that is flexible, scalable and working for you in real-time. It must be a transparent, smoothly implemented strategy that all stakeholders – from customers to the board – will be able to understand and comprehe...
The demand for organizations to expand their infrastructure to multiple IT environments like the cloud, on-premise, mobile, bring your own device (BYOD) and the Internet of Things (IoT) continues to grow. As this hybrid infrastructure increases, the challenge to monitor the security of these systems increases in volume and complexity. In his session at 18th Cloud Expo, Stephen Coty, Chief Security Evangelist at Alert Logic, will show how properly configured and managed security architecture can...
When it comes to IoT in the enterprise, namely the commercial building and hospitality markets, a benefit not getting the attention it deserves is energy efficiency, and IoT's direct impact on a cleaner, greener environment when installed in smart buildings. Until now clean technology was offered piecemeal and led with point solutions that require significant systems integration to orchestrate and deploy. There didn't exist a 'top down' approach that can manage and monitor the way a Smart Buildi...
Korean Broadcasting System (KBS) will feature the upcoming 18th Cloud Expo | @ThingsExpo in a New York news documentary about the "New IT for the Future." The documentary will cover how big companies are transmitting or adopting the new IT for the future and will be filmed on the expo floor between June 7-June 9, 2016, at the Javits Center in New York City, New York. KBS has long been a leader in the development of the broadcasting culture of Korea. As the key public service broadcaster of Korea...