5 Reasons Why The Cloud Is Still Not 100% Secure

5 Reasons Why The Cloud Is Still Not 100% Secure

5 Reasons Why The Cloud Is Still Not 100% Secure

In the last year, many big cloud companies have come under cyber attacks leading to outages and data losses

Cloud companies offer tremendous trade-offs to businesses in terms of flexibility of scale, better security, reduced manpower and maintenance cost. The majority of organizations and individuals are now convinced of the value of the cloud and are starting to migrate their data over their.  Now, it’s generally assumed that ones data is more secure within the cloud than it would if it were residing inside an unsecure desktop or server room. Unfortunately, this assumption is not true all the time.

If there is one area that is common between Google, Apple, Microsoft, Adobe, Spamhaus, American Express, Evernote, Facebook and Twitter it is the vulnerability of a cyber attack. All these organizations use cloud solutions for their business and have been victims of cyber attacks over the past year. Some of them have publicly acknowledged that data breaches have taken place during such attacks.

crime-cyber

Many cloud subscribers today wonder why these high profile tech companies are unable to keep their data safe & secure. Here are five such reasons why this may be the case:

1) Dynamic nature of business and inherent complexity

For an end user, the services offered by cloud companies are structured in very simple manner. But the structure inside the cloud is inherently complex. Multiple customers share physical databases, file servers, web servers and disk spaces. It is only logical and technical implementation and rarely the physical separation that keeps them apart.

Moreover, organizations’ business requirements and thus cloud needs keep changing. As a result, regular restructuring of security controls becomes essential. It’s a daunting task to maintain security controls for such a dynamic and complex environment at the cutting edge so that they cannot be exploited. Any slip-up there opens the door for hackers.

2) Cloud companies cannot own 100% of responsibility to make it secure

Organizations often overlook their own responsibilities when they offload a business domain to the cloud. While the service provider will do its best, it cannot ensure absolute safety at the subscriber’s end. Organizations themselves have to ensure that their own systems are patched; the access to the cloud is for authorized users, there are no stale users in the list and encryption keys are kept safe.

3) Increased sophistication of cyber attacks

In recent years, the hacker community is better organized, and they receive huge funding. In certain cases organizations and governments back them. The change is evident in the speed at which zero day vulnerabilities are ready for exploitation, the size of payload and comprehensive functionality available in malware. In the month of March DDoS attack on Spamhaus was able to generate 300 gigabits per second, something that was unheard of before. It is not easy to completely ward off such sophisticated and powerful attacks.

Notable cyber attacks in 2013

Courtesy (http://hackmageddon.com/2013-cyber-attacks-timeline-master-index)

Month Target Description
Feb 2013 Twitter Twitter announces in a blog post to have detected unusual access attempts to the accounts of 250,000 users. As a consequence the affected users’ accounts are reset.
Feb 2013 Facebook Hit by targeted attacks and admits to have been by a watering hole attack in January.
Feb 2013 Apple Apple admits to have been hit by the same sophisticated cyber attack that targeted Facebook. The culprit is iPhoneDevSDK, a forum compromised to serve a malware exploiting 0-day vulnerability.
Feb 2013 Microsoft With a scant statement on its Security Response Center blog, Microsoft admits to have been targeted by the same cyber attack that hit Facebook and Apple.
Feb 2013 American Express In name of #OpBlackSummer. TunisianCyberArmy1 AKA @TN_cyberarmy claims to have hacked American Express and to have stolen 2 Gb of data.
Mar 2013 Spamhaus Spamhaus is the victim of massive DDoS attack made with DNS Amplification and reaching a peak of 300 Gbps.
Apr 2013 WordPress Security analyst from at least three Web hosting services detect an ongoing attack using more than 90000 IP addresses to brute-force crack administrative credentials of vulnerable WordPress systems.
Apr 2013 Google The Bangladeshi hacker TiGER-M@TE defaces the Kenyan domain of Google (google.co.ke)
May 2013 Drupal Passwords for almost one million accounts on the drupal.org website are reset after hackers gain unauthorized access to sensitive use data exploiting vulnerability in an undisclosed third party application
Jul 2013 Apple Extended outage on its developer portal (developer.apple.com) due to an intruder. Apple does not rule out the possibility that some developers’ name, addresses may have been accessed.

4) Ascertaining jurisdiction is difficult in a virtual environment

Virtualization is amongst the founding principles of cloud computing. For a subscriber, it is not easy (at times impossible) to find out where exactly their data is stored. The location may be a different data centre in a different city, state or country altogether. Unless jurisdiction is ascertained it is difficult to take help of the law and precious time gets wasted. In case of a breach it becomes difficult to seek legal help and go after the culprits. This situation works to the advantage of the hacker community and many times they continue to remain at large.

5) Vulnerable users are everywhere

Any amount of security is not enough if there are vulnerable users in the system. Despite all those trainings and awareness programs, people make mistakes and thus expose the whole system to security risks. Use of easy or predictable passwords, sharing of accounts, falling prey to phishing / vishing attacks continues to happen. In the end, the hackers need just one small door to enter the fortified castle.

While cloud solutions are here to stay but so are the cyber attacks on them. Organizations and individuals must weigh pros and cons of cloud solutions before embracing it.

By Manoj Tiwari

(Image Source: Shutterstock)

About CloudTweaks

Established in 2009, CloudTweaks is recognized as one of the leading authorities in connected technology information and services.

We embrace and instill thought leadership insights, relevant and timely news related stories, unbiased benchmark reporting as well as offer green/cleantech learning and consultive services around the world.

Our vision is to create awareness and to help find innovative ways to connect our planet in a positive eco-friendly manner.

In the meantime, you may connect with CloudTweaks by following and sharing our resources.

View All Articles

Sorry, comments are closed for this post.

Comic
In The Fast Lane: Connected Car Hacking A Big Risk

In The Fast Lane: Connected Car Hacking A Big Risk

Connected Car Hacking Researchers and cybersecurity experts working hard to keep hackers out of the driver’s seat. Modern transportation has come a million miles, and most all of today’s vehicles are controlled entirely by digital technology. Millions of drivers are not aware that of the many devices in their digital arsenal, the most complex of…

Having Your Cybersecurity And Eating It Too

Having Your Cybersecurity And Eating It Too

The Catch 22 The very same year Marc Andreessen famously said that software was eating the world, the Chief Information Officer of the United States was announcing a major Cloud First goal. That was 2011. Five years later, as both the private and public sectors continue to adopt cloud-based software services, we’re interested in this…

Building a Data Security Strategy – More Important Than Ever

Building a Data Security Strategy – More Important Than Ever

Data Security Strategy Article sponsored by SAS Software and Big Data Forum Security and privacy have been an integral concern of the IT industry since its very inception, but as it expands through web-based, mobile, and cloud-based applications, access to data is magnified as are the threats of illicit penetration. As enterprises manage vast quantities…

Pitney Bowes Selects Aria Systems for Billing on the New Commerce Cloud

Pitney Bowes Selects Aria Systems for Billing on the New Commerce Cloud

Top-Ranked Cloud Billing Company Enables Greater Speed and Frictionless Billing for Unparalleled Customer Experience San Francisco, CA – August 23, 2016 – Aria Systems, which helps enterprises grow subscription and usage-based revenue, today announced that Pitney Bowes has selected Aria’s cloud-based monetization platform as the key billing and monetization component of their new Commerce Cloud…

The Golden Age of Wearable Technology

The Golden Age of Wearable Technology

The Golden Age One of the biggest fads in the technology sector right now is wearable tech. From Smartwatches that let you check your emails, chat with friends and search the web, to fitness accessories that monitor your heart rate and your sleep patterns, this is truly the Golden Age of wearable technology. But some…

Staying on Top of Your Infrastructure-as-a-Service Security Responsibilities

Staying on Top of Your Infrastructure-as-a-Service Security Responsibilities

Infrastructure-as-a-Service Security It’s no secret many organizations rely on popular cloud providers like Amazon and Microsoft for access to computing infrastructure. The many perks of cloud services, such as the ability to quickly scale resources without the upfront cost of buying physical servers, have helped build a multibillion-dollar cloud industry that continues to grow each…

Why Security Practitioners Need To Apply The 80-20 Rules To Data Security

Why Security Practitioners Need To Apply The 80-20 Rules To Data Security

The 80-20 Rule For Security Practitioners  Everyday we learn about yet another egregious data security breach, exposure of customer data or misuse of data. It begs the question why in this 21st century, as a security industry we cannot seem to secure our most valuable data assets when technology has surpassed our expectations in other regards.…

The Cancer Moonshot: Collaboration Is Key

The Cancer Moonshot: Collaboration Is Key

Cancer Moonshot In his final State of the Union address in January 2016, President Obama announced a new American “moonshot” effort: finding a cure for cancer. The term “moonshot” comes from one of America’s greatest achievements, the moon landing. If the scientific community can achieve that kind of feat, then surely it can rally around…

Are CEO’s Missing Out On Big Data’s Big Picture?

Are CEO’s Missing Out On Big Data’s Big Picture?

Big Data’s Big Picture Big data allows marketing and production strategists to see where their efforts are succeeding and where they need some work. With big data analytics, every move you make for your company can be backed by data and analytics. While every business venture involves some level of risk, with big data, that risk…

The Rise Of BI Data And How To Use It Effectively

The Rise Of BI Data And How To Use It Effectively

The Rise of BI Data Every few years, a new concept or technological development is introduced that drastically improves the business world as a whole. In 1983, the first commercially handheld mobile phone debuted and provided workers with an unprecedented amount of availability, leading to more productivity and profits. More recently, the Cloud has taken…

Shadow IT To Remain A Focus For Both Cloud Vendors And CIOs

Shadow IT To Remain A Focus For Both Cloud Vendors And CIOs

Shadow IT To Remain A Focus Shadow IT, a phenomenon defined as building internal IT systems without the official organizational approval has been a growing concern for CIOs over the last few years. In 2015, it climbed to the top of the list of the emerging IT threats, with as much as 83% CIOs reporting…

Are Women Discriminated Against In The Tech Sector?

Are Women Discriminated Against In The Tech Sector?

Women Discriminated Against In Tech Sector It is no secret that the tech industry is considered sexist since most women are paid less than men; there are considerably fewer women in tech jobs; and generally men get promoted above women. Yet the irony is twofold. Firstly, there is an enormous demand for employees with skills…

Cloud Computing Myths That SMBs Should Know

Cloud Computing Myths That SMBs Should Know

Cloud Computing and SMBs Cloud Computing is the hottest issue among IT intellects of Small and Medium Businesses (SMBs). Like any other computer-orientated technology, Cloud Computing has some misconceptions and myths that often kick-start arguments among the two opposing groups: Cloud Supporters and Cloud Opponents. Both of these groups have their own ideology and reasons…

Cloud Infographic – What Is The Internet of Things?

Cloud Infographic – What Is The Internet of Things?

What Is The Internet of Things? “We’re still in the first minutes of the first day of the Internet revolution.”  – Scott Cook The Internet of Things (IOT) and Smart Systems are based on the notions of Sensors, Connectivity, People and Processes. We are creating a new world to view and measure anything around us through…

Cloud Computing – A Requirement For Greater Innovation

Cloud Computing – A Requirement For Greater Innovation

Cloud Computing Innovation Sao Paulo, Brazil has had trouble with both energy and water supplies as of late. Despite it is the rainy period. Unfortunately Sao Paulo is very dependent on its rain as a majority of its power is generated from large dams. No water, no energy. Difficult situation for a city of some…

Disaster Recovery – A Thing Of The Past!

Disaster Recovery – A Thing Of The Past!

Disaster Recovery  Ok, ok – I understand most of you are saying disaster recovery (DR) is still a critical aspect of running any type of operations. After all – we need to secure our future operations in case of disaster. Sure – that is still the case but things are changing – fast. There are…