THE FUTURE FOR CYBER SECURITY

A study entitled, State of Cyber Security 2017, performed by ISACA (Information Systems Audit and Control Association), suggested that cyber security staff are becoming increasingly difficult to find in such a rapidly expanding and evolving field. The report was based on a survey of 633 cyber security specialists across North America and Europe, with 27% stating that they were unable to fill open cyber security positions in their businesses and another 14% unsure as to whether they would ever fill those positions...

Cloud Security Issues – Is The Cloud Insecure?

cloud security issues

Cloud Security  Issues – Is The Cloud Insecure?

Cloud security issues are a top concern of every CIO’s mind. Apparently some people even consider that cloud risks outweigh cloud benefits.  Unfortunately, an overzealous approach to cloud security can lead to arguments that detract from the real issues, with little to no analysis of the specific problems at hand.

Cloud security issues

  • Separation of duties Your existing company probably has separate application, networking and platform teams. The cloud may force a consolidation of these user groups. For example, in many companies the EC2 administrators are application programmers, have access to Security Groups (firewall) and can also spin up and take down virtual servers.
  • Home access to your servers Corporate environments are usually administered on-premise or through a VPN with two-factor authentication. Strict access controls are usually forgotten for the cloud, allowing administrators to access your cloud’s control panel from home and make changes as they see fit. Note further that cloud access keys/accounts may remain available to people who leave or get fired from your company, making home access an even bigger concern…
  • Difficulty in validating security Corporation are used to stringent access and audit controls for on-premise services, but maintaining and validating what’s happening in the cloud can become a secondary concern. This can lead some companies to lose track of the exact security posture of their cloud environments.
  • Appliances and specialized tools do not support the cloud Specialized tools may not be able to go into the cloud. For example, you may have Network Intrusion Detection appliances sitting in front of on-premise servers, and you will not be able to move such specialized boxes into the cloud. A move to Virtual Appliances may make this less of an issue for future cloud deployments.
  • Legislation and Regulations Cross border issues are a big challenge in the cloud. Privacy concerns may forbid certain user data from leaving your country, while foreign legislation may become an unneeded new challenge for your business. For example, a European business running systems on American soil may open themselves up to Patriot Act regulations.
  • Organizational processes Who has access to the cloud and what can they do? Can someone spin up an Extra Large machine and install their own software? How do you backup and restore data? Will you start replicating processes within your company simply because you’ve got a separate cloud infrastructure? Many companies are simply not familiar enough with the cloud to create the processes necessary for secure cloud operations.
  • Auditing challenges Any auditing activities that you normally undertake may be complicated if data is in the cloud. A good example is PCI — Can you actually prove that CC data is always within your control, even if it’s hosted outside of your environment somewhere in the cloud ether?
  • Public/private connectivity is a challenge Do you ever need to mix data between your public and private environments? It can become a challenge to send data between these two environments, and to do so securely. New technologies for cloud impedance matching may help.
  • Monitoring and logging You will likely have central systems monitoring your internal environment and collecting logs from your servers. Will you be able to achieve those same monitoring and log collection activities if you run servers off-premise?
  • Penetration testing Some companies run periodic penetration testing activities directly on public infrastructure. Cloud environments may not be as amenable to ‘hacking’ type activities from taking place on cloud infrastructure that they provide.

By Simon Ellis,

Simon is the owner of LabSlice, a new startup that allows companies to distribute Virtual Demos using the cloud.

About CloudTweaks

Established in 2009, CloudTweaks is recognized as one of the leading authorities in cloud connected technology information and services.

We embrace and instill thought leadership insights, relevant and timely news related stories, unbiased benchmark reporting as well as technology related infographics and comics.

Syndicated Technology News

RiskVision Named 2017 Cybersecurity Breakthrough Awards Winner

By CloudBuzz | September 20, 2017

RiskVision Named 2017 Cybersecurity Breakthrough Awards Winner for Enterprise Risk Management (ERM) Software of the Year SUNNYVALE, CA–(Marketwired – Sep 20, 2017) – RiskVision, the enterprise risk intelligence company formerly known as Agiliance, today announced that the RiskVision platform has…

Amazon working on ‘smart glasses’ as its first wearable device: FT

By CloudBuzz | September 20, 2017

(Reuters) – Amazon.com Inc is working on its first wearable device – a pair of ‘smart glasses’, the Financial Times reported on Wednesday. The device, designed like a regular pair of spectacles, will allow Amazon’s digital assistant Alexa to be…

Cloudflare Collaborates with Google Cloud to Fund Developer Innovation

By CloudBuzz | September 19, 2017

Collaboration Offers Developers $100,000 in Cloud Platform Credits SAN FRANCISCO, Sept. 19, 2017 (GLOBE NEWSWIRE) — Cloudflare, the leading Internet performance and security company, is collaborating with Google Cloud to help support developer innovation on the Cloudflare Apps Platform. Starting today,…

Cisco Expands Learning Portfolio with New Business Architecture Training and Certifications

By CloudBuzz | September 19, 2017

New Business Architecture Training and Certifications Expanded Portfolio Accelerates Business Transformation by Addressing Critical Talent Needs SAN JOSE, CA–(Marketwired – Sep 19, 2017) – Cisco (NASDAQ: CSCO) today announced it is expanding its learning portfolio with new business architecture training and…

2017 Ponemon Institute Study Finds SMBs are a Huge Target for Hackers

By CloudBuzz | September 19, 2017

Negligent Employees and Poor Password Policies are the Weakest Links Negligent employees are the #1 root cause behind data breaches across North America and the UK Ransomware is hitting SMBs hard with more than 50% experiencing an attack Attacks are becoming costlier…

Virtual Reality: Coming Soon to a Cubicle Near You?

By CloudBuzz | September 18, 2017

Cisco invites customers to experiment with Cisco Spark in VR SAN JOSE, CA–(Marketwired – Sep 18, 2017) – Cisco (NASDAQ: CSCO) thinks it is only a matter of time before virtual reality makes a major impact on all sorts of industries…