July 10, 2017

Malware Will Cripple Cloud And IoT Infrastructure If Not Contained

By Junaid Islam

The Malware Cloud Concern This year we’ve had two cyber attacks in which malware was used to cripple government computer systems. Unless counter-measures are deployed, similar malware attacks can be used against cloud and IoT infrastructure. 2017 started with the Shamoon2 cyber attack on Saudi Arabian government systems.  The attack wiped out data on 50,000 […]

The Malware Cloud Concern

This year we’ve had two cyber attacks in which malware was used to cripple government computer systems. Unless counter-measures are deployed, similar malware attacks can be used against cloud and IoT infrastructure.

2017 started with the Shamoon2 cyber attack on Saudi Arabian government systems.  The attack wiped out data on 50,000 compute devices and servers.  More recently a cyber attack against the Ukraine government called NotPetya wiped out data as well as disabled energy management systems.

The destructive power of both malware attacks derived from the difficulty to patch large numbers of compute devices. Thus while the attacks were not “zero-day”, cyber attackers created weapons-grade malware by adding the ability to laterally search for vulnerable systems.

For organizations migrating to the cloud or deploying IoT infrastructure the recent cyber attacks should be a wake up call to the destructive power of malware that can autonomously hunt for targets!

The increasing number of personal compute devices and supply chain partners connecting to enterprise clouds makes universal endpoint protection impossible. Subsequently, malware can find and propagate from infected compute devices to cloud-based applications. Once infected, hosted apps can become malware super spreaders. However as bad as the risk of malware is to enterprises, the risk to IoT systems is even greater.

The new generation of IoT devices has the ability to autonomously communicate locally and globally.  As IoT devices come in hundreds of different variations with specialized software modules, patching IoT systems is far more difficult than personal compute devices.

Infected IoT devices can spread malware from autonomous vehicles and energy management systems to consumer products and cloud computers – and then back again.  A malware attack on billons of networked IoT devices would take months or years to correct.

Malware Cloud Concern

Fortunately there is a proven counter-measure to weapons-grade malware that is a Software Defined Perimeter (SDP) based application layer access control solution.

Vidder developed an application layer access control solution under the PrecisionAccess brand two years ago.  At that time enterprises with high value intellectual property wanted a counter-measure agianst the office of Personnel Management (OPM) cyber attack.

The OPM attack utilized stolen credentials in combination with lateral movement to find classified data that was hidden deep in the data center.  To ensure similar attacks didn’t happen again, Vidder developed an access solution that verified identity (to stop credential theft) and then provisioned an application layer tunnel (to stop lateral movement).

Application layer access control protects cloud assets by ensuring only authorized devices are granted connectivity.  Only whitelisted applications on the user’s device are allowed access to a specific port on the application server.  If a hosted app should become infected, application layer connectivity ensures that malware can’t spread from the cloud back to the user’s device.

Similarly application layer access control can protect IoT infrastructure from lateral movement malware by only allowing authorized process-to-process connectivity.  Subsequently malware cannot re-task IoT devices or backend cloud infrastructure.

With cyber attackers now developing malware that can hunt for vulnerable compute devices, we must deploy proven counter-measures to protect cloud and IoT assets.  Application layer access control, such as Vidder’s PrecisionAccess, is a proven counter-measure that should be deployed before disaster strikes.

By Junaid Islam

Junaid Islam

Metasploit-Penetration-Testing-Software-Pen-Testing-Security

Leading Cloud Vulnerability Scanners

Vulnerability Scanners Cyber security vulnerabilities are a constant nuisance and it certainly doesn’t help with [...]
Read more

Lambda Cold Starts: What They Are and How to Fix Them

What Are Lambda Cold Starts? Lambda cold starts occur when AWS Lambda has to initialize [...]
Read more

A.I. is Not All It’s Cracked Up to Be…At Least Not Yet!

Exploring AI’s Potential: The Gap Between Aspiration and Reality Recently Samsung releases its new Galaxy [...]
Read more
Steve Prentice

Episode 19: Why AWS Needs to Become Opinionated about FinOps

On today’s episode of the CloudTweaks podcast, Steve Prentice chats with Rahul Subramaniam, CEO at CloudFix [...]
Read more
Jeff DeVerter

Charting the Course: An Interview with Rackspace’s Jeff DeVerter on AI and Cloud Innovation

Rackspace’s Jeff DeVerter on AI & Cloud Innovation In an insightful conversation with CloudTweaks, Jeff [...]
Read more

Exploring SaaS Directories: The Path to Optimal Software Selection

Exploring the Landscape of SaaS Directories SaaS directories are vital in today’s digital age, serving [...]
Read more

SPONSORS

Interviews and Thought Leadership

AI at the Gate: Navigating the Future of Cybersecurity with SonicWall’s Bobby Cornwell

Navigating the Future of Cybersecurity In the face of the digital age’s advancements, AI’s role in cybersecurity presents both innovation and challenges. CloudTweaks welcomes a Q&A with Bobby Cornwell, Vice [...]
Read more
Jeff DeVerter

Charting the Course: An Interview with Rackspace’s Jeff DeVerter on AI and Cloud Innovation

Rackspace’s Jeff DeVerter on AI & Cloud Innovation In an insightful conversation with CloudTweaks, Jeff DeVerter, a seasoned IT and technology veteran with over 25 years of experience, sheds light [...]
Read more

Leveraging Artificial Intelligence in Insurance Claims Analytics Software Development

Enhancing Insurance Claims Analysis with AI Technology Nowadays, digital technology affects all aspects of our everyday lives, and the insurance [...]
Read more

Digital Solutions for Legal Matchmaking: The Role of AI in Connecting Clients with Lawyers

The Role of AI in Connecting Clients with Lawyers The legal industry is transforming significantly in today’s digital age, embracing [...]
Read more

Gartner Predicts Solid Growth for Information Security, Reaching $287 Billion by 2027

AI continues to become more weaponized, with nation-state attackers and cybercrime gangs experimenting with LLMs and gen AI-based attack tradecraft. [...]
Read more

SPONSOR PARTNER

Explore top-tier education with exclusive savings on online courses from MIT, Oxford, and Harvard through our e-learning sponsor. Elevate your career with world-class knowledge. Start now!
© 2024 CloudTweaks. All rights reserved.