Risk
8/16/2012
01:00 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Don't Trust Cloud Security

Companies using cloud services need to verify, not trust, that a provider's controls will actually protect their data.

InformationWeek Green - August 20, 2012 InformationWeek Green
Download the entire August 20, 2012, issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.

Don't Trust Cloud Security

A common question about the cloud is whether it's more secure than a data center. But that's the wrong question to ask. Instead, customers and potential customers of public cloud services--whether infrastructure-as-a-service, platform-as-a-service, software-as-a-service, or some other as-a-service--need to ask whether a cloud provider's controls are sufficient to limit the risk a customer is willing to take with its data.

Most cloud providers say, "Trust us, we're secure." But you shouldn't take them at their word. A variety of options are available to assess a cloud provider's controls: basic questionnaires, standardized reports, technical audits, vulnerability scans, and full-blown penetration attempts that put a provider's security to the test.

You must assess the pros and cons of each approach and find the provider that takes the same (or better) care with your data as you would. It's not easy, but it's a lot better than cleaning up the mess left by a breach.

Get The Security You Need

Security is a top concern with the public cloud. Consider that 27% of respondents to the InformationWeek 2012 Cloud Security and Risk Survey say they have no plans to use public cloud services. And 48% of those respondents say their primary reason for not doing so is related to security, including fears of leaks of customer and proprietary data.

What about those who have adopted, plan to adopt, or are considering cloud services? They're worried, too. Security concerns easily trump other significant issues, including cloud performance, vendor lock-in, and the ability to recover data if a customer ends the service or a provider goes out of business, according to our survey. However, while security concerns are paramount, companies also see significant benefits to cloud adoption. When we asked why companies adopt or would adopt cloud computing, the top response was lower capital costs. A close second was the reduced burden on IT. Despite security concerns, companies are moving to the cloud for business reasons.

In an ideal world, companies would carefully inspect any public cloud provider they intend to use. But that doesn't seem to be the case among all our survey respondents. We asked respondents using or planning to use a provider to compare the provider's security controls with their own; 20% say the provider has superior controls, and another 20% say the provider's controls are on par with their own. However, 31% say they have no idea, because they haven't examined the controls in depth. In other words, they're going on blind faith.

But it doesn't have to be this way. At the very least, companies considering a cloud service should take advantage of the documentation that most providers make available to customers and potential customers. The most common is the Statement on Standards for Attestation Engagements 16, a set of auditing standards that replaced the well-known SAS 70. In an SSAE 16 report, a provider describes its security and technology controls, a third-party auditor reviews them, and the provider's management attests that the controls are in place.

To read the rest of the article,
Download the Aug. 20, 2012, issue of InformationWeek

Verify, Don't Trust

Our full report on cloud security is free with registration.

This report includes 31 pages of action-oriented analysis, packed with 25 charts. What you'll find:
  • Pros and cons of assessment tools
  • How to make the most of SSAE 16 and other reports
Get This And All Our Reports


Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.