Risk
8/16/2012
01:00 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Don't Trust Cloud Security

Companies using cloud services need to verify, not trust, that a provider's controls will actually protect their data.

InformationWeek Green - August 20, 2012 InformationWeek Green
Download the entire August 20, 2012, issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.

Don't Trust Cloud Security

A common question about the cloud is whether it's more secure than a data center. But that's the wrong question to ask. Instead, customers and potential customers of public cloud services--whether infrastructure-as-a-service, platform-as-a-service, software-as-a-service, or some other as-a-service--need to ask whether a cloud provider's controls are sufficient to limit the risk a customer is willing to take with its data.

Most cloud providers say, "Trust us, we're secure." But you shouldn't take them at their word. A variety of options are available to assess a cloud provider's controls: basic questionnaires, standardized reports, technical audits, vulnerability scans, and full-blown penetration attempts that put a provider's security to the test.

You must assess the pros and cons of each approach and find the provider that takes the same (or better) care with your data as you would. It's not easy, but it's a lot better than cleaning up the mess left by a breach.

Get The Security You Need

Security is a top concern with the public cloud. Consider that 27% of respondents to the InformationWeek 2012 Cloud Security and Risk Survey say they have no plans to use public cloud services. And 48% of those respondents say their primary reason for not doing so is related to security, including fears of leaks of customer and proprietary data.

What about those who have adopted, plan to adopt, or are considering cloud services? They're worried, too. Security concerns easily trump other significant issues, including cloud performance, vendor lock-in, and the ability to recover data if a customer ends the service or a provider goes out of business, according to our survey. However, while security concerns are paramount, companies also see significant benefits to cloud adoption. When we asked why companies adopt or would adopt cloud computing, the top response was lower capital costs. A close second was the reduced burden on IT. Despite security concerns, companies are moving to the cloud for business reasons.

In an ideal world, companies would carefully inspect any public cloud provider they intend to use. But that doesn't seem to be the case among all our survey respondents. We asked respondents using or planning to use a provider to compare the provider's security controls with their own; 20% say the provider has superior controls, and another 20% say the provider's controls are on par with their own. However, 31% say they have no idea, because they haven't examined the controls in depth. In other words, they're going on blind faith.

But it doesn't have to be this way. At the very least, companies considering a cloud service should take advantage of the documentation that most providers make available to customers and potential customers. The most common is the Statement on Standards for Attestation Engagements 16, a set of auditing standards that replaced the well-known SAS 70. In an SSAE 16 report, a provider describes its security and technology controls, a third-party auditor reviews them, and the provider's management attests that the controls are in place.

To read the rest of the article,
Download the Aug. 20, 2012, issue of InformationWeek

Verify, Don't Trust

Our full report on cloud security is free with registration.

This report includes 31 pages of action-oriented analysis, packed with 25 charts. What you'll find:
  • Pros and cons of assessment tools
  • How to make the most of SSAE 16 and other reports
Get This And All Our Reports


Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-5084
Published: 2015-08-02
The Siemens SIMATIC WinCC Sm@rtClient and Sm@rtClient Lite applications before 01.00.01.00 for Android do not properly store passwords, which allows physically approximate attackers to obtain sensitive information via unspecified vectors.

CVE-2015-5352
Published: 2015-08-02
The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time ...

CVE-2015-5537
Published: 2015-08-02
The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.

CVE-2015-5600
Published: 2015-08-02
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumptio...

CVE-2015-1009
Published: 2015-07-31
Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!