Risk
8/16/2012
01:00 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Don't Trust Cloud Security

Companies using cloud services need to verify, not trust, that a provider's controls will actually protect their data.

InformationWeek Green - August 20, 2012 InformationWeek Green
Download the entire August 20, 2012, issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.

Don't Trust Cloud Security

A common question about the cloud is whether it's more secure than a data center. But that's the wrong question to ask. Instead, customers and potential customers of public cloud services--whether infrastructure-as-a-service, platform-as-a-service, software-as-a-service, or some other as-a-service--need to ask whether a cloud provider's controls are sufficient to limit the risk a customer is willing to take with its data.

Most cloud providers say, "Trust us, we're secure." But you shouldn't take them at their word. A variety of options are available to assess a cloud provider's controls: basic questionnaires, standardized reports, technical audits, vulnerability scans, and full-blown penetration attempts that put a provider's security to the test.

You must assess the pros and cons of each approach and find the provider that takes the same (or better) care with your data as you would. It's not easy, but it's a lot better than cleaning up the mess left by a breach.

Get The Security You Need

Security is a top concern with the public cloud. Consider that 27% of respondents to the InformationWeek 2012 Cloud Security and Risk Survey say they have no plans to use public cloud services. And 48% of those respondents say their primary reason for not doing so is related to security, including fears of leaks of customer and proprietary data.

What about those who have adopted, plan to adopt, or are considering cloud services? They're worried, too. Security concerns easily trump other significant issues, including cloud performance, vendor lock-in, and the ability to recover data if a customer ends the service or a provider goes out of business, according to our survey. However, while security concerns are paramount, companies also see significant benefits to cloud adoption. When we asked why companies adopt or would adopt cloud computing, the top response was lower capital costs. A close second was the reduced burden on IT. Despite security concerns, companies are moving to the cloud for business reasons.

In an ideal world, companies would carefully inspect any public cloud provider they intend to use. But that doesn't seem to be the case among all our survey respondents. We asked respondents using or planning to use a provider to compare the provider's security controls with their own; 20% say the provider has superior controls, and another 20% say the provider's controls are on par with their own. However, 31% say they have no idea, because they haven't examined the controls in depth. In other words, they're going on blind faith.

But it doesn't have to be this way. At the very least, companies considering a cloud service should take advantage of the documentation that most providers make available to customers and potential customers. The most common is the Statement on Standards for Attestation Engagements 16, a set of auditing standards that replaced the well-known SAS 70. In an SSAE 16 report, a provider describes its security and technology controls, a third-party auditor reviews them, and the provider's management attests that the controls are in place.

To read the rest of the article,
Download the Aug. 20, 2012, issue of InformationWeek

Verify, Don't Trust

Our full report on cloud security is free with registration.

This report includes 31 pages of action-oriented analysis, packed with 25 charts. What you'll find:
  • Pros and cons of assessment tools
  • How to make the most of SSAE 16 and other reports
Get This And All Our Reports


Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0485
Published: 2014-09-02
S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.

CVE-2014-3861
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element.

CVE-2014-3862
Published: 2014-09-02
CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log.

CVE-2014-5076
Published: 2014-09-02
The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework.

CVE-2014-5136
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2_3 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.