Risk
7/20/2010
07:41 PM
Keith Ferrell
Keith Ferrell
Slideshows
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Slideshow: Cloud Security Pros And Cons

Securing your business in the cloud can offer substantial savings and resources balanced by large and unexpected risks. In this review of cloud security silver linings and storms warnings, we look at some of the brightest and darkest security clouds.
Previous
10 of 13
Next


The cloud offers distributed resources, but as a general principle it's good to bear in mind that those resources are no more or less invulnerable than any other resources. Cloud-based companies can suffer outages the same as ground-bound ones -- precisely because cloud-based firms, of necessity, are bound to the same sorts of resources as everyone else. Servers, connections, software, personnel can all be sources or causes of outages. Too much confidence in the cloud can make even occasional, brief outages a source of outrage, as witness recent Gmail glitches. Before committing to a cloud service or provider, be sure they've provided you with documentation detailing the availability rates they guarantee (less than 99+% is unacceptable), their remedies and remediation strategies should an outage occur and their responsibility for any liabilities your business might incur as a consequence of a cloud-outage.

Previous
10 of 13
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web