Perimeter
2/19/2013
11:02 AM
Connect Directly
RSS
E-Mail
50%
50%

5 Overlooked Cloud-Based Compliance Dangers

Fully understanding risks helps avoid expensive surprises later

We all know the use of cloud-based resources is becoming increasingly common in organizations of all sizes. This can range from large-scale systems to small software-as-a-service tools. While convenient and sometimes quite cost-effective, this trend creates several compliance and data security dangers that are often overlooked. Here are five of the most serious issues:

1. Legal Liability: Whenever access to shared resources is constantly changing hands, ensuring the company is secure and compliant is like conducting an orchestra with musicians in different rooms. It takes extra effort to keep everyone on the same beat, otherwise the song (or security) falls apart. This applies with all shared resources, including hardware, software, or storage mediums.

2. Third-Party Validation: Unless you have complete control of your cloud-based assets, it is unlikely you can do much about how a cloud provider secures the data in their care. There are many data centers that make great efforts to obtain compliance certifications; however, you will probably be acting on faith that they remain secure and compliant.

3. Disclaimers Of Liability: The terms of a cloud provider's service-level agreement (SLA) normally states that the provider accepts no liability for data breaches. This is understandable from their perspective because the cost and effort to manage and track everyone involved in the hosting and use of the servers would be incredibly challenging. The bottom line is, when there's a data security breach, the cloud provider is not at risk, but your company is.

4. Application Interoperability: Moving data between secure systems and databases can create points of greater risk or exposure. Standardization can help solve this problem, but our experience is that a large number of system interfaces are still custom-built and often lack security that is as robust as the applications themselves.

5. Application Mismatched To Laws And Regulations: Many regulations and laws, such as HIPAA, require that access to private data be limited to the minimum number of necessary data fields required for a specific purpose. This level of granular detail is not a function of the cloud, but instead a function of the cloud-based application. Many such applications, particularly if they were originally designed for more general-purpose use, are not capable of meeting such compliance needs.

Unless you have invested in a private cloud in your own facilities, your organization may have little control over the security and monitoring of your system that you've placed in a cloud environment. However, an inventory of covered data points, periodic privacy, and security assessments, and a response plan for breaches can go a long way toward demonstrating compliance efforts that will mitigate the impact of a data breach.

Glenn S. Phillips is not sure if he is an overlooked danger. He is the president of Forte' Incorporated where he works with business leaders who want to leverage technology and understand the often hidden risks within. Glenn is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish. Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5619
Published: 2014-09-29
The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame.

CVE-2012-5621
Published: 2014-09-29
lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains invalid UTF-8 strings.

CVE-2012-6107
Published: 2014-09-29
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2012-6110
Published: 2014-09-29
bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.

CVE-2013-1874
Published: 2014-09-29
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.