Perimeter

2/19/2013
11:02 AM
50%
50%

5 Overlooked Cloud-Based Compliance Dangers

Fully understanding risks helps avoid expensive surprises later

We all know the use of cloud-based resources is becoming increasingly common in organizations of all sizes. This can range from large-scale systems to small software-as-a-service tools. While convenient and sometimes quite cost-effective, this trend creates several compliance and data security dangers that are often overlooked. Here are five of the most serious issues:

1. Legal Liability: Whenever access to shared resources is constantly changing hands, ensuring the company is secure and compliant is like conducting an orchestra with musicians in different rooms. It takes extra effort to keep everyone on the same beat, otherwise the song (or security) falls apart. This applies with all shared resources, including hardware, software, or storage mediums.

2. Third-Party Validation: Unless you have complete control of your cloud-based assets, it is unlikely you can do much about how a cloud provider secures the data in their care. There are many data centers that make great efforts to obtain compliance certifications; however, you will probably be acting on faith that they remain secure and compliant.

3. Disclaimers Of Liability: The terms of a cloud provider's service-level agreement (SLA) normally states that the provider accepts no liability for data breaches. This is understandable from their perspective because the cost and effort to manage and track everyone involved in the hosting and use of the servers would be incredibly challenging. The bottom line is, when there's a data security breach, the cloud provider is not at risk, but your company is.

4. Application Interoperability: Moving data between secure systems and databases can create points of greater risk or exposure. Standardization can help solve this problem, but our experience is that a large number of system interfaces are still custom-built and often lack security that is as robust as the applications themselves.

5. Application Mismatched To Laws And Regulations: Many regulations and laws, such as HIPAA, require that access to private data be limited to the minimum number of necessary data fields required for a specific purpose. This level of granular detail is not a function of the cloud, but instead a function of the cloud-based application. Many such applications, particularly if they were originally designed for more general-purpose use, are not capable of meeting such compliance needs.

Unless you have invested in a private cloud in your own facilities, your organization may have little control over the security and monitoring of your system that you've placed in a cloud environment. However, an inventory of covered data points, periodic privacy, and security assessments, and a response plan for breaches can go a long way toward demonstrating compliance efforts that will mitigate the impact of a data breach.

Glenn S. Phillips is not sure if he is an overlooked danger. He is the president of Forte' Incorporated where he works with business leaders who want to leverage technology and understand the often hidden risks within. Glenn is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish. Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.
CVE-2018-20156
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multisite network.
CVE-2018-19007
PUBLISHED: 2018-12-14
In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable to an OS system command injection as root.
CVE-2018-20147
PUBLISHED: 2018-12-14
In WordPress versions before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.