Perimeter
2/19/2013
11:02 AM
50%
50%

5 Overlooked Cloud-Based Compliance Dangers

Fully understanding risks helps avoid expensive surprises later

We all know the use of cloud-based resources is becoming increasingly common in organizations of all sizes. This can range from large-scale systems to small software-as-a-service tools. While convenient and sometimes quite cost-effective, this trend creates several compliance and data security dangers that are often overlooked. Here are five of the most serious issues:

1. Legal Liability: Whenever access to shared resources is constantly changing hands, ensuring the company is secure and compliant is like conducting an orchestra with musicians in different rooms. It takes extra effort to keep everyone on the same beat, otherwise the song (or security) falls apart. This applies with all shared resources, including hardware, software, or storage mediums.

2. Third-Party Validation: Unless you have complete control of your cloud-based assets, it is unlikely you can do much about how a cloud provider secures the data in their care. There are many data centers that make great efforts to obtain compliance certifications; however, you will probably be acting on faith that they remain secure and compliant.

3. Disclaimers Of Liability: The terms of a cloud provider's service-level agreement (SLA) normally states that the provider accepts no liability for data breaches. This is understandable from their perspective because the cost and effort to manage and track everyone involved in the hosting and use of the servers would be incredibly challenging. The bottom line is, when there's a data security breach, the cloud provider is not at risk, but your company is.

4. Application Interoperability: Moving data between secure systems and databases can create points of greater risk or exposure. Standardization can help solve this problem, but our experience is that a large number of system interfaces are still custom-built and often lack security that is as robust as the applications themselves.

5. Application Mismatched To Laws And Regulations: Many regulations and laws, such as HIPAA, require that access to private data be limited to the minimum number of necessary data fields required for a specific purpose. This level of granular detail is not a function of the cloud, but instead a function of the cloud-based application. Many such applications, particularly if they were originally designed for more general-purpose use, are not capable of meeting such compliance needs.

Unless you have invested in a private cloud in your own facilities, your organization may have little control over the security and monitoring of your system that you've placed in a cloud environment. However, an inventory of covered data points, periodic privacy, and security assessments, and a response plan for breaches can go a long way toward demonstrating compliance efforts that will mitigate the impact of a data breach.

Glenn S. Phillips is not sure if he is an overlooked danger. He is the president of Forte' Incorporated where he works with business leaders who want to leverage technology and understand the often hidden risks within. Glenn is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish. Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0279
Published: 2015-03-26
JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.

CVE-2015-0635
Published: 2015-03-26
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to spoof Autonomic Networking Registration Authority (ANRA) responses, and consequently bypass intended device an...

CVE-2015-0636
Published: 2015-03-26
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (disrupted domain access) via spoofed AN messages that reset a finite state machine,...

CVE-2015-0637
Published: 2015-03-26
The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) via spoofed AN messages, aka Bug ID CSCup62315.

CVE-2015-0638
Published: 2015-03-26
Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge) via crafted ICMPv4 packets, aka Bug ID CSCsi02145.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.