Perimeter
2/19/2013
11:02 AM
Connect Directly
RSS
E-Mail
50%
50%

5 Overlooked Cloud-Based Compliance Dangers

Fully understanding risks helps avoid expensive surprises later

We all know the use of cloud-based resources is becoming increasingly common in organizations of all sizes. This can range from large-scale systems to small software-as-a-service tools. While convenient and sometimes quite cost-effective, this trend creates several compliance and data security dangers that are often overlooked. Here are five of the most serious issues:

1. Legal Liability: Whenever access to shared resources is constantly changing hands, ensuring the company is secure and compliant is like conducting an orchestra with musicians in different rooms. It takes extra effort to keep everyone on the same beat, otherwise the song (or security) falls apart. This applies with all shared resources, including hardware, software, or storage mediums.

2. Third-Party Validation: Unless you have complete control of your cloud-based assets, it is unlikely you can do much about how a cloud provider secures the data in their care. There are many data centers that make great efforts to obtain compliance certifications; however, you will probably be acting on faith that they remain secure and compliant.

3. Disclaimers Of Liability: The terms of a cloud provider's service-level agreement (SLA) normally states that the provider accepts no liability for data breaches. This is understandable from their perspective because the cost and effort to manage and track everyone involved in the hosting and use of the servers would be incredibly challenging. The bottom line is, when there's a data security breach, the cloud provider is not at risk, but your company is.

4. Application Interoperability: Moving data between secure systems and databases can create points of greater risk or exposure. Standardization can help solve this problem, but our experience is that a large number of system interfaces are still custom-built and often lack security that is as robust as the applications themselves.

5. Application Mismatched To Laws And Regulations: Many regulations and laws, such as HIPAA, require that access to private data be limited to the minimum number of necessary data fields required for a specific purpose. This level of granular detail is not a function of the cloud, but instead a function of the cloud-based application. Many such applications, particularly if they were originally designed for more general-purpose use, are not capable of meeting such compliance needs.

Unless you have invested in a private cloud in your own facilities, your organization may have little control over the security and monitoring of your system that you've placed in a cloud environment. However, an inventory of covered data points, periodic privacy, and security assessments, and a response plan for breaches can go a long way toward demonstrating compliance efforts that will mitigate the impact of a data breach.

Glenn S. Phillips is not sure if he is an overlooked danger. He is the president of Forte' Incorporated where he works with business leaders who want to leverage technology and understand the often hidden risks within. Glenn is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish. Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0640
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.

CVE-2014-0641
Published: 2014-08-20
Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.

CVE-2014-2505
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors.

CVE-2014-2511
Published: 2014-08-20
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.

CVE-2014-2515
Published: 2014-08-20
EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.