Risk
11/18/2013
08:02 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Enterprises Should Practice For Cloud Security Breaches

With cloud services collecting more data from businesses, firms should prepare for potential breaches that involve their providers

Companies are increasingly moving to cloud: Over the 18 months ending June 2013, enterprises boosted their use of cloud storage by 90 percent, resulting in 45 percent more revenue for cloud service providers, according to report released by Verizon.

Yet businesses should expect bumps ahead. Attackers will increasingly focus on finding ways to compromise companies' cloud services to gain access to the valuable data stored in those online systems. From the attempted digital coup on CloudFlare's infrastructure to breaches at businesses services such as social network LinkedIn and e-mail marketing firm Epsilon Data Management, attackers have already shown interest in illicitly accessing enterprise data in the cloud.

While the security of cloud provides is typically better than the average company, breaches will happen, experts say. And responding to an incident will likely be more complex for businesses when the response includes a cloud provider's infrastructure.

"The key here is to plan ahead," says Kristy Westphal, information security officer with Element Payment Services, a secure payment processing firm recently acquired by Vantiv. "You need to know what is in your contract, what you can get access to, and what you are on the hook for."

At the coming Cloud Security Alliance (CSA) Congress, Westphal plans to discuss strategies for minimizing the impact of a cloud breach and smoothing incident response. As a first step, companies should begin including their cloud providers in their incident response planning, finding the appropriate contact at the firm, and discovering what resources they can expect in the event of a breach.

Companies need to know the provider's contractual obligations because there is often a murky line between the cloud provider's responsibilities and the customer's responsibilities, says Dave Dalva, vice president in the risk consulting practice at Stroz Friedberg.

In addition, companies should be familiar with the provider's technologies, such as what mechanisms the cloud firm has for logging, he says. In multitenant cloud environments, separating the logs of one client from another may be difficult. Businesses should also find out whether the provider will preserve data and hard drives for later forensics, and whether that is even possible in the cloud environment.

You need to make the lines of responsibility very clear, Dalva says.

"It may be very easy, or it may be very hard, but getting an appreciation for that stuff up front will make life a lot easier in the event of a breach," he says.

[What attacks are most likely against cloud computing environments? Here's a look -- and some advice. See How Cybercriminals Attack The Cloud.]

Before moving to the cloud, company management should discuss incident response with the cloud provider. Executives and IT managers should ask whether the cloud service provider offers enough assurances to protect data and respond to breaches, says Dave Anderson, senior director of marketing at Voltage Security, a data-encryption provider.

"Do you trust your cloud provider to securely or properly manage the data you are throwing up into the cloud? If the cloud providers are saying that we are not going to provide that level of end-to-end data protection for you, then it's up to you to do it," he says.

The response will also depend on the type of cloud service that a company uses: Platform-as-a-service (PaaS) and software-as-a-service (SaaS) will differ from infrastructure-as-a-service, such as Amazon EC2, because of the number of differences between cloud providers, Element's Westphal says.

The most important step for companies is to practice incident response exercises and include the cloud provider in the session, she says. IT managers should know who the point of contact is at the cloud service provider and who is responsible for contacting cloud providers.

"You need to know who the players are -- who would be involved and that they know what their roles are, so they are not trying to solve someone else's issue," Westphal says. "You can't buy that kind of preparation. The more prepared you are, the better off you will be."

While cloud providers may not provide much in terms of supporting incident response activities, that's changing, says Stroz Friedberg's Dalva.

"There is an opportunity for cloud providers that do do all the security stuff, and we are starting to see more effort to help clients with that," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Robert Lemos is a veteran technology journalist of more than 16 years and a former research engineer, writing articles that have appeared in Business Week, CIO Magazine, CNET News.com, Computing Japan, CSO Magazine, Dark Reading, eWEEK, InfoWorld, MIT's Technology Review, ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MROBINSON000
50%
50%
MROBINSON000,
User Rank: Apprentice
12/4/2013 | 10:34:06 AM
re: Enterprises Should Practice For Cloud Security Breaches
I completely agree with you, Robert! The majority of organizations do not have a formal application security training program in place. Due to the rapid change of technology and the rise of new platforms such as cloud and mobile, knowledge and skills are fundamental to software assurance. Without a thorough understanding and grounding in the principles, vernacular, tools, and practices for software security, your development teamG«÷s effectiveness will be limited and you wonG«÷t see the kinds of results you are expecting.

According to a recent research conducted by Security Innovation and the Ponemon Institute most organizations do not identify, measure, or understand security risks. Check out more details on this topic - http://blog.securityinnovation...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web