Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

11/18/2013
08:02 PM
50%
50%

Enterprises Should Practice For Cloud Security Breaches

With cloud services collecting more data from businesses, firms should prepare for potential breaches that involve their providers

Companies are increasingly moving to cloud: Over the 18 months ending June 2013, enterprises boosted their use of cloud storage by 90 percent, resulting in 45 percent more revenue for cloud service providers, according to report released by Verizon.

Yet businesses should expect bumps ahead. Attackers will increasingly focus on finding ways to compromise companies' cloud services to gain access to the valuable data stored in those online systems. From the attempted digital coup on CloudFlare's infrastructure to breaches at businesses services such as social network LinkedIn and e-mail marketing firm Epsilon Data Management, attackers have already shown interest in illicitly accessing enterprise data in the cloud.

While the security of cloud provides is typically better than the average company, breaches will happen, experts say. And responding to an incident will likely be more complex for businesses when the response includes a cloud provider's infrastructure.

"The key here is to plan ahead," says Kristy Westphal, information security officer with Element Payment Services, a secure payment processing firm recently acquired by Vantiv. "You need to know what is in your contract, what you can get access to, and what you are on the hook for."

At the coming Cloud Security Alliance (CSA) Congress, Westphal plans to discuss strategies for minimizing the impact of a cloud breach and smoothing incident response. As a first step, companies should begin including their cloud providers in their incident response planning, finding the appropriate contact at the firm, and discovering what resources they can expect in the event of a breach.

Companies need to know the provider's contractual obligations because there is often a murky line between the cloud provider's responsibilities and the customer's responsibilities, says Dave Dalva, vice president in the risk consulting practice at Stroz Friedberg.

In addition, companies should be familiar with the provider's technologies, such as what mechanisms the cloud firm has for logging, he says. In multitenant cloud environments, separating the logs of one client from another may be difficult. Businesses should also find out whether the provider will preserve data and hard drives for later forensics, and whether that is even possible in the cloud environment.

You need to make the lines of responsibility very clear, Dalva says.

"It may be very easy, or it may be very hard, but getting an appreciation for that stuff up front will make life a lot easier in the event of a breach," he says.

[What attacks are most likely against cloud computing environments? Here's a look -- and some advice. See How Cybercriminals Attack The Cloud.]

Before moving to the cloud, company management should discuss incident response with the cloud provider. Executives and IT managers should ask whether the cloud service provider offers enough assurances to protect data and respond to breaches, says Dave Anderson, senior director of marketing at Voltage Security, a data-encryption provider.

"Do you trust your cloud provider to securely or properly manage the data you are throwing up into the cloud? If the cloud providers are saying that we are not going to provide that level of end-to-end data protection for you, then it's up to you to do it," he says.

The response will also depend on the type of cloud service that a company uses: Platform-as-a-service (PaaS) and software-as-a-service (SaaS) will differ from infrastructure-as-a-service, such as Amazon EC2, because of the number of differences between cloud providers, Element's Westphal says.

The most important step for companies is to practice incident response exercises and include the cloud provider in the session, she says. IT managers should know who the point of contact is at the cloud service provider and who is responsible for contacting cloud providers.

"You need to know who the players are -- who would be involved and that they know what their roles are, so they are not trying to solve someone else's issue," Westphal says. "You can't buy that kind of preparation. The more prepared you are, the better off you will be."

While cloud providers may not provide much in terms of supporting incident response activities, that's changing, says Stroz Friedberg's Dalva.

"There is an opportunity for cloud providers that do do all the security stuff, and we are starting to see more effort to help clients with that," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MROBINSON000
50%
50%
MROBINSON000,
User Rank: Apprentice
12/4/2013 | 10:34:06 AM
re: Enterprises Should Practice For Cloud Security Breaches
I completely agree with you, Robert! The majority of organizations do not have a formal application security training program in place. Due to the rapid change of technology and the rise of new platforms such as cloud and mobile, knowledge and skills are fundamental to software assurance. Without a thorough understanding and grounding in the principles, vernacular, tools, and practices for software security, your development teamGs effectiveness will be limited and you wonGt see the kinds of results you are expecting.

According to a recent research conducted by Security Innovation and the Ponemon Institute most organizations do not identify, measure, or understand security risks. Check out more details on this topic - http://blog.securityinnovation...
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15058
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.
CVE-2020-15059
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.
CVE-2020-15060
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15061
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values.
CVE-2020-15062
PUBLISHED: 2020-08-07
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.