Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/17/2011
02:06 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

The Dark Side Of The Cloud

Wave of high-profile breaches of cloud-based services during the past few months a reality check for entrusting your data with these providers, according to a new Dark Reading Analytics report

It hasn't been a banner year for cloud-based services: First it was Amazon's outage, and then the breaches of email marketing provider Epsilon, Sony's PlayStation Network, and others, fueling concerns about just how safe it is to move data out of the data center and into the cloud.

Cloud providers aren't quite there yet when it comes to keeping data as secure as traditional enterprise networks do, security experts say, and it pays to look at their DNA: They tend to host an infrastructure that mirrors the source of their computing power, according to Chris Whitener, chief security strategist for Hewlett-Packard. Amazon’s cloud services are based on its experiences providing an available retail experience. A cloud based on a bank’s excess capacity, meanwhile, might have more security built into it, he notes in Dark Reading's newly released Analytics Alert, "Dark Side of the Cloud Becoming Clearer."

And making things worse, cloud services providers and users see security differently, according to a recent survey by the Ponemon Institute and sponsored by CA Technologies: The data indicates that cloud providers are more focused on cost and speed of deployment than on security. Nearly 80 percent of cloud providers allocate just 10 percent or less of IT resources to security or control-related activities. Fewer than half of the service provider respondents agree or strongly agree that security is a priority, and less than 20 percent of U.S. and European providers consider security a competitive advantage.

This doesn't bode well for cloud adoption: "If the risk of breach outweighs potential cost savings and agility, we may reach a point of ‘cloud stall’ -- where cloud adoption slows or stops -- until organizations believe cloud security is as good as or better than enterprise security," said Mike Denning, CA Technologies' general manager, security, in a statement. The majority of cloud providers (69 percent) believe security is primarily the responsibility of the cloud user, according to the report.

What should enterprises do? Rather than focus on contracts and limiting liability in cloud services deals, focus instead on controls and auditability, according to Josh Corman, director of research at The 451 Group. Corman says there's typically not enough due diligence done before signing with a cloud services provider and handing over your data: “It’s like if you had a date tonight, would you let a random stranger watch your kids?” he says. “No. There is a whole bunch of questions you would ask.”

And not all software-as-a-service providers sufficiently encrypt data. According to Russ Dietz, CTO for SafeNet, a maker of secure network and cloud technologies: “We still have a long way to go,” Dietz says. “SaaS providers could deploy [encryption technologies], but it takes time to integrate them into their systems. We are still in the early days.”

So authentication is as important as encryption to protect sensitive information. Meanwhile, compliance is still an enigma in the cloud. Auditors and enterprises alike are trying to sort out what compliance means in diverse and complex cloud environments -- a process that will continue to evolve as organizations figure out what cloud providers should be held accountable for, and how.

The full Dark Reading report is available for download here.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16246
PUBLISHED: 2019-12-12
Intesync Solismed 3.3sp1 allows Local File Inclusion (LFI), a different vulnerability than CVE-2019-15931. This leads to unauthenticated code execution.
CVE-2019-17358
PUBLISHED: 2019-12-12
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP ...
CVE-2019-17428
PUBLISHED: 2019-12-12
An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the database to be decrypted.
CVE-2019-18345
PUBLISHED: 2019-12-12
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrat...
CVE-2019-19198
PUBLISHED: 2019-12-12
The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.