Future Threats Monitor - 12 July 2011
Head in the cloud?
Cloud computing is currently de rigueur for organisations, and promises to keep increasing as an IT trend. However, as is often the case with the introduction of cutting edge technologies, the people with a full understanding of the new security challenges that come with it are rarely the same people whose decision it is to use it.
Security firm Gartner defines cloud computing as “massively scalable IT-enabled capabilities that are delivered ‘as a service’ to external customers using internet technologies.” This simply means that IT-functions, such as data storage, which used to be done in-house on servers owned by an organisation (or by their sub-contracted IT management firm), are now done by a third party provider which makes use of the internet to access multiple servers, often spread around the globe. The service is “massively scalable” because the capacity of a single server is no longer the limiting factor.
The risks associated with cloud computing, as with any new technology or system, are those associated with an accidental natural event, a deliberate malicious act, or forces acting in a market that is not yet fully understood.
Analysis performed by International Data Corporation (IDC) demonstrates that the global cloud computing market in 2009 was worth US$17.4bn, expected to increase to US$44.2bn in 2013. Any market of that value is a tempting target for criminals, and cloud computing has its own unique vulnerabilities that could be exploited.
Cloud infrastructures generally concentrate data and resources, presenting an attractive objective to attackers. They are globally distributed, with the result that confidential data may be held across a large number of jurisdictions. However, the scale and diffuse nature of cloud computing could also be considered an additional strength. Through replication and inherent redundancy of systems, and more robust and scalable security, they may achieve a higher level of security than most in-house or smaller infrastructures. If a server was forced offline, either through malicious actions such as hacker activity, or a natural event such as an earthquake damaging the server, the inherent redundancy in the cloud would (or at least should) allow systems to continue operating.
Increased security in some areas, however, may not wholly compensate for increased exposure in others. Cloud-based services are vulnerable to certain specific risks, such as the potential for the service provider’s staff to compromise sensitive data. It is always an act of faith on the part of an organisation that deals with confidential data that subcontracted third parties properly vet their employees. This does not appear to have been a problem so far, with providers differentiating their services on security levels. But it is inevitable that groups or individuals who wish to do harm to organisations, whether for financial gain, for the express purpose of damaging the said organisations for political or ideological reasons, or simply for the fun of destruction, will attempt to subvert cloud services. If that means infiltrating service providers, then someone, sooner or later, will try.
Appropriate industry standards and competition between providers should enable businesses to manage the day-to-day security risks associated with cloud computing. However, little attention has so far been paid to the impact of catastrophic events on cloud services on more than a local scale. For example, the effects of a massive solar flare on the worlds electrical and communications infrastructure (FTM – May 2011). Without careful resilience planning, customers risk a loss of processing capacity and of essential data.
Market forces
Service provision in the cloud environment is a young industry; the ‘shape’ of the
market is not yet clear. Different companies will gamble that various types of service
are what customers want, and will continue to want, and inevitably some will get
it wrong. It is yet to be seen what the impact on clients will be of the collapse
of a service provider. Data is stored on an ever-changing set of servers across
an equally fluid set of jurisdictions. The mutable nature of the environment means
that it is likely to be impossible to predict all the challenges, both technical
and legal, that will occur as a result of a service provider folding.
Nevertheless, certain risks can be identified, and there are measures that companies can take to help mitigate these:
|
Risk |
Mitigation |
|
Storing or processing sensitive data via a third party provider carries an inherent risk, because outsourced services bypass the usual in-house controls. |
Organisations can lessen this risk by obtaining as much information as they can about the provider. Before moving to a cloud-based system organisations should oblige providers to supply specific information on the hiring and oversight of privileged administrators. |
|
Organisations are ultimately responsible for the security and integrity of their own data, regardless of where and how it is stored. |
Traditional service providers are subjected to external audits and security certifications. Due to jurisdictional differences cloud computing providers can avoid scrutiny, but those that refuse to be subject to such checks can be seen as refusing to offer a guarantee on their service. |
|
When using cloud services an organisation will rarely (if ever) know the full list of jurisdictions across which its data is being hosted. |
Organisations should oblige providers to supply information about which jurisdictions they will be hosting in. Providers will, of course, be subject to the laws of the jurisdiction they are under, but organisations should require providers to sign a contract accepting that they are liable for any breaches of those laws and not the organisation which owns the data. |
|
Data in the cloud is typically in a shared environment alongside data from other organisations. Encryption is an effective method of ensuring segregation, but is not fool-proof. Encryption can make data difficult to access, and errors can make it unusable. |
Organisations should find out what is done to segregate data at rest before moving to the cloud, and require the provider to provide evidence that encryption schemes have been fully tested before they are deployed. |
|
It is conceivable that even with the best possible security a catastrophic event could cause data to be lost. |
Cloud providers should provide information about what will happen to your data and service in case of a disaster. According to Gartner, “any offering that does not replicate the data and application infrastructure across multiple sites is vulnerable to a total failure.” A provider should commit to being able to do a complete restoration. |
|
Illegal activity is difficult to track and investigate in the cloud environment, both due to the diffuse nature of the system and the potentially large and changing number of jurisdictions involved. |
Cloud service providers should offer contractual assurances that they can and will investigate all inappropriate and potentially illegal activity. |
|
Using a third party provider carries the risk that if they go bust or are bought up by another company, an organisation’s data, or access to it, could be threatened. |
Cloud service providers should provide contractual assurances that your data will remain accessible under all such circumstances. |
|
Source: Gartner |
|
With cloud computing, as with all new technologies and systems, the biggest underlying risk is that security and crisis planning does not keep pace with progress. The cloud environment may represent the next technological archetype, and there is no good reason why organisations should shy away from using it. But decision makers should be careful not to be blinded to new risks by the promise of what the technology can offer. Cloud computing is innovative, but security should be developed from first principles.