Cyber Security Risks Of Cloud Computing

The global cloud market is expected to grow to $190+ billions by 2020. Cloud computing has brought the advantage of lower cost of ownership of IT applications, super-fast time to market, and unmatched surges in employee productivity.

From storage to data analytics, applications of all scales and sizes are operating on the cloud. Employees are bringing their own cloud based apps to work, furthering a culture of Bring Your Own Cloud (BYOC).

It’s fair to say, right from SMEs to large enterprises, all organisations are using dozens of cloud computing based tools, and will continue to do so.

However, does this increased cloud adoption not call for better understanding and mitigation of common cloud cyber security threats? This guide helps you understand the most common of these cyber security issues that threaten cloud computing applications.

Loss of Intellectual Property

An analysis done by Skyhigh revealed that more than 20% of the data kept on cloud by enterprises contains sensitive information, including but not limited to intellectual property. Now, most enterprises use multi-tenancy cloud services, wherein their data is kept in servers that are also used to deliver similar services, to other organisations.

Also, there are several entry level cloud based storage solution providers out there who are behind the security game, and lacking the state of the art data protection and security means. Any security breach faced by the cloud service provider compromises your sensitive data. Also, there are cloud storage vendors who misuse circuitous terms and conditions to establish ownership of the uploaded data!

Violations of Compliance and Regulatory Norms

There are several regulatory and compliance requirements facing enterprises in all kinds of markets and geographies. For instance, there’s HIPAA guidelines for private health information, and FERPA for student information. This means that enterprises need to ensure that their cloud storage and application service providers take care of these regulatory norms.

Also, for enterprises that promote the Bring Your Own Device and Bring Your Own Cloud concepts, ensuring compliance to these norms becomes a lot more challenging. Any security breaches and data leakages can lead to severe penalties and loss of brand equity.

Compromised Credentials and Authentication Breaches

Poor certificate and key management, weak passwords, and lax authentication are causes of frequent data breaches in cloud hosted applications.

• Enterprises struggle with identity management issues as they map permissions and privileges with user roles.
• Another huge problem area is when enterprises don’t remove or change user access when he/she quits or changes role.
• Lack of multifactor authentication is attributed as the reason behind the compromising of 80 million customer records in the Anthem breach, and several cloud applications still continue to lack this authentication.

Furthermore, developers are often guilty of leaving crypto-graphic keys and credentials within open source codes, which makes them free to grab at portals like GitHub.

Enterprises looking to federate identify management with a cloud provider need to be aware of all these issues, and how the vendor ensures protection.

Threats to APIs

Most cloud solution providers offer their APIs to enterprise IT teams to help them with cloud provisioning, orchestration, management, and monitoring. This makes the security and availability of cloud solutions dependent on the API security. Re Weak API interfaces expose cloud applications to risks of accountability, confidentiality, integrity, and availability.

For most enterprises, such APIs continue to be the most vulnerable layers because they’re fairly easily accessible via the open Internet. Rigorous penetration testing and security focused code reviews are key enablers of sustainable protection of these APIs from cyber-attacks.

Hijacking of Accounts

Surprising as it sounds, software exploits, fraud, and phishing are still prevalent everywhere you see. Cloud services are also vulnerable to these disruptive cyber-attacks, because cyber criminals have more means to monitor the activities of users on shared clouds.

The two most effective preventive means for a business to protect its cloud data and applications are:

• ensure there is no sharing of passwords and account details among users;
• ensure there are multifactor authentication schemes in place, wherever possible.

Prevention of account details loss is the first step to keeping cloud applications safe from phishing and other violations.

Abuse of Cloud Services

Cloud services can be misused to commit nefarious cyber-crimes, right from usage of cloud resources to access encryption keys, to launching DDoS attacks on an enterprise’s servers. Use of an enterprise’s cloud resources for such cyber-crimes has the following impacts:

• low availability of the cloud systems
• exposure to legal liabilities in form of lawsuits from impacted parties
• severe loss of reputation

Ensure your cloud service provider offers a mechanism of reporting abuse quickly to help avoid and control such issues.

Adotas.com

You Might Also Read:

Cloud Portability Is Still Science Fiction:

Cloud Security Analysed For Management (£)

 

« HBO Offers Hackers $250,000 'bug bounty'
You Might Need To Hire AI Expertise Sooner Than You Think »

Quartz Conference
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Perimeter 81 / Zero Trust Network Access Guide

Perimeter 81 / Zero Trust Network Access Guide

Curious how you can Implement a Zero Trust roadmap with insights from Gartner? Download this free report for a limited time only.

Corero Network Security

Corero Network Security

Corero Network Security is dedicated to improving the security of the Internet through the deployment of its innovative DDoS & Network Security Solutions.

CERT Estonia

CERT Estonia

CERT Estonia deals with security incidents that occur in Estonian networks, start there, or which it has been notified about by citizens or institutions either in Estonia or abroad.

CERT-In

CERT-In

CERT-In is a functional organisation of the Ministry of Information & Electronics Technology, Government of India, with the objective of securing Indian cyber space.

CFC Underwriting

CFC Underwriting

CFC is a specialist insurance provider and a pioneer in emerging risk, including cyber insurance.

GuardKnox

GuardKnox

GuardKnox protects the users of connected vehicles against threats that can endanger their physical safety and the safety of their personal information.

Ingalls Information Security

Ingalls Information Security

Ingalls Information Security provides network security, monitoring and forensics.

Sandline Discovery

Sandline Discovery

Sandline Discovery provides digital forensics, eDiscovery solutions, managed review and litigation consulting services.

ecsec

ecsec

ecsec is a specialized vendor of security solutions including information security management, smart card technology, identity management, cloud computing and electronic signature technology.

Pentagon Group

Pentagon Group

Pentagon Group is a provider of security services in high-risk environments, remote areas and emerging markets in support of land-based, aviation, maritime and cyber operations.

Crypto Valley Association

Crypto Valley Association

Crypto Valley Association is an independent, government-supported association established to build the world’s leading blockchain and cryptographic technologies ecosystem.

Echosec Systems

Echosec Systems

Echosec Systems is a data discovery company delivering social media and dark web threat intelligence. Our web based security software delivers critical information for situational awareness.

Cympire

Cympire

Cympire significantly increases an organisation’s Cyber Resilience through continuous Training and Assessment. Cyber Security Training Platform. Cloud-based and fully customizable Cyber Range.

Tactic Labs

Tactic Labs

Tactic Labs (part of the Avnon Group) delivers a holistic Cyber-Security Management Platform which provides military-grade protection, safeguarding critical infrastructures and mission-critical data.

Auvik Networks

Auvik Networks

Auvik is easy-to-use cloud-based networking management and monitoring software - true network visibility and control without the hassle.

Bytes Technology Group

Bytes Technology Group

Bytes is a leading provider of world-class IT solutions. Our growing portfolio of services includes cloud, security, licensing, SAM, storage, virtualisation and managed services.

Torq

Torq

Torq's no-code automation modernizes how security & operations teams work with easy workflow building, limitless integrations and numerous pre-built templates.