The Curse of Cloud Security

READ THE FULL SERIES:

Part 1: Companies Seek Social Networking’s promise, Find Peril Instead

Part 2: The Curse of Cloud Security

Part 3: IT Security Outsourcing in Decline; Companies Do More In-house

Part 4: Survey Says More Companies Hiring CSOs, Holding Steady on Spending

Virtualization and cloud computing let you simplify your physical IT infrastructure and cut overhead costs, but you’ve only just begun to see the security risks involved.

Putting more of your infrastructure in the cloud has left you vulnerable to hackers who have redoubled efforts to launch denial-of-service attacks against the likes of Google, Yahoo and other Internet-based service providers. A massive Google outage earlier this year illustrates the kind of disruptions cloud-dependent businesses can suffer.

See also: Google FAIL and the Fog Over Cloud Security

That’s one of the big takeaways from the seventh-annual Global Information Security survey, which CSO and CIO magazines conducted with PricewaterhouseCoopers earlier this year. Some 7,200 business and technology executives worldwide responded from a variety of industries, including government, health care, financial services and retail.

Jumping in, sans parachute

Given the expense to maintain a physical IT infrastructure, the thought of replacing server rooms and haphazardly configured appliances with cloud services is simply too hard for many companies to resist. But rushing into the cloud without a security strategy is a recipe for risk. According to the survey, 43 percent of respondents are using cloud services such as software as a service or infrastructure as a service. Even more are investing in the virtualization technology that helps to enable cloud computing. Sixty-seven percent of respondents say they now use server, storage and other forms of IT asset virtualization. Among them, 48 percent actually believe their information security has improved, while 42 percent say their security is at about the same level. Only 10 percent say virtualization has created more security holes.

Security may well have improved for some, but experts like Chris Hoff, director of cloud and virtualization solutions at Cisco Systems, believe that both consumers and providers need to ensure they understand the risks associated with the technical, operational and organizational changes these technologies bring to bear.

“When you look at how people think of virtualization and what it means, the definition of virtualization is either very narrow — that it’s about server consolidation, virtualizing your applications and operating systems, and consolidating everything down to fewer physical boxes — or it’s about any number of other elements: client-side desktops, storage, networks, security,” he says. “Then you add to the confusion with the concept of cloud computing, which is being pushed by Microsoft and a number of smaller, emerging companies. You’re left scratching your head wondering what this means to you as a company. How does it impact your infrastructure?”

Signs of hope

Fortunately, there’s some evidence of companies proceeding with caution.

One example is Atmos Energy, which is using Salesforce.com to speed its response time to customers and help the marketing department manage a growing pool of clients, according to CIO Rich Gius. The endeavor is successful thus far, so Gius is investigating the viability of running company e-mail in the cloud. “It would help us address the growing challenge where e-mail-enabled mobile devices like BlackBerrys are proliferating widely among the workforce,” he says. But he’s not ready to take such a big step because the risks, including security, remain hard to pin down. One example of the disruption that cloud-dependent companies can experience came in May, when search giant Googlewhose content accounts for 5 percent of all Internet trafficsuffered a massive outage. When it went down, many companies that have come to rely on its cloud-based business applications (such as e-mail) were dead in the water.

The outage wasn’t caused by hackers, but there are signs that cybercriminals are exploring ways to exploit the cloud for malicious purposes. On the heels of the outage, attackers added insult to injury by flooding Google search results with malicious links, prompting the U.S. Computer Emergency Response Team (U.S. CERT) to issue a warning about potential dangers to cloud-based service sites.

The attack poisoned several thousand legitimate websites by exploiting known flaws in Adobe software to install a malicious program on victims’ machines, U.S. CERT says. The program would then steal FTP login credentials from victims and use the information to spread itself further. It also hijacked the victim’s browser, replacing Google search results with links chosen by the attackers. Although the victimized sites were not specifically those offering cloud-based services, similar schemes could be directed at cloud services providers.

IT organizations often make an attacker’s job easier by configuring physical and cloud-based IT assets so poorly that easy-to-find-and-exploit flaws are left behind. Asked about the potential vulnerabilities in their virtualized environments, 36 percent cited misconfiguration and poor implementation, and 51 percent cited a lack of adequately trained IT staff (whose lack of knowledge leads to configuration glitches). In fact, 22 percent of respondents cited inadequate training, along with insufficient auditing (to uncover vulnerabilities) to be the greatest security risk to their company’s cloud computing strategy.

It’s this awareness that makes Atmos Energy’s Gius proceed with caution. “We have no CSO. If we were a financial services firm it might be a different story, or if we had a huge head count,” Gius says. “But we are a small-to-medium-sized company, and the staff limitations make these kinds of implementations more difficult.”

Even with the right resources, security in the cloud is a matter of managing a variety of risks across multiple platforms. There’s no single cloud. Rather, “there are many clouds, they’re not federated, they don’t natively interoperate at the application layer and they’re all mostly proprietary in their platform and operation,” Hoff says. “The notion that we’re all running out to put our content and apps in some common [and secure] repository on someone else’s infrastructure is unrealistic.”

Mark Lobel, a partner in the security practice at PricewaterhouseCoopers, says perfect security is not possible. “You have to actively focus on the security controls while you are leaping to these services,” he says. It’s difficult for companies to turn back once they have let their data and applications loose because they are often quick to rid themselves of the hardware and skills they would need to bring the services back in-house.

“If you dive down a well without a rope, you may find the water you wanted, but you’re not going to get out of the well without the rope,” he says. “What if you have a breach and you need to leave the cloud? Can you get out if you have to?”