Data breaches are disastrous events for enterprises and consumers alike. Sensitive information is stolen or made public. Cloud-based data breaches can be quite devastating because of the sheer volume of data that can be taken or manipulated. Cloud security is especially important in the Big Data age.
Cloud-based data is valuable for different reasons. A business’s competitors could be interested trade secrets, business relationships, and intellectual property. Activists wanting to expose “confidential” and potentially embarrassing information might want to access Cloud-based Big Data. Or, someone may simply want to blackmail you. In 2015, a company named BitDefender was hacked by way of its public Cloud application and had passwords and customer usernames stolen. The hacker demanded a ransom of $15,000.
People hacking into Cloud-based files and systems have become a serious concern for organizations. While data breaches are not unique to Cloud storage, it does rank as a major concern for Cloud users. The Cloud is not only vulnerable to the same risks as a conventional corporate network, but can be attacked through the use of shared resources, Cloud staff, and third party partners of the Cloud provider. Because of their access to Big Data, Cloud providers are very attractive targets.
When choosing a Cloud provider, be sure their security guarantees are clearly stated in the contract and service level agreement (SLA). The contract should describe exactly what kind of security will be used, and any penalties the Cloud provider will receive for non-compliance. It should also describe how problems will be reported, and how you can ensure the terms of your contract are being met.
While Cloud providers normally provide fairly good security for their customer base, their customers are still ultimately responsible for protecting their own data, even if it is in the Cloud. Businesses can protect themselves by installing their own security program. This step should be taken seriously by people and organizations with sensitive information, such as a client’s credit card number.
Unfortunately, the consequences of a data breach are not necessarily limited to a loss of privacy. In many places around the world, regulations and laws require organizations to maintain certain standards designed to protect sensitive information against unauthorized use. Companies can be fined and may be open to civil lawsuits. Criminal charges are also a possibility. And then there are the costs of investigation and damage repair.
The Basics
Make certain the Cloud provider is an ally. They should make it easy to update systems current and keep up with the latest updates and patches. The Cloud provider should also offer thorough transparency for you, the client, regarding your own Cloud activities. The last thing you want is a Cloud provider who acts like an enemy.
Multifactor authentication (requiring more than one method of authentication) is a fairly simple, inexpensive method of increasing security. Unfortunately, most people find multiple identifications to be a nuisance. There is hope for simplifying this process through the use of eyescans, which are just starting to be used as a form of identification.
Most people think of hackers as their biggest security threat, but, in fact, employees present an equal risk, not due to maliciousness, but basic human sloppiness. A report by Experian claims employees have caused nearly 60% of last years’ security incidents. This was made worse by employees who worked remotely, or used their personal mobile device in accessing materials from outside the company’s network. Employees need to be trained in using only secure connections when they access their work by way of the Internet.
One of more the challenging aspects working in the Cloud is the convenience of being able to create new VMS (virtual machines) and containers, and then forgetting to close them. These are called “Zombies,” and are security threats which present potential openings into other parts of your system. The use of VMS and containers is still an immature technology, and security is the technology’s greatest weakness. Diligence, remembering to turn the project off when not working on it, is the keyword in maintaining “Zombie” security.
Integrating security controls with your on-premises systems and your Cloud provider will support an efficient security system. Ensure the appropriate controls are being used for the type of server. This should include programming such as application control, intrusion prevention, and advanced anti-malware solutions. These systems should be managed centrally to provide transparency and compliance while sharing data.
Encryption
This type of protection requires protecting the data itself. Cloud providers will not take responsibility for protecting data stored in their computers. Some Cloud providers offer encryption as part of their package, but an astonishing number do not (some offer the service, but encrypt data only on a part-time basis). A 256-bit encryption, or less, is currently considered inadequate. It is important to have complete control over the encryption process. If the Cloud provider requires owning the encryption system, you will have absolutely no guarantee your data will be safe. Finding another provider would be the smart move.
Additionally, be sure your unencrypted data is unencrypted only when using it. Some Cloud providers require the data is transmitted to their facilities in plain-text format, which is an immediate red flag. Unencrypted data transmissions are a security risk.
Whichever Cloud provider gets used, make sure their security guarantees are in the contract and SLA (service-level agreement). A good contract should spell out exactly what procedures will be employed, along with any penalties the provider will face for non-compliance, how they will report upon it, and how you can audit to ensure your contractual terms are being met. A strong SLA will protect the client from the Cloud provider developing a “casual attitude.”
Finding a Cloud
Finding a Cloud provider can be difficult. Cloud services are dynamic, and often in a state of evolution, leaving the user in a state of confusion. Additionally, some Cloud services, astonishingly, don’t include the word Cloud in their self-descriptions. After finding a provider, it can be difficult to get accurate information about them. Internet reviews are nearly worthless, due to companies creating their own reviews. On top of that, Cloud services vary from provider to provider, and one provider may be well-suited to one client’s needs, but poorly suited for another. It can be difficult to find the right Cloud provider.
CRN has developed a list of potential Cloud providers titled, the 100 Coolest Cloud Computing Vendors. This list provides a foundation for the search. The list is broken up into five segments: Platform and Development, Software, Security, Storage, and Infrastructure.
Cloud Armor is a service that offers to protect Cloud consumers from making costly mistakes, by finding trustworthy Cloud services that suit your needs. Cloud Armor provides an honest review service that automatically researches Cloud services, and provides honest feedback from other Cloud consumers. Cloud Armor describes itself as an interactive, one-stop service for Cloud consumers wanting to investigate Cloud services, and their trustworthiness.
Cloud Security Services
Armor Defense, Inc., formerly named Firehost, offers a broad portfolio of cyber security services and products. They also host their own Cloud. In order to differentiate themselves from the competition, Armor Defense has built their reputation on providing serious security. As a Cloud provider, they offer:
- Unlimited zones of firewalls
- Isolated networks
- Web app protection
- DDoS protection
- Reputation based screening of incoming IPs
- Secure VPN access
- Armor Complete, a virtual private Cloud (VPC) and private Cloud hosting solution hosted by Armor themselves
- Secure PCI and HIPAA compliant hosting solutions and data centers
- 24/7 Support Staff
Armor Defense also offers Armor Anywhere, a package of useful security tools capable of being used with other Cloud providers.
Cloud security is still evolving, as is the Cloud. Data breaches, human sloppiness, and account hijacking, were listed as three of the 12 critical issues of Cloud security in the report, “The Treacherous Twelve: Cloud Computing Top Threats in 2016” by Cloud Security Alliance. Staying educated and informed about recent security advances provides a safety net that would otherwise not exist. Although it can be difficult to detect and eliminate security breaches, many can be blocked with a proactive security system. A well-trained and diligent staff will also help to prevent incursions into your Big Data.