Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Moving almost everything to the Cloud gradually becomes a mainstream.

Are there any security issues, which appeared together with this trend?

What everybody should check out, from the security point of view, before moving its webapps and databases to the Amazon Cloud, Azure, etc.?

share|improve this question

10 Answers 10

up vote 9 down vote accepted

There's an infinite amount of security issues with the cloud. To see a nasty laundry list, check out ENISA's documents.

share|improve this answer
4  
Don't want to be picky, but an "infinite" amount? ;) –  Nev Stokes Nov 14 '10 at 20:38
    
@ Nev Stokes: Well we're still coming up with new security issues everyday in non-cloud environments, why not also cloud? –  atdre Nov 15 '10 at 1:43
2  
I'd be interested in seeing a real world comparison of risk between cloud and non-cloud deployments. Since most risk is from insiders, one would think the cloud solution is more secure. I doubt the local-non-cloud deployment will be as secure as the cloud deployment in most cases. –  makerofthings7 Dec 1 '10 at 21:03
1  
@makerofthings - I have a feeling your assumption that most risk is from insiders is outdated by a few years. Most real risk as measured at C-suite level is external (possibly with an element of internal collusion, but not always) as applications are more and more external. So far evidence proves cloud is definitely less secure, but to be fair, this could be mostly around misconfoguration :-) –  Rory Alsop Dec 30 '10 at 1:57
2  
In fact, the (very good) ENISA link lists 35 risks and 53 vulnerabilities - that's total of only 88 which was less than infinite last I checked. "Infinite" sounds a lot like paranoid scare tactics to me. Sure, If there was more content to the answer or to the indirect argument against cloud computing it contains, I'd be happy let the attack pass or would even join the crowd - but stated like this there just isn't. –  Ilari Kajaste Jan 10 '11 at 12:22

A small subset of security issues (not necessarily new per se to cloud, but definitely more difficult) :

  • Access control
  • Privacy and confidentiality
  • Availability (how strong is your SLA, really? does your provider indemnify for any damages resulting from being offline?)
  • connection with internal systems - you'll often have to punch open holes in your firewall to allow some other protocols to get to your sensitive, internal systems.
  • Compliance - there are some regulations, notably PCI-DSS, that you currently cannot reach compliance with, if you are using cloud-based systems. Note that they might not explicitly disallow cloud-systems, but it is simply impossible to be compliant while using cloud-systems as they are today.
  • There are certain laws, in some countries, that forbid you from moving private data of their citizens out of their country. There are other countries, where you don't want to move your data into, as you do not want to be subject to their laws... When you're clouding, you don't really know where your systems and data are located, so how can you ensure your users anything wrt their location? For that matter how do you know which laws you must comply with at which time? And how do you know you're not already illegal?
share|improve this answer
    
Good points Avid although I'm not sure every item you listed falls into the security category, but still all very relevant to Cloud apps. I think your last point is a very important one. The individuals security (the user of your app) is at least as important as your companies security. –  Anonymous Type Dec 30 '10 at 2:51
    
@Anonymous, actually I don't regard laws as protecting the individual's security - I can do that better than any vague and generic law. However, this is "security" because it relates to compliance to those laws. –  AviD Dec 30 '10 at 8:41

Virtualization, that is the root of cloud computing technology, removes so called term "perimeter", that was like a guide in usual DC's (data centers) where to start defense and what to do. As the most data in clouds are transferred between physical servers, virtual machines, there is decreased control of such system - less possibilities for network segmentation and usage of hardware-type protection. Such new DC virtualization requires new access policy and data management software.

There was created non-profit organization Cloud Security Alliance (CSA) that aims cloud security: http://www.cloudsecurityalliance.org/. There you can find guide, best-practices of how to deal with cloud computing.

share|improve this answer
    
The term "perimeter" was dying down long before clouding and virtualizationing became the tech du jour. E.g. check out Jericho Forum, its been around for some time now... –  AviD Nov 16 '10 at 22:39
    
@AviD, not all countries has the same level of IT development - it still often happens to watch the usage of this term in its primary meaning. Also, I used it here so it is clear what the talk about is - users who wants to get more information should check the link that was given in my answer. –  anonymous Nov 17 '10 at 9:20
    
@Ams, sorry, I wasn't clear - I didnt mean they don't use the term, I meant that the concept was slowly being phased out. That is, the "perimeter" around the organization, its systems, and users, has been recognized to not really be feasible anymore; what with mobile computing, open systems, extranet, hosted systems, etc etc. Of course, it could be argued that that was the beginning of the cloud/virtzation fad, but this was happening irrelevant of the cloud. –  AviD Nov 17 '10 at 12:06

Practically speaking, I've seen companies move websites into the cloud without a code review. The code was written for a single machine running ASP.NET.

The cloud mostly offers scale-out abilities. If the site wasn't made to scale out, then concurrency issues arise with data integrity or session security. To deal with these problems developers will either remove the non-concurrent code (sometimes making it less secure) or rewriting the code needed to support sessionless, concurrent deployments.

share|improve this answer

There was just a blog post from Lenny Zeltser on this topic: Top 10 Cloud Security Risks

Most of his points talk about the problem that you don't have full control over the infrastructure anymore, and might not even know how it works internally. One also doesn't know anymore who else is on the same system, and a vulnerability in their system might leak over to your data.

Another problem is that you have to trust an outsider to secure your data. A wrong configuration and all your data might leak.

share|improve this answer

In addition to AviD's good points, the following are also very important:

  • Availability - yes, AviD mentioned it, but I can't stress enough how critical it is that you understand your reliance on the cloud. Often cloud providers mention the invulnerability of the cloud, but in reality a denial of service attack is still valid if you can't access your application on a timely basis.
  • Regulatory Compliance - on two fronts: where is your data? Can you guarantee it remains in the correct jurisdiction, and for e-discovery, can you guarantee you have retrieved every item of data connected with an individual/event?

The cloud makes both of these harder to confirm.

share|improve this answer
    
Actually on availability with the massive resources of hosters like Msft, Amazon, etc you are actually less likely to suffer DDOS/DOS attacks than with a regular web hoster. Therefore while the same caveats that apply to web apps also apply to cloud apps, I'm not sure that the availability issue is necessarily "worse" under cloud. –  Anonymous Type Dec 30 '10 at 2:54
    
@Anonymous Type - you'll note I didn't say worse, just that they are harder to confirm :-) –  Rory Alsop Dec 30 '10 at 9:25

From the ENISA pdf that @atdre already linked to in his answer.

LOSS OF GOVERNANCE: in using cloud infrastructures, the client necessarily cedes control to the Cloud Provider (CP) on a number of issues which may affect security. At the same time, SLAs may not offer a commitment to provide such services on the part of the cloud provider, thus leaving a gap in security defences.
LOCK-IN: there is currently little on offer in the way of tools, procedures or standard data formats or services interfaces that could guarantee data, application and service portability. This can make it difficult for the customer to migrate from one provider to another or migrate data and services back to an in-house IT environment. This introduces a dependency on a particular CP for service provision, especially if data portability, as the most fundamental aspect, is not enabled..
ISOLATION FAILURE: multi-tenancy and shared resources are defining characteristics of cloud computing. This risk category covers the failure of mechanisms separating storage, memory, routing and even reputation between different tenants (e.g., so-called guest-hopping attacks). However it should be considered that attacks on resource isolation mechanisms (e.g.,. against hypervisors) are still less numerous and much more difficult for an attacker to put in practice compared to attacks on traditional OSs.
COMPLIANCE RISKS: investment in achieving certification (e.g., industry standard or regulatory requirements) may be put at risk by migration to the cloud:
if the CP cannot provide evidence of their own compliance with the relevant requirements
if the CP does not permit audit by the cloud customer (CC).
In certain cases, it also means that using a public cloud infrastructure implies that certain kinds of compliance cannot be achieved (e.g., PCI DSS (4)).
MANAGEMENT INTERFACE COMPROMISE: customer management interfaces of a public cloud provider are accessible through the Internet and mediate access to larger sets of resources (than traditional hosting providers) and therefore pose an increased risk, especially when combined with remote access and web browser vulnerabilities.
DATA PROTECTION: cloud computing poses several data protection risks for cloud customers and providers. In some cases, it may be difficult for the cloud customer (in its role as data controller) to effectively check the data handling practices of the cloud provider and thus to be sure that the data is handled in a lawful way. This problem is exacerbated in cases of multiple transfers of data, e.g., between federated clouds. On the other hand, some cloud providers do provide information on their data handling practices. Some also offer certification summaries on their data processing and data security activities and the data controls they have in place, e.g., SAS70 certification.
INSECURE OR INCOMPLETE DATA DELETION: when a request to delete a cloud resource is made, as with most operating systems, this may not result in true wiping of the data. Adequate or timely data deletion may also be impossible (or undesirable from a customer perspective), either because extra copies of data are stored but are not available, or because the disk to be destroyed also stores data from other clients. In the case of multiple tenancies and the reuse of hardware resources, this represents a higher risk to the customer than with dedicated hardware.
MALICIOUS INSIDER: while usually less likely, the damage which may be caused by malicious insiders is often far greater. Cloud architectures necessitate certain roles which are extremely high-risk. Examples include CP system administrators and managed security service providers.

share|improve this answer

I can highly recommend this survey of security issues with cloud-based hosting: Self Hosting vs. Cloud Hosting: Accounting for the security impact of hosting in the cloud.

share|improve this answer

In order to ensure that data is secure and that data privacy is maintained, cloud computing providers attend to the following areas:

Data protection - To be considered protected, data from one customer must be properly segregated from that of another; it must be stored securely when “at rest” and it must be able to move securely from one location to another. Cloud providers have systems in place to prevent data leaks or access by third parties. Proper separation of duties should ensure that auditing and/or monitoring cannot be defeated, even by privileged users at the cloud provider.

Identity management - Every enterprise will have its own identity management system to control access to information and computing resources. Cloud providers either integrate the customer’s identity management system into their own infrastructure, using federation or SSO technology, or provide an identity management solution of their own.

Physical and personnel security - Providers ensure that physical machines are adequately secure and that access to these machines as well as all relevant customer data is not only restricted but that access is documented.

Availability - Cloud providers assure customers that they will have regular and predictable access to their data and applications.

Application security - Cloud providers ensure that applications available as a service via the cloud are secure by implementing testing and acceptance procedures for outsourced or packaged application code. It also requires application security measures (application-level firewalls) be in place in the production environment.

Privacy - Finally, providers ensure that all critical data (credit card numbers, for example) are masked and that only authorized users have access to data in its entirety. Moreover, digital identities and credentials must be protected as should any data that the provider collects or produces about customer activity in the cloud.

For more info regarding Cloud Computing in India visit - Link Removed by mod

share|improve this answer
2  
the OP requested security issues specific to the cloud. What you have posted contains a reasonable list of security headings but reads as an advert. The link you added is also a marketing front page, not a source of security information. –  Rory Alsop Jan 10 '11 at 9:35
    
Adverts like these usually hurt the business more than it could do any good. –  AdnanG Sep 18 '13 at 4:22

Multi-tenant environments are vulnerable to Related Domain Cookie attacks

share|improve this answer
    
It is not clear to me how big an issue this is in practice, or how many cloud providers are at risk. Multi-tenant environments are at risk for related-domain cookie attacks only if the multiple tenants are assigned related domains. While some cloud providers may do that, it's also true that many cloud providers (like Amazon EC2) don't. –  D.W. Mar 16 '12 at 17:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.