2

Almost everyone is using cloud service providers for their computing needs these days, including myself. I am getting increasingly paranoid about a Cloud Hopper threat recently described in this Reuters article. To summarize:

  1. Hackers gain access to the cloud service provider.
  2. They use the cloud's admin privileges to access the clients' servers (including mine) and steal whatever information they want there
  3. When cloud service provider discovers the breach, they keep it super secret from everyone, especially their clients, otherwise their company goes down in a very competitive cloud service market.
  4. This goes on for months or years until the client discovers that the product it makes is now offered for a fraction of a price by a state-controlled Best New Company Co. Ltd. Inc. from a country that sponsors cyber theft.

So how can I, the client of a cloud service provider, protect my business from this threat? Solutions that come to mind:

  1. Don't use cloud services at all. But that is expensive
  2. Do not store unencrypted sensitive documents in the cloud. But the production code and the database are the sensitive documents too.
  3. ?
1
  • 1
    Cloud - i.e. "someone elses machine" is never a good model for security, except when it comes to availability. So keep that in mind and only store data that you would be ok with to host publicly.
    – Tobi Nary
    Jun 27, 2019 at 4:29

2 Answers 2

4

The way to protect yourself from a compromised cloud service is to not store sensitive data in the cloud. "The cloud" is, as it is often repeated, essentially just a bunch of computers somewhere else.

Cloud solutions are a good idea if your demand fluctuates wildly, and providing enough performance to keep up with the peak is just overkill for you. Good examples for this would be computationally-intensive tasks, which need to be done rarely.

The problem with basing your entire business (or parts of your business) permanently in "the cloud" is that you effectively store some parts of potentially sensitive data "somewhere else" and thus depend on the security of someone else.

The general rule of thumb for cloud services should be: If you cannot afford to disclose some information to the public, don't put it in the cloud.


It should also be noted that not informing customers of a security breach, especially one that may include their personal information or may further compromise their own security, is illegal in some jurisdictions. I'm not a lawyer, but the EU doesn't joke around when it comes to disclosure of security breaches. Should anyone notice that a cloud service provider got breached, that the cloud service provider knew and that they chose not to inform customers - then they are in a very bad spot. Probably much worse off than had they informed customers right away.

2
  • Well I bet that's not what most customers think when they see cloud services advertised as "secure". Also apparently the US is not as strict as EU (from the Reuters article): "Even when the government alerted technology service providers, the companies would not always pass on warnings to clients, Jeanette Manfra, a senior cybersecurity official with the U.S. Department of Homeland Security, told Reuters. “We asked them to notify their customers,” Manfra said. “We can’t force their hand.” Jun 27, 2019 at 9:17
  • You can't influence what "most customers think". There is no solution that you, me, or anyone here could offer that would once and for all solve this problem. Not storing sensitive data in the cloud should be the norm, as was shown with the iCloud leaks.
    – user163495
    Jun 27, 2019 at 11:16
1

With 2 you are on the right track. It's good practice not to store unencrypted, confidential data.

Apart from that, you can and should limit the impact an intruder can have and deploy logs, alerts and make use of the principle of least privilege.

Of course, if an attacker gets access to your CSP, they might be able to shut down your security controls and completely circumvent your countermeasures. If this is a threat that you consider valid, you might not be able to leverage cloud computing resources and need to run, observe and defend your own infrastructure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .