Almost everyone is using cloud service providers for their computing needs these days, including myself. I am getting increasingly paranoid about a Cloud Hopper threat recently described in this Reuters article. To summarize:
- Hackers gain access to the cloud service provider.
- They use the cloud's admin privileges to access the clients' servers (including mine) and steal whatever information they want there
- When cloud service provider discovers the breach, they keep it super secret from everyone, especially their clients, otherwise their company goes down in a very competitive cloud service market.
- This goes on for months or years until the client discovers that the product it makes is now offered for a fraction of a price by a state-controlled Best New Company Co. Ltd. Inc. from a country that sponsors cyber theft.
So how can I, the client of a cloud service provider, protect my business from this threat? Solutions that come to mind:
- Don't use cloud services at all. But that is expensive
- Do not store unencrypted sensitive documents in the cloud. But the production code and the database are the sensitive documents too.