Cyber Security Issues: Cloud Computing – Secure or Insecure?

There is no doubt that over the past two years Cloud computing has become all the rage. More and more applications and services are becoming Cloud-based. But how many vendors and users of these services have paused to think about the security of such sites. Last year saw a number of reported security breaches most notably Dropbox. They suffered a breach leading to thousands of their European customers being subjected to a spam attack, which contained ads for gambling web sites.

More recently the reported leaks from within the US National Security Agency’s (NSA) Prism surveillance programme have raised serious concerns about data privacy. It is reported (Computer Weekly, Friday 5^th July 2013), “as a result, businesses are now turning to Switzerland for their data hosting needs. Privacy in Switzerland is enshrined in law. As the country is outside of the EU, it is not bound by pan-European agreements to share data with other member states, or with the US.”

Cloudy Security

When considering security in the Cloud think no differently to security in any other form of software application. Security is not a bolt-on option, or at least it shouldn’t be. Security should be at the very core of the application and be at the top of the list of requirements before a single line of code is written. I’m constantly amazed at how often we see companies that offer online services of one kind or another being forced to add layers of security to their offerings following an embarrassing security breach.

When data is stored in the Cloud the reality is that it is stored on someone’s server somewhere in the world, on terra firma. All the usual data security issues apply, only now they are magnified by sheer size and number of likely access requests. Remember a security breach does not have to be malicious; it could be as a result of human error. In fact some would say this is the far larger area of risk. Too often Cloud based data storage is seen at “arms length” and thought of in the same way, as someone else’s problem.

Securing the Cloud

The Cloud is not some fluffy cotton wool ball up in the sky, it is just another server it might be remote or it could be located within your organisation. What makes it a Cloud server is its openness to the Internet. A Cloud server by nature can be viewed by anyone; however the authentication of users and the access they might be granted is at the very crux of the security issue.

Organisations considering using such a service for sharing large files for instance, should be concerned at the very least about;

• central control, who they might want to make such shares with,
• the audit ability of authorised access and unauthorised attempts to access,
• the ability to revoke access at a later date,
• the product having government certified assurance level.

Experts are beginning to refer to this type of product as having managed file transfer technology MFT. Earlier this year Gartner estimated that 50% of medium to large organisations will deploy products of this type by 2016.

Summary

In summary security should be your first concern when considering a Cloud based app or service. Vendors with a pedigree of meeting security needs should be your first ports of call. These are going to be companies with a past history of developing managed encryption based products. It is not always easy to pick your way through the array of sales speak that you will encounter when looking for secure software applications. This is when it can be very helpful to engage the help of a consultancy. Being UK based I have had a long experience of working with one such consultancy SBL, based in York. Their pedigree is both long and qualified when talking computer security.