Security Breaches, Data Loss, Outages: The Bad Side of Cloud

As a big supporter of cloud computing, this is never an easy topic to discuss. However, security concerns will always be present as threats continue to rise. Let me give you an example. As soon as the whole Heartbleed topic arose, our organization began fielding calls from various IT shops asking for remediation, fixes, and patches. The crazy part was that not all OpenSSL systems were impacted. Many pre-version 1 OpenSSL systems were safe. Many others were facing the challenge up correcting and fixing this serious vulnerability. Cisco, Juniper, F5, and many others were actively deploying fixes to ensure that their systems stay safe. Numerous social media giants – Facebook and LinkedIn for example – were also having to deal with OpenSSL issues. Furthermore, even though they were stating that patches have been deployed, these giants were asking all of their users to reset their passwords… just in case.

Interdependencies on cryptography library pieces can allow for a standardization around security protocols. However, it can also cause issues like Heartbleed where a number of large providers are impacted by the same very serious issue. Although cloud computing is a powerful platform, it can certainly have its “cloudier” days.

Although we’ve come a long way with cloud design, there are still some concerns and issues to overcome. There are so many moving parts that create a cloud environment that sometimes, not all of the pieces fit together entirely well. In looking at cloud computing, consider some of the following:

Many organizations often times don’t have a Data Loss Prevention (DLP) system plan in place. This means that a user, even non-maliciously, might post some information or upload a file which can contain sensitive information.

So what do you do? If you take a look at the responses from folks like Facebook, Google, and even LinkedIn, you’ll see proactive actions which address the issue immediately and sets in motion plans to fix problems like this moving forward. You can never predict the future, especially not in IT or security. But you can be vigilant and ready for things like this to happen.

New proactive security solutions like virtual security appliances give you the ability to deploy agile, powerful, and intelligent security systems anywhere within your infrastructure. The other big part is that these security platforms can be service-oriented. This means you can monitor specific network nodes and data points within a very distributed environment.

For now, cloud computing has really done a good job staying out of the spotlight when it comes to major security issues. Yes, Dropbox might accidentally delete a few of your files, or some source code becomes exposed. But the reality is that a public cloud environment hasn’t really ever experience a massive data breach. Ask yourself this question, what would happen if AWS lost 80 million records like in the very recent Anthem breach? The conversation around public cloud security would certainly shift quickly. But the reality is that they haven’t. Maybe this gives us more hope that the cloud architecture is being designed in such a way that data is properly segregated, networks are well designed, and the proper boarder security technologies are in place. It all sounds great; but the key is to never become complacent. As more organizations move to a cloud-based model, advanced persistent threats may follow.