Cloud computing continues to transform the way companies use, store, and share data, applications, and workloads. It has also introduced a range of new security threats and challenges. With so much data going into the cloud — and into public cloud services in particular — these resources become natural targets for hackers. Here are the top issues in cloud security:
1.Data Breaches
A data breach might be the primary objective of a targeted attack or simply the result of human error, application vulnerabilities, or poor security practices. It might involve any kind of information that was not intended for public release, including personal health information, financial information, personally identifiable information, trade secrets, and intellectual property. A company’s cloud-based data may have value to different parties for different reasons. The risk of data breach is not unique to cloud computing, but it consistently ranks as a top concern for cloud customers.
2. Insufficient identity credentials and access management
Bots masquerading as legitimate users, operators, or developers can read, modify, and delete data; issue control plane and management functions; snoop in data in transit or release malicious software that appears to originate from a legitimate source. A consequence of insufficient identity credentials and poor password management can result in unauthorized access to data, and potentially cause catastrophic damage to companies or end users.
3. Insecure interfaces and application programming interfaces (APIs)
Cloud providers expose a set of software user interfaces (UIs) or APIs that customers use to manage and interact with cloud services. Provisioning, management, and monitoring are all performed with these interfaces, and the security and availability of general cloud services depend on the security of API. They need to be designed to protect against accidental and malicious attempts to circumvent policy.
4. System vulnerabilities
System vulnerabilities are exploitable bugs in programs that attackers can use to infiltrate a system to steal data, taking control of the system or disrupting service operations. Vulnerabilities within the components of the operating system put the security of all services and data at significant risk. With the advent of multi-tenancy in the cloud, systems from various companies are placed close to each other and given access to shared memory and resources, creating a new attack surface.
5. Account hijacking
Account or service hijacking is not new, but cloud services add a new threat to the landscape. If attackers gain access to a user’s credentials, they can eavesdrop on activities and transactions, manipulate data, return falsified information and redirect clients to illegitimate sites. Account or service instances might become a new base for attackers. With stolen credentials, attackers can often access critical areas of cloud computing services, allowing them to compromise the confidentiality, integrity, and availability of those services.
6. Advanced persistent threats (APTs)
APTs are a parasitical form of cyber attack that infiltrates systems to establish a foothold in the IT infrastructure of target companies, from which they steal data. APTs pursue their goals stealthily over extended periods of time, often adapting to the security measures intended to defend against them. Once in place, APTs can move laterally through data centre networks and blend in with normal network traffic to achieve their objectives.
7. Data loss
Data stored in the cloud can be lost for reasons other than malicious attacks, CSA says. An accidental deletion by the cloud service provider, or a physical catastrophe such as a fire or earthquake, can lead to the permanent loss of customer data unless the provider or cloud consumer takes adequate measures to back up data, following best practices in business continuity and disaster recovery.
Don’t want to lose your data? Choose IDM and forget about problems listed above!
