July 02, 2008

Gartner: Seven cloud-computing security risks

Cloud computing is picking up traction with businesses, but before you jump into the cloud, you should know the unique security risks it entails

Cloud computing is fraught with security risks, according to analyst firm Gartner. Smart customers will ask tough questions and consider getting a security assessment from a neutral third party before committing to a cloud vendor, Gartner says in a June report titled "Assessing the Security Risks of Cloud Computing." 

Cloud computing has "unique attributes that require risk assessment in areas such as data integrity, recovery, and privacy, and an evaluation of legal issues in areas such as e-discovery, regulatory compliance, and auditing," Gartner says. (Compare security products.)

Amazon's EC2 service and Google's Google App Engine are examples of cloud computing, which Gartner defines as a type of computing in which "massively scalable IT-enabled capabilities are delivered 'as a service' to external customers using Internet technologies."

[ Learn more about what cloud computing really means and the new breed of utility computing and platform-as-a-service offerings. ]

Customers must demand transparency, avoiding vendors that refuse to provide detailed information on security programs. Ask questions related to the qualifications of policy makers, architects, coders and operators; risk-control processes and technical mechanisms; and the level of testing that's been done to verify that service and control processes are functioning as intended, and that vendors can identify unanticipated vulnerabilities.

Here are seven of the specific security issues Gartner says customers should raise with vendors before selecting a cloud vendor.

1. Privileged user access. Sensitive data processed outside the enterprise brings with it an inherent level of risk, because outsourced services bypass the "physical, logical and personnel controls" IT shops exert over in-house programs. Get as much information as you can about the people who manage your data. "Ask providers to supply specific information on the hiring and oversight of privileged administrators, and the controls over their access," Gartner says.

2. Regulatory compliance. Customers are ultimately responsible for the security and integrity of their own data, even when it is held by a service provider. Traditional service providers are subjected to external audits and security certifications. Cloud computing providers who refuse to undergo this scrutiny are "signaling that customers can only use them for the most trivial functions," according to Gartner.

3. Data location. When you use the cloud, you probably won't know exactly where your data is hosted. In fact, you might not even know what country it will be stored in. Ask providers if they will commit to storing and processing data in specific jurisdictions, and whether they will make a contractual commitment to obey local privacy requirements on behalf of their customers, Gartner advises.

Close

On Twitter now

Security

Powered by Twitter

On Twitter now

White Paper

D2D Virtual Tape Library Replication Primer

This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.

Download now »

White Paper

An Alternative to Virtualization for Datacenter Cost Savings

Server virtualization is a popular option for dealing with mounting datacenter costs. Another equally promising approach is the use of an Application Delivery Controller. Citrix NetScaler provides a low-cost way for organizations to reduce their server count and accrue cost savings from a reduction in space, cooling, power and personnel.

Download now »

White Paper

Why Your Firewall, VPN, and IEEE 802.11i Aren't Enough to Protect Your Network

The emergence of WLANs has created a new breed of security threats to enterprise networks.

Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation

Download now »

White Paper

Bringing the Edge to the Data Center

Effectively address data protection challenges, implementing solutions that help store and protect business–critical data while cutting costs and improving efficiency and reliability.

Download now »
Rajesh Kanungo 21-Oct-09 11:11am
Cloud computing does have its uses. Customers have come to rely on many services provided by the presence of broadband and cloud computing has been a natural progression of things to come. As a security professional, I have noted that Cloud Computing, however, generally does not come with the kind of guarantees one would like, especially in the are of security being mandated by state and federal regulations (see below for links to blogs on IT Security aspects of Massachusetts and Nevada Personal Information Privacy law). Cloud computing typically use massive computing power, a large number of Virtual Machines, large storage farms, and, obviously, high bandwidth network connectivity. Hence, customers need to ask the following questions before they store personal information in the cloud: 1. Can they meet Personal Information privacy laws as defined by many states? 2. Can they meet Credit Card standards (PCI-DSS) if you handle credit card information? 3. What are the guarantees that the data is used only as defined by law. For example, if I am a psychiatrist and my patient contact information gets backed up, does it mean that clod services can trawl through the patient records and do whatever they do without the written consent of the patient. 4. Virtual Machine Isolation and security: How are virtual machines kept secure? For example, is it possible for one Virtual Machine to crawl raw buffers of memory and extract information that was left there by another VM? A hacker could take advantage of many flaws in the VMs to attack other VMs. What kind of security do they have for protecting against viruses. 5. What kind of Network and System security standards have they met? 6. Will they inform you of any breach? What kind of structure they have in place for reporting, handling, and preventing future breaches? 7. Where do they store backups? Offsite? Offshore? Are the protections adequate there? What are the contractual obligations? What are the laws regulating Personal Information if data is sent offshore? 8. Do they encrypt data or allow customer data to be encrypted? For more, read the following to get an idea of what I am talking about: Massachusetts Regulation 201 CMR 17 - The IT Manager's Perspective : http://www.trusttone.com/encBlog/?Tag=201+CMR+17 Summary of Nevada Personal Information Law : http://www.trusttone.com/encBlog/?Tag=NRS+603.A Rajesh Kanungo

Sign up to receive Security Resource Alerts

Subscribe to the Security Central Newsletter

Stay informed of the latest security threats and fixes.

White paper

Log Management: How to Develop the Right Strategy for Business and Compliance

This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.

Download now! »

White paper

The Essential Series: Security Information Management

Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.

Download now! »

White paper

Aberdeen: Choosing and Consuming Managed Security Services

Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.

Download now! »
©1994-2009 Infoworld, Inc.