July 02, 2008

Gartner: Seven cloud-computing security risks

Cloud computing is picking up traction with businesses, but before you jump into the cloud, you should know the unique security risks it entails

Cloud computing is fraught with security risks, according to analyst firm Gartner. Smart customers will ask tough questions and consider getting a security assessment from a neutral third party before committing to a cloud vendor, Gartner says in a June report titled "Assessing the Security Risks of Cloud Computing." 

Cloud computing has "unique attributes that require risk assessment in areas such as data integrity, recovery, and privacy, and an evaluation of legal issues in areas such as e-discovery, regulatory compliance, and auditing," Gartner says. (Compare security products.)

Amazon's EC2 service and Google's Google App Engine are examples of cloud computing, which Gartner defines as a type of computing in which "massively scalable IT-enabled capabilities are delivered 'as a service' to external customers using Internet technologies."

[ Learn more about what cloud computing really means and the new breed of utility computing and platform-as-a-service offerings. ]

Customers must demand transparency, avoiding vendors that refuse to provide detailed information on security programs. Ask questions related to the qualifications of policy makers, architects, coders and operators; risk-control processes and technical mechanisms; and the level of testing that's been done to verify that service and control processes are functioning as intended, and that vendors can identify unanticipated vulnerabilities.

Here are seven of the specific security issues Gartner says customers should raise with vendors before selecting a cloud vendor.

1. Privileged user access. Sensitive data processed outside the enterprise brings with it an inherent level of risk, because outsourced services bypass the "physical, logical and personnel controls" IT shops exert over in-house programs. Get as much information as you can about the people who manage your data. "Ask providers to supply specific information on the hiring and oversight of privileged administrators, and the controls over their access," Gartner says.

2. Regulatory compliance. Customers are ultimately responsible for the security and integrity of their own data, even when it is held by a service provider. Traditional service providers are subjected to external audits and security certifications. Cloud computing providers who refuse to undergo this scrutiny are "signaling that customers can only use them for the most trivial functions," according to Gartner.

3. Data location. When you use the cloud, you probably won't know exactly where your data is hosted. In fact, you might not even know what country it will be stored in. Ask providers if they will commit to storing and processing data in specific jurisdictions, and whether they will make a contractual commitment to obey local privacy requirements on behalf of their customers, Gartner advises.

Close

On Twitter now

Security

Powered by Twitter

On Twitter now

White Paper

D2D Virtual Tape Library Replication Primer

This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.

Download now »

Trial

Free 30-Day Desktop Virtualization Trial

Download a free 30–day trial and experience how XenDesktop delivers a pristine, on–demand desktop experience to users on whatever device they choose, while cutting IT complexity and costs.

Download now »

White Paper

Why Your Firewall, VPN, and IEEE 802.11i Aren't Enough to Protect Your Network

The emergence of WLANs has created a new breed of security threats to enterprise networks.

Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation

Download now »
Rajesh Kanungo 21-Oct-09 11:11am
Cloud computing does have its uses. Customers have come to rely on many services provided by the presence of broadband and cloud computing has been a natural progression of things to come. As a security professional, I have noted that Cloud Computing, however, generally does not come with the kind of guarantees one would like, especially in the are of security being mandated by state and federal regulations (see below for links to blogs on IT Security aspects of Massachusetts and Nevada Personal Information Privacy law). Cloud computing typically use massive computing power, a large number of Virtual Machines, large storage farms, and, obviously, high bandwidth network connectivity. Hence, customers need to ask the following questions before they store personal information in the cloud: 1. Can they meet Personal Information privacy laws as defined by many states? 2. Can they meet Credit Card standards (PCI-DSS) if you handle credit card information? 3. What are the guarantees that the data is used only as defined by law. For example, if I am a psychiatrist and my patient contact information gets backed up, does it mean that clod services can trawl through the patient records and do whatever they do without the written consent of the patient. 4. Virtual Machine Isolation and security: How are virtual machines kept secure? For example, is it possible for one Virtual Machine to crawl raw buffers of memory and extract information that was left there by another VM? A hacker could take advantage of many flaws in the VMs to attack other VMs. What kind of security do they have for protecting against viruses. 5. What kind of Network and System security standards have they met? 6. Will they inform you of any breach? What kind of structure they have in place for reporting, handling, and preventing future breaches? 7. Where do they store backups? Offsite? Offshore? Are the protections adequate there? What are the contractual obligations? What are the laws regulating Personal Information if data is sent offshore? 8. Do they encrypt data or allow customer data to be encrypted? For more, read the following to get an idea of what I am talking about: Massachusetts Regulation 201 CMR 17 - The IT Manager's Perspective : http://www.trusttone.com/encBlog/?Tag=201+CMR+17 Summary of Nevada Personal Information Law : http://www.trusttone.com/encBlog/?Tag=NRS+603.A Rajesh Kanungo

Sign up to receive Security Resource Alerts

Subscribe to the Security Central Newsletter

Stay informed of the latest security threats and fixes.

White paper

Comprehensive Data Protection for Storage Appliances

With the continuous expansion of data capacity, completing the full cycle of a scheduled scan can be a very time consuming process. Find out how to efficiently secure EMC Celerra with centralized virus scanning, virus pattern file updates, event reporting and antivirus configuration.

Download now! »

White paper

Secure Celerra Environments with Minimal Overhead

A single virus-infected file in a storage system can be responsible for infecting large amounts of data. This white paper details the architecture and product features of Trend Micro's data storage security solution, ServerProtect, and discusses how it has been designed to protect EMC Celerra file servers with minimal overhead.

Download now! »
White paper

Keep Linux Servers Free from Malware

The increase in Linux popularity has increased the frequency and sophistication of malware attacks. Learn how you can protect your Linux environment with real-time protection that is certified by all major Linux vendors.

Download now! »

White paper

Centrally Managed Virus Protection for Windows and NetWare

With the emergence of mixed threat attacks, a failure on a single server can quickly impact the entire network. Learn how a technology that is designed to remove and block infected files on application and file servers prevents the virus from reaching users and keeps your Windows network free from malware.

Download now! »
©1994-2009 Infoworld, Inc.