Cloud

9/16/2017
09:00 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Public, Hybrid Cloud Security Fears Abound

Most CISOs say encryption is the most effective security tool for data in the public cloud, but only one in six encrypt all data stored there.

The transition to the public cloud is a major concern for security leaders, but many haven't adopted the tools to address their biggest fears.

Security firm Bitdefender polled 1,051 IT security pros to learn more about the pressures of cloud migration as part of its report "Virtualization's hidden traps: Security has become a battlefield for CISOs." Respondents represent large businesses (1000+ PCs and data centers) based in the United States, the UK, France, Italy, Sweden, Denmark, and Germany.

Senior eThreat analyst Bogdan Botezatu says the high number of respondents concerned with public cloud security doesn't hold within the bigger picture: when asked about the most concerning data points, 22% of respondents encrypt already-migrated data.

"This was the first finding that took us a little bit by surprise," he says. "Twenty-two percent of information encrypted is very, very low."

To put that number into context, about 82% of CISOs surveyed say encryption is the most effective security mechanism to protect public-cloud data. Security software was next, cited by 75% of those surveyed, followed by backups, trusted by half of respondents.

Researchers found one-third of US companies secure 31% to 60% of data stored in the public cloud. Only 20% encrypt all data stored there. Fifteen percent of CISOs don't deploy security in the public cloud, and 17% don't encrypt data in transit from their data center to an external one.

Why only encrypt part of the data? "Some companies only encrypt information they are legally required to encrypt," says Botezatu. This usually includes financial information but does not extend to emails, chats, communications, or anything beyond financial data.

"It's something we have seen in the past and could have anticipated … encryption requires more processing power and is more complicated than storing information in plaintext," he continues. "Companies that don't have access to hardware will prioritize what they encrypt and where they will store that information … it's a security versus performance tradeoff."

Security leaders' biggest security concern is information stored in the public cloud will unintentionally be made public. They are focusing more on data leaks and less on other types of cyberattacks like malware, phishing, or other threats that could affect their infrastructure.

A data leak could potentially be devastating, especially to an organization with fewer resources, says Botezatu, who cites the Ashley Madison incident as an example.

"There are plenty of other examples of smaller companies who don't have the financial powers of the big companies to defend their users against identity theft or misuse of their personal information," he explains.

Hybrid Cloud, Hybrid Problems

The rise of hybrid cloud, already in place at 70% of global companies, is giving way to a new set of security challenges. CISOs are exploring new technologies to fight zero-days, advanced persistent threats (APTs), and other types of related threats.

Some of the biggest challenges in securing the hybrid cloud include synchronizing the public and private clouds, determining what happens with interconnectivity in case of an outage, meeting legislation to ensure information doesn't illegally transfer to another data center, and protecting all of this information stored under such a large attack surface, Botezatu explains.

"People have realized backups are tricky and rarely validated, and access to the backup is also often not restricted," he continues. "When you have a cloud you can take backups everywhere -  chances are at some point, you forget about those backups and who has access to them."

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

The question of who has access to backups, and who has access to virtual machine snapshots, are considered some of the biggest issues with virtualization. All of the virtual machines you create have users that could use them as backdoors if they become disgruntled employees.

Botezatu suggests perhaps encryption will become more broadly used when the EU's GDPR goes into effect in May 2018. Many businesses still struggle to comply with new regulations, which require data be adequately protected. When breaches occur, businesses must have notification capabilities that align with GDPR standards. Gartner anticipates by the end of 2018, more than half of companies affected by GDPR will not fully comply with the requirements.

More CISOs have started to become part of the board, which Botezatu says could help them implement good practices. Many CIOs and CISOs are confronted with underfunding because they typically answer to the financial department; not the board. A company should spend 20% of their revenue on ensuring security, he says, but "this never happens."

If the board understands security should be an important discussion, like a business operation, those 20% of investments will be granted. Securing the data center is as important as securing your own premises.

"They need to be very careful about their budgets and the way they invest in security," says Botezatu of business leaders. "They need to understand the days where companies operate in a brick-and-mortar building are over now."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
7 Ways to Keep DNS Safe
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Locked device, Ha! I knew there was another way in.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-15137
PUBLISHED: 2018-07-16
The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed.
CVE-2017-17541
PUBLISHED: 2018-07-16
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature.
CVE-2018-1046
PUBLISHED: 2018-07-16
pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow ...
CVE-2018-10840
PUBLISHED: 2018-07-16
Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image.
CVE-2018-10857
PUBLISHED: 2018-07-16
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.