Cloud

9/16/2017
09:00 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Public, Hybrid Cloud Security Fears Abound

Most CISOs say encryption is the most effective security tool for data in the public cloud, but only one in six encrypt all data stored there.

The transition to the public cloud is a major concern for security leaders, but many haven't adopted the tools to address their biggest fears.

Security firm Bitdefender polled 1,051 IT security pros to learn more about the pressures of cloud migration as part of its report "Virtualization's hidden traps: Security has become a battlefield for CISOs." Respondents represent large businesses (1000+ PCs and data centers) based in the United States, the UK, France, Italy, Sweden, Denmark, and Germany.

Senior eThreat analyst Bogdan Botezatu says the high number of respondents concerned with public cloud security doesn't hold within the bigger picture: when asked about the most concerning data points, 22% of respondents encrypt already-migrated data.

"This was the first finding that took us a little bit by surprise," he says. "Twenty-two percent of information encrypted is very, very low."

To put that number into context, about 82% of CISOs surveyed say encryption is the most effective security mechanism to protect public-cloud data. Security software was next, cited by 75% of those surveyed, followed by backups, trusted by half of respondents.

Researchers found one-third of US companies secure 31% to 60% of data stored in the public cloud. Only 20% encrypt all data stored there. Fifteen percent of CISOs don't deploy security in the public cloud, and 17% don't encrypt data in transit from their data center to an external one.

Why only encrypt part of the data? "Some companies only encrypt information they are legally required to encrypt," says Botezatu. This usually includes financial information but does not extend to emails, chats, communications, or anything beyond financial data.

"It's something we have seen in the past and could have anticipated … encryption requires more processing power and is more complicated than storing information in plaintext," he continues. "Companies that don't have access to hardware will prioritize what they encrypt and where they will store that information … it's a security versus performance tradeoff."

Security leaders' biggest security concern is information stored in the public cloud will unintentionally be made public. They are focusing more on data leaks and less on other types of cyberattacks like malware, phishing, or other threats that could affect their infrastructure.

A data leak could potentially be devastating, especially to an organization with fewer resources, says Botezatu, who cites the Ashley Madison incident as an example.

"There are plenty of other examples of smaller companies who don't have the financial powers of the big companies to defend their users against identity theft or misuse of their personal information," he explains.

Hybrid Cloud, Hybrid Problems

The rise of hybrid cloud, already in place at 70% of global companies, is giving way to a new set of security challenges. CISOs are exploring new technologies to fight zero-days, advanced persistent threats (APTs), and other types of related threats.

Some of the biggest challenges in securing the hybrid cloud include synchronizing the public and private clouds, determining what happens with interconnectivity in case of an outage, meeting legislation to ensure information doesn't illegally transfer to another data center, and protecting all of this information stored under such a large attack surface, Botezatu explains.

"People have realized backups are tricky and rarely validated, and access to the backup is also often not restricted," he continues. "When you have a cloud you can take backups everywhere -  chances are at some point, you forget about those backups and who has access to them."

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

The question of who has access to backups, and who has access to virtual machine snapshots, are considered some of the biggest issues with virtualization. All of the virtual machines you create have users that could use them as backdoors if they become disgruntled employees.

Botezatu suggests perhaps encryption will become more broadly used when the EU's GDPR goes into effect in May 2018. Many businesses still struggle to comply with new regulations, which require data be adequately protected. When breaches occur, businesses must have notification capabilities that align with GDPR standards. Gartner anticipates by the end of 2018, more than half of companies affected by GDPR will not fully comply with the requirements.

More CISOs have started to become part of the board, which Botezatu says could help them implement good practices. Many CIOs and CISOs are confronted with underfunding because they typically answer to the financial department; not the board. A company should spend 20% of their revenue on ensuring security, he says, but "this never happens."

If the board understands security should be an important discussion, like a business operation, those 20% of investments will be granted. Securing the data center is as important as securing your own premises.

"They need to be very careful about their budgets and the way they invest in security," says Botezatu of business leaders. "They need to understand the days where companies operate in a brick-and-mortar building are over now."

Related Content:

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance & Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kaspersky Lab Seeks Injunction Against US Government Ban
Jai Vijayan, Freelance writer,  1/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.