Ellie
Cloud services refer to computing services being made available on-demand to users sourced from the web or through a cloud computing provider’s server. The server can have multiple IP addresses like 192.168.2.2, 192.168.1.1, etc. It thereby eliminates the requirement of companies to set up their on-premises servers to share resources and facilitates technological flexibility along with cost-optimization.
The wastage of resources also tends to get minimized as the users access the necessary resources necessary only and pay for the same.
Public clouds refer to computing platforms, owned and managed by third-party intermediaries, wherein accumulated pools of virtual resources are made accessible to the public, i.e., potential clients. The funds tend to vary by providers and can range from including virtual machines to applications, databases, intelligence, and storage capabilities.
However, public cloud services are attached to certain critical risks that cannot be overlooked. These include:
-
Risk of an incorrect evaluation of a Public cloud provider
Several considerations on all possible security concerns have to be borne in mind and taken into account while selecting a public cloud provider. These security concerns include obtaining answers to a plethora of questions such as:
- How are viruses and malware prevented in the cloud equipment and its resources, which are provisioned to access by multiple users?
- How often do the cloud equipment undergo vulnerability scans to detect possible vulnerabilities, and what is the average time frame required for any remediation to be carried out?
- Do the cloud servers and materials possess a proper intrusion prevention system and do these systems undergo periodic auditing?
- Is there a provision of implementing firewalls between the users of the resources?
- Are the access requests to resources provided logged and monitored thoroughly?
- For the client systems, what are the data recovery procedures in place, and what is the average data recovery time frame?
- Do cloud providers facilitate hard drive encryption or not?
- What methodology is followed for the client management of servers?
All the above parameters are of paramount importance, and finding relevant, correct answers is a must but is undoubtedly extremely challenging. Any error at the end of the client company in verifying details could lead to a faulty evaluation of public cloud providers, the consequences of which are to be borne by the client users.
-
Risk of consequences of errors on the part of one client being taken by multiple clients
Another chance of public cloud service is that while sharing the cloud space, the fellow users may be indirectly impacted by the action of one or a few. To quote an example, if a server that is engaged in holding multiple clients is blacklisted due to an erroneous work of one or a few, the server and the pool of resources become unavailable to all the clients who share the server without any faulty action on their part.
-
Risk of the data breach
Another risk of public cloud services is highlighted via intra-server vulnerabilities wherein there exists a possible threat of data breach. This could happen if the client virtual machines are housed upon server systems that run on outdated software that become vulnerable to be attacked and do not adequately secure the storage of database and other resources that are offered to clients on the network.
The data on other clients’ storage (their virtual disc drives) hence tends to become accessible to other clients too via shared discs and networks. This could lead to leakage of a client’s sensitive data without them even realizing the same.
-
Risk of weak authentication and identity management
Another chance of public cloud service includes that of weak authentication wherein tracing the identity of each specific user granted access to the pool of resources becomes complex.
Also, every enterprise allocates permissions of access to the database only as per individual employee’s job role and requirements.
However, it has often been the case wherein cloud service providers have failed to remove user access when the client employee leaves a particular organization or undergoes a change of job role.
-
Risk of Internal threat and account hijacking
Malicious insiders who also tend to be clients to the public cloud services can develop cloud codes for them to be accessible and exploitable by outside operators. This would lead to leakage of confidential data of an enterprise that can be used for malicious and unethical purposes.
Also, the reuse of passwords by the clients, or the use of weak or stolen passwords can lead to the hijacking of accounts, and client data can land into the wrong hands.
-
Risk of loss of data
There exists a risk of loss of cloud data in multiple ways. This could take place when the client user of the cloud service provider might accidentally modify or delete the data, or an attacker/cybercriminal gets the access of the same and removes it due to malicious intentions. Loss of data can also occur if the cloud data center is destroyed due to an unforeseen disaster.
-
The risk of malware injection
In the cloud services, the malware injection has the topmost base to eavesdrop upon your content. In layman’s language, malware injection is the authorized part of the software connected to the cloud servers.
However, when it begins operating with the cloud, the other person who injected it can steal your private content and can look over everything uploaded on your phone.
-
No authorization of services
This cyberattack is different from the other mentioned in the list. As the above are mostly for maintaining a long term presence on the object’s activities, the denial of service attack is a short term presence. In simple terms, it means that applying this would not let the legitimate user access the information or perform any activity related to it. Also, through this, it is possible to turn down other security walls like the firefox.
-
Insufficient attention paid to a security gap
Some of the issues listed above are technical. Yet, it is an utter failure for organizations that do not attempt to guard their information while uploading it on cloud services without matching customer’s expectations. In the end, it leads to a breach in the security gap, especially when the company falls under regulatory laws.
