threats – T Clouds Project

There are a variety of reasons someone might be hacking your information, with any Cloud service there is going to be a wealth of data. Remember, whatever your reason for choosing one Cloud provider over another, other people are likely making similar choices for similar reasons. In addition, with more and more people moving their data to the Cloud, the increase in payoff for the hacker attracts more sophisticated hackers. Hackers will use a number of entry points to get into the Cloud provider. A lot of the vulnerabilities are in the interface between you and the Cloud provider. A Cloud service should be using the most sophisticated techniques to secure your data on their end. But remember that an API gives access to the server, in limited formats, to any one using the UI or API.

An API, or Application Programming Interface, is is similar to a UI, or User Interface. Though often used similarly, the two can offer varying services depending on who is using the term. An interface is the way a user interacts with some program or programs; an API provides access to the service. It is a program that you can operate from a remote location. This interface provides a key security loophole that can be exploited because the Cloud provider is giving access to the user. It can seem an obvious problem, and in some respects it is, in addition some API’s give access to the Cloud customer’s customer. Some companies or individuals are using Cloud services to offer back up and security to their prospective clients.

There is no one-step way to prevent hackers, a lot depends on the systems you are using. For every system there are going to periodic vulnerabilities, but staying up to date with the latest patches for your software is important. Researching known vulnerabilities is also important. There are various companies which you can hire to keep you abreast of vulnerabilities and problems that occur.

A lot of Hackers are increasing their efforts towards spear phishing, spear phishing is a way to find out passwords or answers to security question through indirect means. After discovering who has access, a hacker will look through public information about that customer, and even a username that might be given away by the employee. The most basic thing you can do to thwart hackers is to educate your employees on the various threats to security. What could seem like an innocuous question, or email attachment, can very well be the opening to an attack. The basics are simple, verify everything. If you aren’t sure of the website, or an email attachment, then do a little research into it. Perhaps you are getting a call from someone saying they are a provider; find out for sure by calling them back.

Hackers have a variety of reasons to get your information, sometimes to sell it to other hackers who can use your usernames and passwords to log into other sites. Suffice to say, this information is becoming more and more of a commodity it our markets. And as long as there are people who want that information, a burgeoning blackmarket for information will develop.

The difficulty is that this is all going on behind the scenes. You may have been hacked and not even know it, yet identifying what information was compromised, and the weak point in your system that allowed for the breach, is a crucial part of keeping a competitive edge in the world today. A lot of the prevention can seem vague or unnecessary to keep your data safe, but it is vital to understand security and your Cloud provider.

Although most organizations are shifting their data to the cloud, security of such data has remained a serious challenge. For you to plan on how to handle the risks, it is good for you to first understand the risks posed to your data in the cloud service. The on-demand nature of this service poses a threat to the data. As it has been noted, with cloud services, one can bypass the organization and setup their own accounts in the cloud, and this has to be handled.
The following are the threats to cloud security:

1. Data breaches
Most of the threats faced by the cloud are similar to those of a traditional corporate network, but because of the huge amounts of data stored in the cloud servers, the providers themselves are highly targeted. The sensitive of the cloud data determines how severe the breach can be in case it occurs. Breaches regarding health information, intellectual property and trade secrets can be more severe compared to breaches on financial information. In case a data breach happens, the company may end up facing criminal charges, lawsuits or fines. Investigating a breach and notifying customers about the same can be too expensive for the organization. It can lead to damaging of a brand and losing of a business, which might cost the organization for a number of years. Although cloud providers have implemented measures against security breaches, the organization should take responsibility of protecting their own data from leaking to unauthorized individuals.

2. Broken authentication
When a data breach occurs, the result may be weak passwords, lax authentication, and poor management of key or certificate. Identity management is a great challenge to organizations as they find it hard for them to assign roles to users based on their job. In some cases, the organization forgets to remove access for a particular user once they have left the organization or in case their job has changed.
Systems with multi-factor authentication mechanisms such as phone authentication, one-time passwords and smartcards are a great way of securing the cloud since they make it impossible for anyone to login through stolen or guessed passwords.
Some software developers leave cryptographic keys and other credentials in the source code and then leave these in public repositories such as the Github. There is a need for us to keep keys well secured, Keys should be rotated on a regular basis to make sure that attackers do not use them.

3. Hacked APIs and Interfaces
Each cloud service has APIs. These APIs and interfaces are used by IT geeks for management of the cloud service.
The availability and security of the cloud will be determined by how secure the APIs are. Third parties who rely on these APIs and interfaces pose a security risk. When you have weak APIs and interfaces, your organization will be exposed to security issues related to integrity, confidentiality, accountability and availability.
Since interfaces and APIs can be accessed from the outside internet, they form the most exposed part of the cloud.

4. Exposed system vulnerabilities
When program bugs and system vulnerabilities are exposed, they pose challenges to cloud computing. Organizations share databases, memory and some other resources, and this creates new surfaces for attacks.
Basic IT processes can be used or mitigation attacks based on system vulnerabilities. Some of the practices for countering this include prompt patch management, vulnerability scanning, and swift follow-up on matters which are reported.

5. Account hijacking
Cloud services are prone to phishing, software exploits and frauds since the attackers are capable of manipulating transactions, eavesdropping on their activities and even modify data in transmission. Some attackers know how to use the cloud service for the purpose of launching attacks.
Organizations should not allow account credentials to be shared between users and services, and multifactor authentication mechanisms should be implemented if possible. Each transaction which occurs should be monitored and ensure that it is traceable back to the owner. The credentials of each account should be highly protected from getting stolen.

6. Malicious insiders
This can be from a system administrator, former employee, business partner or a contractor. The agenda behind this may be a revenge or data theft. The insider can choose to manipulate the organization data or maybe destroy the whole infrastructure.
The best solutions include minimizing the level of access to accounts by users and control the process of key encryption.

Tag: threats

Threats to Cloud Security