The outage wasn't caused by hackers, but there are signs that cybercriminals are exploring ways to exploit the cloud for malicious purposes. On the heels of the outage, attackers added insult to injury by flooding Google search results with malicious links, prompting the U.S. Computer Emergency Response Team (U.S. CERT) to issue a warning about potential dangers to cloud-based service sites.
The attack poisoned several thousand legitimate websites by exploiting known flaws in Adobe software to install a malicious program on victims' machines, U.S. CERT says. The program would then steal FTP login credentials from victims and use the information to spread itself further. It also hijacked the victim's browser, replacing Google search results with links chosen by the attackers. Although the victimized sites were not specifically those offering cloud-based services, similar schemes could be directed at cloud services providers.
IT organizations often make an attacker's job easier by configuring physical and cloud-based IT assets so poorly that easy-to-find-and-exploit flaws are left behind. Asked about the potential vulnerabilities in their virtualized environments, 36 percent cited misconfiguration and poor implementation, and 51 percent cited a lack of adequately trained IT staff (whose lack of knowledge leads to configuration glitches). In fact, 22 percent of respondents cited inadequate training, along with insufficient auditing (to uncover vulnerabilities) to be the greatest security risk to their company's cloud computing strategy.
It's this awareness that makes Atmos Energy's Gius proceed with caution. "We have no CSO. If we were a financial services firm it might be a different story, or if we had a huge head count," Gius says. "But we are a small-to-medium-sized company, and the staff limitations make these kinds of implementations more difficult."
Even with the right resources, security in the cloud is a matter of managing a variety of risks across multiple platforms. There's no single cloud. Rather, "there are many clouds, they're not federated, they don't natively interoperate at the application layer and they're all mostly proprietary in their platform and operation," Hoff says. "The notion that we're all running out to put our content and apps in some common [and secure] repository on someone else's infrastructure is unrealistic."
Lobel, with PricewaterhouseCoopers, says perfect security is not possible. "You have to actively focus on the security controls while you are leaping to these services," he says. It's difficult for companies to turn back once they have let their data and applications loose because they are often quick to rid themselves of the hardware and skills they would need to bring the services back in-house.