Cloud security is one of the greatest concerns of business leaders today as cloud computing comes with a bunch of substantial benefits including high scalability, cost savings and performance optimization but it still meets many possible security threats. While the following top five does not cover all security risks for cloud services, this list is a good starting point in identifying what cloud-related threats you should concern most when using cloud services.
- Account or Service Traffic Hijacking
In this type of security breach, hackers exploit software vulnerabilities such as buﬀer overﬂow attacks, and loss of passwords and credentials to take control over a user account. An attacker can use the stolen account information to carry out malicious or unauthorized activities such as eavesdropping on data and transactions, providing false information to customers, or redirecting customers to illegitimate sites. At the enterprise level, this phishing can destroy company integrity and reputations built over years. So protect yourself by running vulnerability scans to detect potential hijacking points or vulnerabilities.
- Data Breaches
The last year witnessed the huge numbers of breaches, and so far 2015 hasn’t been far behind as this year the data breaches at many organizations captured the attention of the media such as retail giant CVS, The IRS, Kaspersky Lab, etc. Data breaches have become more widespread, and the cost incurred for each breach is rising for organizations around the world. It is predicted that eventually, the big data breach may not be targeted at speciﬁc ones, but at the hypervisor or virtual machines, thus exposing various companies at once. Applying two-factor authentication can be a good solution to reduce the threats of the data breaches.
- Data Loss
While data breaches are the result of malicious and probably intrusive actions, data loss may occur as a result of negligence or mistakes, for instance, when a disk drive dies without its owner having created a backup. The loss can also occur if a staff loses an encryption key for data and the company no longer has a way to unlock it. For both consumers and businesses, the possibility of permanently losing one’s data is really scary. There are a lot of techniques to prevent data loss but they occur anyway due to human error.
- Insecure APIs
The cloud era has come with the contradiction of trying to distribute their services to a wide range of users while minimizing damage that all these anonymous users might do to the service. This issue is solved by a public facing application programming interface, or APIs, which deﬁne how outside applications interact with the primary application. There is increasing number of APIs being built to make interacting with services easier and sturdier. Nonetheless, it also entails potential risks, as organizations are required to relinquish their credentials to third parties in order to enable their agency. According to Cloud Security Alliance, to protect yourself against insecure APIs, you have to understand the security implications associated with the usage, management, orchestration, and monitoring of cloud services.
- Denial of service
Denial of Service is nothing new as it has been an Internet risk for years, but it becomes more difficult to deal with in the age of cloud computing. These attacks can insert great impact on multiple customers, not just one targeted organization. When a denial of service attacks a customer’s cloud service, it may impair service without shutting it down, in which case the customer will be billed based on computer cycles and all resources consumed during the attack. Unrelenting denial of service attacks may make it too pricey for you to run your service and you’ll have to take it down yourself.