Black linings: security threats to cloud computing

David Heath
Thursday, 04 March 2010 21:51

Business IT - Security

At this week's RSA Conference in San Francisco, the Cloud Security Alliance announced research into the major security threats that might impact the use of cloud computing.

Clouds may-well be green on the outside but it is becoming very clear that there are dark and stormy corners which may not be obvious from the casual observer.

According to the report, the purpose of the Cloud Security Alliance's study was to "provide needed context to assist organizations in making educated risk management decisions regarding their cloud adoption strategies." 

Also, according to the accompanying press release, "The research was conducted to provide cloud clients with greater visibility into specific security threats relevant to cloud services in order to more accurately assess the risks and benefits of cloud adoption strategies. This research complements the CSA's flagship Security Guidance for Critical Areas of Focus, which provides advice on best practices."

Intentionally, the risks are not provided in any particular order; the CSA observing that "The exercise helped validate that our threat listing reflected the critical threat concerns of the industry, however the cumulative ranking did not create a compelling case for a published ordered ranking, and it is our feeling that greater industry participation is required to take this step."

The first threat is "Abuse and nefarious use of cloud computing."  This relates to the ease with which criminals have access to Cloud services to conduct illegal activities.  "Areas of concern include password and key cracking, DDOS, launching dynamic attack points, hosting malicious data, botnet command and control, building rainbow tables, and CAPTCHA solving farms."

To a major extent, Cloud vendors have brought this issue upon themselves due to the ease with which they can provide services either through try-before-you-buy offers or a "frictionless registration process where anyone with a valid credit card can register and immediately begin using cloud services."