Top Threats to Cloud Computing


Here at Cyber Security News, we have covered the security implications of Cloud computing quite a lot. While the benefits of using Cloud are evident (reduced costs, increased flexibility, improved choice and efficient usage) there are also security implications that all organisations need to be aware of. The Cloud Service Security Checklist we have composed gives a good idea of the types of controls that will minimize this risk, and all cloud service providers and consumers should be aware of these. But what are the threats you are protecting against? What are the types of vulnerabilities attackers may look for? And why are cloud services so valuable to attackers?

Well, let’s start by looking at what cloud services actually are. Most of the time, cloud services are hosted in a virtualised environment where the consumer is able to utilize multiple virtual machines depending on their requirements. The benefit of cloud services is that they are flexible, if the consumer needs more machines then new virtual machines are created and offered to the customer. This sounds great, in practice. From a security perspective, the risk is in the fact that this is a multi-tenanted environment. That is, your virtual machine is sitting right next to another consumers virtual machine on the same physical box (or hypervisor).

So, why does this cause any issues? Surely the cloud service provider has tested this to make sure that attackers cannot “break out” of virtual machines and access your virtual machine? Well, you would hope so. But a lot of the time, service providers are focused on minimizing their costs for infrastructure and maximizing their client base. The only number they will be concerned with is in terms of memory and processing power – as if the service goes down then the provider will be liable under their service level agreement.

With this in mind, it is clear that organisations need to be aware of the top threats to cloud computing. The Cloud Security Alliance have published guidance regarding the top threats to cloud computing. In their article, the Cloud Security Alliance identify Abuse and Nefarious Use of Cloud Computing, Insecure Application Programming Interfaces, Malicious Insiders, Shared Technology Vulnerabilities, Data Loss/Leakage, Account, Service & Traffic Hijacking and Unknown Risk Profile’s as the highest threats to Cloud services. This article will look at a small proportion of these, however, it is worthwhile checking out the CSA website as well for useful information.

Malicious insiders is one of the main threats identified by the CSA and we will discuss that further here. Every organisation is used to having malicious insiders as one of the main threats to their assets, however, in this case the malicious insiders are not specifically within the boundaries of the organisation. In this case, malicious insiders are also those working for the cloud service provider. For example, system administrators at the provider side will have access to a wide range of your data, as well as numerous other customers. If an administrator were to harvest data to sell this could be very lucrative. Therefore, it is imperative that you ensure that the service providers staff are cleared and have been background checked appropriately before storing any sensitive data in a cloud environment that is managed outside of your organisation.

Another interesting point is loss of data. That is ultimately the biggest risk with cloud computing, loss of sensitive, personal or financial data that may be stored or processed in that environment. How can this risk be managed? The same as in a traditional network environment – authentication, encryption of comms, monitoring of activity and managing the service relationship via SLA’s and other mechanisms. The same controls should be applied to a cloud environment, however, the responsibility may rest with the provider rather than you so you need to check that these controls have been implemented. You should check that the provider has implemented strong authentication mechanisms, encryption for data at rest and in transit and strong key generation, storage and destruction. As with any security, controls should be implemented at each layer of the OSI model to provide defence in depth.

About Lee Hazell

Lee Hazell is a cyber security consultant with a keen interest in anything tech or security related. Follow Lee on .

Leave a Reply

Your email address will not be published. Required fields are marked *