Cloud Computing: What's to Stop You From Moving to the Cloud?

While the benefits of Cloud Computing are compelling, the risks and problems associated with the move can be difficult to overcome.  In March 2010, the Cloud Security Alliance compiled a list of the top seven risks that threaten the future of Cloud Computing.

Criminal Use of Cloud Computing – Cloud computing provides the opportunity to summon on short notice vast amounts of computer resources to be applied to any problem.  But what happens when those computing resources are used to attack other computer sites, to crack passwords, to host viruses and other malware?

Insecure SDKs and APIs for Accessing Cloud Computing –  Cloud Computing services are increasingly including aggregated services from multiple vendors and providers.  Interoperation of the services require trusted reliances between the different services.   If any one of the different layers of APIs from the different vendors has a security weakness, there is potential that data across all of the services could be put at risk.  In this way it is harder to guarantee security across all of the layers.

Threat from Insiders – IT personnel working at Cloud providers have access to huge am0unts of data from many different organizations.  WikiLeaks proves a good example of what happens when a single person with unlimited access to a system can compromise vast amounts of data.

Breakdown of Separation Between Customer Data – Many SaaS and Cloud-based applications allow customers to share both hardware and software resources.  Often customer data is intermingled with multi-tenancy or in parallel virtual machines running on the same physical server.  In the perfect world, the barriers between customer data never leak.  But the world isn’t perfect.  Through software bugs or human error, leaks could happen which could inadvertently expose data from one cloud customer to another.

Loss of Data – Storing data in the cloud puts responsibility on the cloud provider to backup and protect customer data.  But again, we don’t live in a perfect world.  Hardware failure and data recovery plans can fail, so this remains a risk.  Customers are advised to check the processes and data recovery plans of their cloud provider.

Account Hijacking – Phishing, fraud and a variety of social engineering tactics can be applied to gain unauthorized access to systems.  This is not that much different than for traditional computing risk, but typically cloud services are available on the internet, exposing the entry point much more easily as a starting point for an attack.

Hard to Track and Verify Security Measures – Again because many vendors and elements might be aggregated as part of a cloud solution, it is hard to ensure that all parties of the solution are complying with stated  security levels.