Cloud application security has been a big concern of lately due to
several data breaches occurring in the cloud services such as the icloud
hack, Target, Home Depot, United States internal Revenue system.
Therefore the security of application poses a question as where does the
responsibility of the application security lie?
Is it with the
vendor or the company or person availing the services? The answer goes
both sides, as the security aspect of the server side is only covered by
the vendor of the cloud application services the client side still
needs the security which is mostly overlooked by the people or the
companies.
The client side application security is of utmost
importance as only the server side security is not enough to protect the
application from security breaches.
The different kind of security threats which pose a great danger to the cloud application security are as follows:
Data breaches
- Account Hijacking
- Compromised credentials
- Permanent Data loss
- Shared Technologies
- Cloud service abuse
- Hacked Interface and API
Data Breaches
This
is one of the biggest threat to the cloud services because of the vast
amount of data stored on the cloud servers. The sensitivity of the data
can be imagined easily, as the cloud is storing the financial details as
well as personal details of millions of people. And if this vast amount
of data is breached in any case it will cause a downfall of the company
and also a threat to the lives of people who have been exposed due to
the breach.
Account Hijacking
This attack has been there
for a quite long time, it includes Fraud, Phishing, Software Exploits
etc. Using these kind of attacks, the cloud services can be compromised
and can lead to launching of other attacks, changing the settings of
account, manipulate transactions, uploading malwares and illegal
contents.
Compromised Credentials
The credentials are
compromised generally due to weak passwords, casual authentication, poor
key or certificate management. Also the identity access management
becomes a problem as the user access are sometimes not changed with the
job role and responsibilities or when the user leaves the organization.
Embedding
credentials and cryptographic keys in source code and leaving them in
the online repositories such as GitHub also makes a big vulnerability
which can be exploited easily. Aligning the identity with the cloud
provider needs an understanding of the security measures taken in
account.
Permanent Data Loss
Malicious hackers have gained
access to the cloud services and deleted data permanently in the past
affecting the business. Also the cloud data centers are vulnerable to
natural disasters which can swipe away the data which has been stored on
the cloud.
If the user encrypts the data before uploading to the
cloud and loses the key then data is lost. Thus the client side
protection of data should be managed and well kept. Permanent data loss
can lead to financial crisis and disruption of the working system.
Shared Technologies
As
the cloud service providers share infrastructure, platforms and
applications from different sources therefore any reconfiguration or
vulnerability in these layers affects the users and can also lead to
compromise of the users system as well as the cloud depending upon the
potential of the vulnerability.
Thus the security alone at the
cloud server side is not only the real issue, Security has to be
maintained at a vast level consisting of all the aspects of the cloud
environment. The client side also needs to be secured as the attacks
also possible from the client side due to low or no security measures.
Cloud Service Abuse
Cloud
applications are breached to gain access to the commanding position in
the cloud where the resources can be used for different malicious
purposes such as launching a DDOS attacks or sending bulk spams and
phishing emails, breaking an encryption key or hosting Malicious
content.
This abuse may lead to unavailability of the services or
can also lead to loss of data of the users stored on the cloud,
therefore it is very much necessary to secure the applications from
abuse.
Hacked Interface and API
To build an application
now the developers are using ready to use interfaces and API to make
their work simple, but these API’s and Interfaces tend to be the most
exposed part of the system as they are available freely on the internet.
Almost
every cloud service and application now offer API, IT reams are using
these interfaces to interact with the cloud services such as management,
provisioning, monitoring etc. Thus the level of threat to the cloud
services increases manifold. This requires rigorous code reviews and
penetrating testing to secure the application and services.
Conclusion
As
we see that there are a lot of possibilities of breaching your data
stored in the cloud due to the importance of data. Therefore your data
cannot be secured alone just by the cloud service provider, there is a
shear work required from the client side to protect the application and
data from the outer security threats. Therefore security audits should
be done in order to secure your precious data from threats.
Please do not hesitate to contact us for your budget security test
contact@briskinfosec.com.
Posts
