Cloud's Future Security Depends On Mobile

As more companies move some part of their infrastructure to the cloud, an increasing amount of corporate data will be accessed from anywhere in the world.

Great for productivity? Yes, but it's also a security threat, a panel of experts stressed on Monday at the Cloud Security Alliance (CSA) Summit in San Francisco. In many cases, the only security measure standing between an attacker and the company's data is a username and password. Even with strong password policies, that can be too little security, says Patrick Harding, chief technology officer for identity and access management firm Ping Identity.

"Passwords are the Achilles heel of cloud security," he says. "If I can get your password ... I can get instant access to all of the data."

Instead, Harding and others see mobile devices being a key part of a person's identity. A smartphone equipped with some form of biometric security -- such as a fingerprint scanner or facial recognition -- could better verify a user's identity and strengthen the security of the gates limiting access to cloud services.

The future of mobile devices and cloud security are already heavily linked, argues Harding. Where many companies worry about employees bringing their own devices (BYOD) into the network, he worries about BYOC, the cloud services that ride into the corporate network piggybacking on mobile devices. Users that downloaded apps that have not been vetted by the company could be allowing remote access into the company. Or the user could be using an unauthorized cloud service to store company-sensitive data, he says.

"I now have the device I can use anywhere and these cloud services I can use anywhere," Harding says. "Now IT has just lost control."

Beset with employees using devices, companies have to change their mindset and create policies to secure their data before the devices are used to send company information into the cloud, says David Lingenfelter, information security officer for mobile-device management firm Fiberlink.

"You can't separate mobile devices and cloud," he says.

Yet the industry has a ways to go before mobile devices make good gatekeepers. The incentive to drive the broad adoption of the necessary technologies for authentication on smartphones has not yet arrived, says Harding. It will take five years for the technology to trickle out into the market, he says.

In addition, the software systems to manage the process need to be developed as well, says Don Godfrey, a panel member and a security consultant at health insurer Humana. Managing corporate passwords for tens of thousands of employees is difficult enough -- adding employee-owned phones to the mix will be a headache, he says.

"When you have 40,000 associates using a phone-based authentication, while it can be very convenient, how do you -- as a company -- manage 40,000 phones?" Godfrey says.

There are other pitfalls as well. In the past, biometric security has led to increased security risk because the biometrics were stored by a security firm. It's a mistake that should not be repeated, says Ping's Harding.

"As long as you leave my biometrics out of the cloud, this will work," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.