Experts Question Security Payoff Of Sending Apps To The Cloud

The browser appears to be following email and productivity applications in a move to the cloud, but security experts are mixed on whether turning desktop applications into cloud services will deliver promised security benefits.

This month, both Authentic8 and Spike Security announced cloud services aimed at allowing customers to run their browsers in virtual machines as a service. Virtualized browsers offer privacy and security benefits, such as isolation from potential malware, which --if it breaks out of the browser sandbox -- will still infect only a virtual machine.

The browser is not alone. Other applications have moved to the cloud, as well, and have benefited from more expert management and better security models, says Nick Piagentini, senior solutions architect with CloudPassage, a startup focused on securing cloud environments. The general trend, in fact, appears to be to move many software components to the Internet in a way similar to the thin client movement in the 1990s.

"I think we are going much more toward that thin client now," Piagentini told us. "Inexpensive compute power in the cloud makes it trivial to move that sort of security intelligence out there and then to shift very simple stuff back and forth to your device."

The focus on the browser should come as no surprise. The browser is the vector of choice for attackers. More more than two-thirds of malicious code -- and 90% of malware that evades detection -- is delivered to the desktop through a browser, according to a March 2013 report from the security firm Palo Alto Network. Other attack vectors such as email and documents, which have already moved to the cloud, are more successfully guarded by traditional security software. Antivirus firms typically cover the average threat sent by email within five days, compared with 30 days for malware sent through the browser.

Scott Petry, co-founder and president of Authentic8, said all cloud-based replacements for desktop applications benefit from access to a single copy of data in the cloud, which makes it easier to secure the data. "By nature of these applications, you get better security, because you have fewer distributed copies of your data in all these places."

Yet critics of pushing additional functionality into the cloud point to virtual desktop infrastructure, which has suffered from slow adoption, as the potential fate of applications in the cloud.

"There are a bunch of potential pitfalls that people face and why VDI has not taken off as some people had hoped, and performance is one of the big issues," said Rajiv Gupta, CEO of the cloud security management vendor Skyhigh Networks.

Petry stresses that putting the browser in the cloud is different from relying on virtual desktop infrastructure. He tells the story of one client that moved all its workspaces to VDI with Internet Explorer as the browser. When one employee clicked on a malicious link, the resulting attack -- the ransomware Cryptolocker -- still infected all the virtual machines and storage drives in the virtual workspace.

"Since they were connected to different file shares and connected to different resources, the Cryptolocker infection propagated everywhere it could," he said. "They thought they moved to the cloud for security reasons, but it was the same unprotected browser that users were putting their credentials into."

Though the browser is the current focus of attackers, interest in that program will likely ebb and flow as attackers shift in response to defenders' tactics, Petry said. "The fact that the browser is No. 1 is because it is least protected thing right now, but as soon as that is protected, the bad guys will move on to the next soft target."