Enterprises Should Practice For Cloud Security Breaches

Companies are increasingly moving to cloud: Over the 18 months ending June 2013, enterprises boosted their use of cloud storage by 90 percent, resulting in 45 percent more revenue for cloud service providers, according to report released by Verizon.

Yet businesses should expect bumps ahead. Attackers will increasingly focus on finding ways to compromise companies' cloud services to gain access to the valuable data stored in those online systems. From the attempted digital coup on CloudFlare's infrastructure to breaches at businesses services such as social network LinkedIn and e-mail marketing firm Epsilon Data Management, attackers have already shown interest in illicitly accessing enterprise data in the cloud.

While the security of cloud provides is typically better than the average company, breaches will happen, experts say. And responding to an incident will likely be more complex for businesses when the response includes a cloud provider's infrastructure.

"The key here is to plan ahead," says Kristy Westphal, information security officer with Element Payment Services, a secure payment processing firm recently acquired by Vantiv. "You need to know what is in your contract, what you can get access to, and what you are on the hook for."

At the coming Cloud Security Alliance (CSA) Congress, Westphal plans to discuss strategies for minimizing the impact of a cloud breach and smoothing incident response. As a first step, companies should begin including their cloud providers in their incident response planning, finding the appropriate contact at the firm, and discovering what resources they can expect in the event of a breach.

Companies need to know the provider's contractual obligations because there is often a murky line between the cloud provider's responsibilities and the customer's responsibilities, says Dave Dalva, vice president in the risk consulting practice at Stroz Friedberg.

In addition, companies should be familiar with the provider's technologies, such as what mechanisms the cloud firm has for logging, he says. In multitenant cloud environments, separating the logs of one client from another may be difficult. Businesses should also find out whether the provider will preserve data and hard drives for later forensics, and whether that is even possible in the cloud environment.

You need to make the lines of responsibility very clear, Dalva says.

"It may be very easy, or it may be very hard, but getting an appreciation for that stuff up front will make life a lot easier in the event of a breach," he says.

[What attacks are most likely against cloud computing environments? Here's a look -- and some advice. See How Cybercriminals Attack The Cloud.]

Before moving to the cloud, company management should discuss incident response with the cloud provider. Executives and IT managers should ask whether the cloud service provider offers enough assurances to protect data and respond to breaches, says Dave Anderson, senior director of marketing at Voltage Security, a data-encryption provider.

"Do you trust your cloud provider to securely or properly manage the data you are throwing up into the cloud? If the cloud providers are saying that we are not going to provide that level of end-to-end data protection for you, then it's up to you to do it," he says.

The response will also depend on the type of cloud service that a company uses: Platform-as-a-service (PaaS) and software-as-a-service (SaaS) will differ from infrastructure-as-a-service, such as Amazon EC2, because of the number of differences between cloud providers, Element's Westphal says.

The most important step for companies is to practice incident response exercises and include the cloud provider in the session, she says. IT managers should know who the point of contact is at the cloud service provider and who is responsible for contacting cloud providers.

"You need to know who the players are -- who would be involved and that they know what their roles are, so they are not trying to solve someone else's issue," Westphal says. "You can't buy that kind of preparation. The more prepared you are, the better off you will be."

While cloud providers may not provide much in terms of supporting incident response activities, that's changing, says Stroz Friedberg's Dalva.

"There is an opportunity for cloud providers that do do all the security stuff, and we are starting to see more effort to help clients with that," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.