What are the major commercial cloud infrastructure security issues?
Security on cloud is always a shared responsibility model, where the cloud providers take care of the underlying infrastructure and customer is responsible for the security of their workloads on the cloud – by using cloud security services or other 3rd party security services.
Some Common security issues – not necessarily limited to cloud
1. Data Breaches / Data Loss - Despite the fact that generally speaking, enterprise-grade cloud services are more secure than legacy architecture, there is still a potential security threat in the form of data breaches and downtime. Cloud services are highly accessible and the vast amount of data hosted on the cloud makes them an attractive target. The most prominent recent data breach is the one that happened in Equifax in 2017. It resulted in a leak of personal data of over 143 million consumers. Equifax’s developers hadn’t updated their software to fix the reported vulnerability. Hackers took advantage of this and the breach happened. Unfortunately, the number and scope of data breaches are growing every year, and no company or industry is safe.
2. Inadequate Access Management - Data breaches and enabling of attacks can occur because of a lack of scalable identity access management systems, failure to use multifactor authentication, weak password use, and a lack of ongoing automated rotation of cryptographic keys, passwords and certificates.
3. Insecure Interfaces and APIs - Cloud vendors provide their customers with a range of Application Programming Interfaces (APIs), which the customer uses to manage the cloud service. Organizations and third parties may build on these interfaces to offer value-added services to their customers. Unfortunately, not every API is entirely secure. APIs and UIs are generally the most exposed part of a system; can be the target of a heavy attack, and adequate controls protecting them from the Internet are the first line of defence and detection.
4. Denial of Service (DoS) attacks - Sometimes, the goal is not to get into the system but to make it unusable for customers. That’s called a denial-of-service attack. The purpose of the denial-of-service attack is to prevent users from accessing the applications or disrupting its workflow.