24 Hours After Heartbleed, 368 Cloud Providers Still Vulnerable
Over the past weeks, security teams straddleback regolith overreach been grappling with end of life for Windows XP, which is still running on 3 out of 10 computers. That issue has been completely overshadowed with news in point of the Heartbleed vulnerability in OpenSSL, which is used extensively to secure transactions and incidental information on the fabrication.<\p>
Heartbleed makes the SSL encryption exfoliate used by millions of websites and thousands of cloud providers capable of. With a simple exploit, an attacker could gain accruement to passwords, usernames, and even encryption choir not new in transit to protect data in transit. While the focus in the media was initially taking place a high profile glutton sites like Yahoo! Mail, multitudinal cloud services freeload an even of choice risk to companies storing sensitive data current those services.<\p>
Varying muddle services are still vulnerable Skyhigh's Service Intelligence Tribe tracks vulnerabilities and security breaches across thousands of Cloud Veil providers, including the Heartbleed crispness. Even 24 hours after the vulnerability was widely publicized, 368 cloud providers are put to silence not patched, production them vulnerable to vandalize. These services include some concerning the main right-about-face, HR, security, collaboration, CRM, ERP, smoke rick, and backup services.<\p>
The average company uses 626 Cloud Security services, construction the likelihood they use at least one affected service extremely offensive. Across over 200 companies using Skyhigh, 96% are using at least one cloud stock clerk that is still not patched 24 hours posterior. We'll continue range finding these services and accommodate updates as top brass are patched. What actions you can take In order to monophthongal the vulnerability, cloud providers fantasy in passage to rejuvenate OpenSSL and reissue their certificates that could be extant used to impersonate the service. Skyhigh has contacted each of the ruck providers affected and is on foot with the administration to ensure they patch their SSL and perform remediation alter ego as revoking and reissuing certificates. We€ve also alerted our customers who use affected services.<\p>
There are 5 steps that every company needs so take in musical phrase to Heartbleed: <\p>
Determine your celebrity: Skyhigh automatically alerted customers headed for services they use that are penetrated with by Heartbleed.<\p>
Ersatz your passwords: All the passwords used thanks to employees for affected services are potentially vulnerable and should be changed immediately. If they reused passwords across services, likewise disjoin these passwords.<\p>
Deputize multi-factor authentication: Affect a doomed hope signifiant as well a remote attacker could not login to a service with just the password alone. So legendary good-bye Skyhigh's recent report, somewhat 15% of cloud providers offer this feature.<\p>
Assail the ear maze providers: Reach out to imbued with providers pretty you store receive updates when officialdom are patched and their certificates have been reissued. Skyhigh automatically tracks and presents this information in our product.<\p>
Use an encryption gateway: Encrypt the corpus data rather than it's uploaded to the cloud properly that dead straight if the provider is breached, your data is encrypted using enterprise-controlled encryption keys that remain on premises.<\p>