eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
NEW YORK-Cyber-criminals are simultaneously taking advantage of the cloud’s benefits to launch attacks as well as targeting organizations’ cloud services, security experts said.
As organizations increasingly virtualize their data centers and move their applications to the cloud, attackers are beginning to think, “Let’s attack here,” Allen Vance, director of product management of the data and applications security group at Dell SecureWorks, told attendees at Cloud Expo during a session on cloud security on June 6. Organizations have to put in measures to handle threats to their virtualized environments when considering a cloud deployment because the environment amplifies the risks, Vance said. Cloud Expo is running from June 6 to June 9 here.
“We are in the middle of a war,” Terry Woloszyn, CTO of PerspecSys, told attendees in a different session on cloud security. He compared the current security climate to an “arms race” as cyber-attackers are continuously developing new attack vectors and modifying existing threats, leaving vendors and businesses to play catch-up.
Nowhere is this more evident than the recent game of whack-a-mole Apple has been playing with malware developers behind the fake MacDefender antivirus scam and its many variants over the past few weeks.
A new MacDefender variant appeared within 24 hours after Apple released a security update on June 1 that included the malware definition in the Mac OS X File Quarantine list. After Apple updated definition files to cover the new variant on June 2, yet another one popped up that bypassed the quarantine hours later.
Vulnerabilities reported in virtualized technologies have “nearly doubled” between 2008 and 2010, according to data compiled by Dell SecureWorks Threat Intelligence and Intrusion, Vance said. Dell SecureWorks found that security “events” detecting attacks against virtual environments increased by more than 500 percent over the same period.
Cyber-attackers can try to steal credentials related to cloud providers, such as the organization’s username and password for Amazon Web Services and the certification and private key used, Dell’s Vance said. Malware is increasingly sophisticated enough to exploit vulnerabilities and use hyper-escalation to compromise cloud platforms, Vance said.
Hyper-escalation refers to what happens when malware exploits a vulnerability in the hypervisor to break out of the virtual machine and gain root privileges on the actual server hardware. This would give attackers complete control over all the other virtual machines running on that machine, a serious threat in a multi-tenancy environment. When organizations are sharing network infrastructure, databases, data storage and computing resources, risks are aggregated, Vance said.
It’s not just “script kiddies” that are breaking into networks and writing malicious code, according to Woloszyn. Attacks are originating from “sophisticated nation-states with cyber-commands” as well as from organized crime. Cyber-attackers are using “strategic multi-pronged” attacks, such as compromising RSA Security first and then using the stolen data to break into defense contractor Lockheed Martin, according to Woloszyn.
Stuxnet was a “cyber cruise missile,” which was “stunning” in the way it targeted highly specialized systems, according to Woloszyn. “Who’s to say the next targeted attack won’t be against the cloud?” Woloszyn asked attendees.
Another threat against cloud services is in the APIs used to connect applications and services, according to Dell’s Vance. There are “thousands” of Web-based APIs, and 10 to 15 new ones are being created each day. If they are not built or implemented correctly, organizations are vulnerable to man-in-the-middle campaigns, identity spoofing, accidental leakage of confidential data and even denial-of-service attacks.
In the event of a breach, forensic analysis is also more difficult in the cloud, Dell’s Vance said. The fact that the environment is maintained by a third party may actually slow down initial incident response as well as the time required to remediate vulnerabilities. One reason for the delay may be because the cloud provider’s first priority is often in making sure other customers are unaffected.
Both Vance and Woloszyn noted that cloud environments are vulnerable to malicious insiders, who may decide to abuse their privileges.
Vance emphasized the importance of organizations monitoring cloud logs. Just because they are giving up operational control doesn’t mean IT departments can’t monitor the host, the guest virtual machines and other security services. Woloszyn said organizations should also consider implementing a zero-trust environment in the cloud so that only the exact information the user needs is revealed and nothing else. Layers of access, where some people have higher levels of trust than others and only anomalies are tracked, mean attackers just have to figure out a way to escalate privileges to gain unfettered access to data.
Traditional security techniques have limited effect in the cloud, Vance said, noting that organizations need to look at “old problems” and consider them in a new context.