How Cloud Computing is Changing Cybersecurity

As it has emerged over the past few years, the cloud has really revolutionized business and allowed us to do amazing things with web-delivered technologies.

However, one of the biggest issues around the cloud has always been, and still is, cybersecurity. (Read The Truth About Cybersecurity.)

The cloud brings with it a host of cybersecurity issues. Some of them relate to the inherent nature of cloud computing, and others are exploited by hackers through very specific design processes.

Here are some of the general challenges of maintaining cybersecurity in the cloud. (Also read How AI Advancements Are Affecting Security, Cybersecurity and Hacking.)

Lack of Transparency

Because the cloud vendor model requires client businesses to trust outside third parties, transparency is a big issue. That starts with knowing what your vendor’s data setup is like – whether it's truly a private cloud, or a multi-tenant design that should rightly be called public – and how many barriers there are between the data holdings of multiple customers.

Then other questions center around the security standards and algorithms that the vendors are running. Even things like uptime have to be hashed out in a service level agreement, or there's really not full transparency in play. That issue of trusting the cloud vendor is one that's always been central to the relationship between a cloud provider and a consumer of cloud services. (Read Making Networks More Secure in the Age of Cybersecurity.)

A company is giving up a lot of control – and with that comes a burden of due diligence and the desire to create transparent relationships with vendors.

“If someone is going to operate a service like a public cloud that people are supposed to be able to count on, while changing it under the hood on a continuous basis, and constantly releasing improvements to it, they have taken a management burden upon themselves that no one else in the computing industry has ever shouldered,” wrote Bernd Harzog at Network World in 2017.

“This gives rise to some very tough questions, which none of the public cloud vendors has been forthcoming to answer.”

There are ways to hedge against vendor risks, for example, creating redundant multi-cloud systems and making in-house systems more versatile, but the threat is still there.

Sprawl and Drift

Companies are using cloud services for supporting virtualization schemes involving virtual machines and containers. (How do containers differ from virtual machines?)

There is the ability to abstract all of the hardware systems into the virtual world, and source everything, from servers to code functionality and storage, through the web.

However, that can lead to some specific problems.

One of them is sometimes referred to as VM sprawl – where people building an architecture may build in too many independent virtual machines or other components, and basically lose track of them over time. With virtual machines running out in limbo, there's a key disorganization or entropy that sets in, and that can be dangerous. (Read What can virtual machine use cases tell companies about systems?)

“If you do not have control of your virtualization environment, what is to stop a rogue virtual machine from creating havoc in your IT infrastructure?” asks Steven Warren at TechCrunch, describing some of the perils of sprawl. “What if some developer created a VM and installed DNS on it or made it a DC (domain controller). Or what if a marketing person had a VM created but didn't patch it and a virus invaded it?”

Another related problem is drift. (What are some factors that contribute to AI "drift"?)

That happens when the individual components aren't always maintained in the same state – for example, with the same licensing, in the same modern version, etc. Sprawl and drift are twin terrors for cloud architecture – as with the lack of transparency, sprawl and drift can sow chaos and leave systems vulnerable to all sorts of hidden dangers.

Vulnerable APIs

The application programming interface (API) came into vogue with the evolution of more sophisticated architectures that plug in and various software components or allow SOA components to talk to each other in unprecedented ways.

The API is a key part of the connective tissue in modern architectures – but when an API isn't secure, that can lead to its own cybersecurity problems. Insecure APIs are one important source of concern for programmers and other stakeholders.

“Whether the communication is between service and server, or services and the browser, the services should not just secure the data they are serving but also control who is requesting that data,” writes Jason Skowronski at solarwinds papertrail.

“Nobody wants to make their social data available to strangers.”

New Topographies and the Internet of Things

With the Internet of Things (IoT) emerging as a new connectivity model, experts are predicting that we will add many billions of connected devices every year. That proliferation has led to a very much in-demand philosophy of edge computing, the idea that data can be kept closer to the edge of a network, as close to the data source as possible.

But then that data, in many ways, can be more vulnerable, and that's another major challenge when it comes to maintaining security in the cloud. Security strategies to keep on your radar screen are Secure Access Service Edge (SASE) and Zero Trust (ZTNA).

Always Connected to the Web

There's a lot more we could talk about in terms of cloud security, but many of the biggest fears shared by security professionals boil down to one key issue – that by their nature, cloud services leave a network connected to the global Internet all the time.

That's where the hackers play.

Without access through the global Internet, hackers would have a much harder time breaking into any given network. But since cloud services are delivered over the Internet, they provide a handy avenue for various bad actors who want access.

DDoS attacks, Man-in-the-Middle attacks and other kinds of server attacks can all utilize cloud connectivity as a starting point for waging war on proprietary systems.

Think about these core concerns about how to handle cloud security, as vanguard security pros try to build in adequate barriers against the black hats.