As we approach the end of the second decade in the 21st century, more and more of our virtual world is moving to the cloud. Cloud computing has made possible what was once only dreamed of. With this revolutionary new way of storing and managing data has come countless advantages.
Companies can now have remote access to their most vital data. Teams no longer need to share the same physical space in order to collaborate. We now rely less on physical hardware, saving workspace and reducing the need for creating new computing devices that tend to become obsolete in a few years or less.
But with this increased convenience has come challenges as well. The greatest of those challenges has, without a doubt, been the new security concerns that cloud-based solutions have created.
The Cloud Security Alliance has noted that cloud servers are easily accessed while also being high-priority targets for hackers because of their tendency to contain veritable mountains of important and valuable information.
In other words, cloud providers are a hacker’s most whimsical wish – a honeypot of data just waiting to be plundered. Many people fail to consider this fact when contemplating the top cloud security threats this year.
Fortunately, there are some simple ways to mitigate the threats that cloud-based systems and others face.
Begin by using two-factor authentication (2FA) such as security keys or 2FA apps. Use strong passwords and password managers. Use threat modeling apps, keep an eye on your security audits, and exercise due diligence when it comes to installing routine software upgrades and security patches.
All of these little things combine to make a big difference.
All of these little things combine to make a big difference.
Data Breaches
The last few years have seen a slew of data breaches on a scale the world has never seen before. Some of these, such as the Cloudflare incident happened as a direct result of increased usage of cloud providers.
Using two-factor authentication such as an authenticator app or security key is a vital security measure that many people neglect to make use of.
While it’s not a cure-all, it definitely makes compromising an account much more difficult. Instead of just obtaining a password, attackers have to go the extra mile to also compromise the second method of authentication, which is much more difficult to accomplish.
While it’s not a cure-all, it definitely makes compromising an account much more difficult. Instead of just obtaining a password, attackers have to go the extra mile to also compromise the second method of authentication, which is much more difficult to accomplish.
A security key is the most secure method of 2FA – the physical key creates a unique code for every log-in. Some security keys require you to push a button with every log-in, others do not.
Security keys are like small flash drives that have to be connected to your device in order to generate a unique code that allows you to log in securely. So the one drawback is that they can’t be used on mobile devices.
Another drawback of security keys is that they are supported by a limited number of services at the moment and require the Google Chrome browser (which is the worst browser available in terms of privacy). But you can still use a security key for your Facebook, Dropbox, and Gmail accounts.
A back-up method of 2FA, such as SMS text or an authenticator app can be set up as an alternative. This way, if you want to log in via mobile or you don’t have your key on hand, you’re not locked out of your accounts.
Authenticator apps are also very secure because they create a locally-stored, unique one-time code that is good for 30 seconds from its creation time. Having the code generated locally means you can retrieve it even if your phone is offline or in airplane mode.
While each code expires after 30 seconds, you don’t have to open the app and rush to enter the code before the next one appears or anything like that. This method of 2FA can seem foreign to someone who has never used it, but it’s no different than receiving a new text twice every minute.
Choose one of these methods over SMS text whenever you can. An SMS message can be intercepted before it reaches the server that sends it to you. An attacker can forward the message to their own phone, at which point they can log-in as long as they have cracked your password first.
However, no approach is 100% perfect, and even if it does approach perfection it might not be the case tomorrow.
Credentials Being Compromised
A significant number of security threats can be avoided just by using secure passwords.
For best results, choose unique passwords with a minimum of 14 characters including lower-case and upper-case letters, numbers, and special characters.
Remember that length is more important than complexity. This is due to the fact that using password cracking programs requires time. A password with eight characters might take a day or two to crack. A password with 14 characters or more might take years.
Remember that length is more important than complexity. This is due to the fact that using password cracking programs requires time. A password with eight characters might take a day or two to crack. A password with 14 characters or more might take years.
Never use the same password twice – if a single account becomes compromised, and you use that password elsewhere, you’re screwed. Secure password managers come in handy here.
Personally, I’m a fan of the Blur password manager. Blur allows you to create masked emails for new accounts and will automatically generate secure passwords for you. The paid version allows you to sync your data across multiple devices and browsers through the cloud. All you need is the Blur browser extension. Blur also has its own privacy-focused browser for mobile devices.
Of course, Blur suffered a breach of its own in late 2018. It’s exactly this kind of thing that prevented me from using password managers of any kind for quite some time.
You have to feel bad for them, it must be rather embarrassing for a cybersecurity-focused company to suffer a breach like that. Fortunately, the company claims that only encrypted passwords were stolen, meaning it’s unlikely that the hackers gained any actionable information.
In addition, put your most important passwords on a regular rotation schedule. If your passwords change constantly, they become a whole lot more difficult to compromise.
Direct Denial of Serivce (DDoS) Attacks
While DDoS attacks are nothing new, the widespread use of cloud providers has coincided with an increase in their use.
Cloud providers often have existing security protocols to prevent these kinds of attacks. Yet they still happen.
Keeping constant eyes on your security audits and sharing crucial information with administrators can help to mitigate this threat.
Hacked APIs and Interfaces
The majority of cloud apps and services utilize APIs for cross-cloud communications.
The Cloud Service Alliance recommends implementing threat modeling apps and performing thorough code reviews to harden your systems against this threat.
Lack of Due Diligence
This one applies not just to cloud services, but technology in general.
Failure to conduct routine maintenance such as software updates and security audits is one of the main reasons for major hacks.
It’s not about how hackers win – it’s about how those who get hacked lose.
Account Hijacking
This often happens as a result of phishing attempts.
Hackers have figured out that sometimes, they don’t even have to hack anything – simply using social engineering tactics can gain them account credentials. At that point, nothing else matters.
Phishing comes in many forms. Sometimes it can be as simple as tricking an individual into sending an unknown party some information. All an attacker needs to do is spoof their email and speak with authority in order to get someone to send the requisite info.
Other times it may mean getting someone to click a link, download a file, or visit a malicious website that appears to be legitimate. All of these methods have been used in the past and seem to be increasing in number and severity.
Educating employees about how to spot and avoid phishing tactics is an investment every company ought to make. Simply being aware of the potential for phishing emails and phone calls greatly reduces the chances of such attacks being successful.
Malicious Insiders
This may be a somewhat less common threat, but when it happens, it can be devastating.
A malicious insider is like a spy – they can roam about your data undetected and steal it from right under your nose.
Even the National Security Agency (NSA) – a government agency tasked with cybersecurity matters – saw a major leak of confidential documents in 2013 due to an insider threat. For months, a certain someone was snooping around opening classified documents and no one had any idea this was happening.
A way to avoid this is to set up adequate detection methods that alert you to the presence of someone poking around in your system. Simply using canary tokens will give you better detection than most companies today.
Canary tokens are files that alert you when opened. They look and act just like regular word documents, images, PDF files, or other file formats. But what an attacker doesn’t know is that the moment he or she opens that file, an alert will be sent to your email inbox.
Of course, it’s preferable to make those files inaccessible in the first place. But in the event of a breach or an insider threat, knowing what has just happened allows you to mitigate further damage and take measures to better protect yourself in the future.
Top 7 Cloud Security Threats You'll Possibly Combat This 2019 Reviewed
While these may be the top 7 cloud security threats you’ll possibly combat this 2018, this is by no means a complete list. It does, however, give you a good idea of the types of vulnerabilities inherent in cloud-based systems.
When it comes to preventing these threats, remember the little things – complex, unique passwords, multifactor authentication, network isolation, regular backups and software updates, and so on.
A large proportion of major breaches don’t occur as a result of some super sophisticated hacking method – rather, they happen because someone failed to take simple measures to protect their systems.
This often takes the form of an individual falling victim to a phishing attack, someone using a password like “p@ssw0rd,” or failing to install routine software updates that include the latest security fixes.
Make sure that doesn’t happen to you by remembering the top 7 cloud security threats you’ll possibly combat in 2019.
No comments:
Post a Comment