Slashdot Mirror
Study: 15 Per Cent of Business Cloud Users Have Been Hacked
An anonymous reader writes Recent research has identified that only one in ten cloud apps are secure enough for enterprise use. According to a report from cloud experts Netskope, organizations are employing an average of over 600 business cloud apps, despite the majority of software posing a high risk of data leak. The company showed that 15% of logins for business apps used by organizations had been breached by hackers. Over 20% of businesses in the Netskope cloud actively used more than 1,000 cloud apps, and over 8% of files in corporate-sanctioned cloud storage apps were in violation of DLP policies, source code, and other policies surrounding confidential and sensitive data. Google Drive, Facebook, Youtube, Twitter and Gmail were among the apps investigated in the Netskope research.
The vendors have assured us that their servers are secure!
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Investigated... but were they vulnerable?
Because that's what they tell me so I'm still using it. Everyone gets hacked and I have nothing to hide. So I don't mind. Cloud FTW!
how much of that is down to stupid passwords ?
It's 2015. . . who the hell puts anything on " The Cloud " without first heavily encrypting it ?
A study produced by a company that sells cloud security solutions, how convenient their finds everyone needs their product.
Really /. these posts are just getting sad.
What if I simply 3D print all my data and use Amazon drones to deliver it to other people? Is that still good? I don't want to be a Luddite!
I've been around long enough to see things comes and go. The current flavor of the month is "cloud". Cloud this, cloud that. Even the behemoths of the ERP world - Oracle and SAP - are making an aggressive push to "the cloud". Companies like Workday and Salesforce are growing at a tremendous rate.
It all seems very appealing. Say goodbye to multi year implementations and increasingly difficult and costly upgrades. Rent it by the seat rather than making large capital outlays. Fully object oriented design. Open standards vs. proprietary tools. Lots of great benefits.
But.....
As Willie Sutton once famously stated when asked why he robbed banks..."because that's where the money is". The data of your company, and other companies in the typical "multi-tenant" configuration is all in the one place. The bad guys know this. They will target these data centers to be sure.
You are essentially taking your data from an environment you can control (largely) to one you cannot. That is a huge leap of faith.
I expect that it is only a matter time before there will be a massive data breach for hosted cloud apps. We're not talking about someone's email account or twitter account. We're talking about an entire database full of SSN's and other personal information getting stolen. Everyone in your company and possibly customer and partner data as well. I don't want to be the one holding that press conference.
You make a good point. Also, every other day we see another story of "XXX million lost in hack".
It's become so frequent we almost get completely numb to it. A week ago, someone posted here that Microsoft hadn't had any significant issues in a while - 48 hours after their Xbox network was taken down for several days. Having the whole network down for a several days is so common that we forget all about it a couple of days later. That's how common major security issues are right now. We need to make some significant changes in how we develop systems.
Read the Summary, followed the links, ran the numbers. The firm that posted the PRNewswire.com press release obviously offered the Slashdot summary, and there is no solid data or info except "BE AFRAID! (And by the way, we are in the be-less-afraid-,-security-business). Perhaps there's plenty of discussion to be had on the premise, but the premise arrived via BINSPAM.
Gently reply
The summary should have read "Some company wants to scare you into buying their product."
This is ridiculous - it's not news, and it sure as shit isn't for nerds.
"As Willie Sutton once famously stated when asked why he robbed banks..."because that's where the money is"." ...AND?
AND the people who listened to famous Willie Sutton put their money under their mattresses? Was the money in the mattress more secure than the bank? Were they robbed by locals and it was never reported in the "study"? Is locally stored data more secure than the Cloud? Willie Sutton is a great spokesperson for PRNewswire.com promotion of their cloud security.. "AND?"
Gently reply
I am surprised people were naive to think "cloud" vendors could be trusted with their data.
Well, before the government stepped in with deposit insurance, mattresses were indeed safer than banks.
Perhaps an understanding of history would help?
Well, before the government stepped in with deposit insurance, mattresses were indeed safer than banks.
Perhaps an understanding of history would help?
Given the 'resolution' they just passed to fund the government, including a little bit letting the banks gamble with your FDIC "insured" bank deposits - effectively making you, the taxpayer, liable for the banks going to Vegas, betting 30x what they actually have (leveraged) on red, losing... and you get to bail them out... and given that you earn 0.01% on whatever you *do* put in the bank anyways, it's pretty easily arguable that even today the mattress is safer than the banks.
That's completely and utterly ridic^~ %`4& --FREE V1AGRA! @ wanker7.com
Table-ized A.I.
A typical SaaS vendor has numerous clients, all with varying levels of sophistication in their password and identity management procedures.
As if the need to ensure tenant isolation does not put enough pressure on the architects, they also have to worry about how well their customers are securing their own staff. The smart ones are doing Federation for predictable data transfers, and two-factor to secure the application layer. Even then, the legal people still make them sign disclaimers that ultimately, data breaches due to compromised credentials are the responsibility of the authorized bearer of the credentials.
It sucks to have to secure a slew of web servers, especially for those who have to run LOB apps on Windows platforms. VDI is being used pretty heavily on that front prevent information leakages. It's cheaper to spin up a session for them via a webpage, than it is to trust that their client is secure. Not to mention easier to maintain and troubleshoot. Staff can shunt the user to a clean session, shadow it, hold the user's hand through whatever.
On the plus side, with a good cloud provider, when your datas get pwnt, it is replicated somewhere else. Maybe even on tape in some cold, humidity controlled warehouse. Because no matter how good security is, sooner or later, it will get compromised.
At that point though, it is all about RTO/RPO which is outside the scope of security. BTW even with LTO6, restore rates from cold storage still blow.
> The majority were the result of lax user passwords, social engineering, or internal access to systems. Any design around these issues has a direct result of reducing functionality.
I don't know that most of the major incidents were, but let's just assume that's true for a moment. Those are all security. Security is more than just the firewall.
A complete answer would run 600 pages, but here are some solutions in summary.
Lax user pass words - pass words are so 1980. Use pass phrases and keys. Just doing a search and replace to say "pass phrase" or "secret sentence" every where we've written "password" would largely solve that problem.
Internal access - has normally been COMPLETELY UNNECESSARY internal access. Snowden didn't need access to all of those documents to do his job, and that's the NSA, an organization that should have good security. Right now at work we're auditing internal access. Everyone should, because in most organizations some people have far, far more access than what makes sense.
Social engineering - test and reward. Call up a few employees at random maybe once per year with a social engineering pen test. Employees who properly refuse to give out sensitive information get a gift card for dinner or some other recognition for doing a good job. Tell employees ahead of time that you plan to do that this year. When the attacker calls, employees will think "maybe this is security calling, here's my chance to show I know better and win".
Those are a few examples. For technical vulnerabilities, it requires changing the mindset from "does the system give good output when fed good input?" to also include "what happens if a bad guy feeds it unexpected input?". My coworkers are slowly starting to realize that if they announce "the new system works, you type your password and it logs you in", I'm going to ask "what happens if I type in SQL code instead of my password?".
Not just what happens when everything goes right, but what happens when things go wrong? This has the side effect of producing far more reliable systems. For example, ALL providers in a certain blind of business had the same bug in their software - it would all empty the data file if the disk was full. That's because they all wrote the new version of the data on top of the old. We made patched copies of all their software that gracefully handles disk full. What happens when things aren't as you expect. At work, we had lots of intermittent errors that were hard to track down, so they were just tolerated for years, with people cleaning up the mess they made every week. Asking "what happens if things don't go as expected?" revealed these were concurrency issues that were easily solved. So these security threats are not only solvable, but the changed perspective results in better, more reliable systems, and therefore less time-consuming and error-prone manual handling of errors.
cyber-space is in fact infected with cyber-bogeymen that do cyber-hack the cyber-gibson with virtual abandon, leaving virtually every cyber-business in the cyber-cloud hacked to the cyber-bits by virtually unnamed cyber-hackers in the virtual cyber-cloud-space.
This is "research" these days. These are the days of the virtual cyber-hacker cloud!
So, we're using UK English now? In the US, that's spelled "percent". Are we going to start seeing per centage and per centile too? The 1700's just called and said they want Slashdot to stop using their archaic spellings.
They're the "cyber" codeword for "it wasn't us, it was dem cyberbogeymen of dem intarwebbertubes!"
It doesn't mean anything other than "standard generic excuse #1337". It's empty. Keep talking about "hacks" and "hacking" and "hackers" and all you're doing is perpetuating the myth that computer security can not get better than it already is. That we've reached the pinnacle of the shitpile and cannot ever get off again. You'd be playing right into the industry's FUD. Which is expensive but still very handy for the rest of the industry: Just claim "hackers did it", then run to some security company and very publicly buy a hackton of digital indulgences. "See? All better now!"
In fact, there are laws against "computer hacking" (curiously left undefined in the law) that can be brought to bear against just about anything and anyone as long as some form of "computing device" (which is what, exactly? do "terrorist watches" qualify? they count numbers, don't they?) is involved, and often lead to people getting cut off from the internet, their freedom, both, for years, not unlikely for nothing more than vague allegations without proof whatsoever. Such is the power of vague words deliberately left undefined.
It isn't that they're so frequent. It's that the wording deliberately means nothing. Yes, that's right, "hack", "hacker", and "hacking" are now doomy vague words of vague doomy doom of vagueness. The. Words. They. Mean. Nothing.
So the first thing we need is to stop using those words entirely. Then we can start to talk about what we could and should be doing instead.
You can do some computational things on encrypted data, like create a database, which obviously adds some overhead. For example cryptdb:
http://css.csail.mit.edu/crypt...
And built an application which then decrypts the data on the client when the user needs access to it, for example there is Mylar from the same research group as the database above:
https://css.csail.mit.edu/myla...
New things are always on the horizon
Once upon a time businesses had their own clouds - back then they were simply called "servers", and they were in another room called "the server room". When and why did this change? Are we all so lazy now that we can't look after our own data, files, apps and so on? A good old terminal server set-up preferably Linux, on or offsite access, and a good IT team. That's all you need.
Your point is a big part of why management should be very careful about apparent 'cost savings' In a large amount of cases, management is chasing a buzzword more than carefully examining what comprises their budget for in-house versus cloud hosted.
Part of the cost savings of the cloud operator is having them do things to the data that most companies would never approve for themselves. Additionally, only a relatively small portion of the expense is moved 'to the cloud'. A lot of work still *should* happen that is lumped into the presumed cost of being internal versus external. So either a new budget starts growing to cover the cost previously not broken out or work stops happening that may critically matter.
XML is like violence. If it doesn't solve the problem, use more.
The level of network hacking against servers and internet systems is somewhat astonishing, and not widely known outside the industry.
I did a small project where a small company wanted to monitor our equipment on a very small fleet of cars. One day, I discovered we were getting telemetry data from our cars. This created much excitement and surprise in the office, as no one was supposed to be driving any of our cars. After a bit more work, I discovered the car in question was in China. Now that was a surprise ...
Businesses don't want the added payroll, insurances/benefits etc. - et al: So they got rid of those (& gave their top mgt. raises & expense accounts larger than many companies' entire payrolls, lol...!).
* There's your answer: The era of the MBA & outsourcing/offshoring, when the "Holy $" is THEIR God...
APK
P.S.=> A relative told me once "Well, a business can choose to live or die" well, when I see the mgt. get many Many, MANY times the wage & then bonuses + golden parachutes of their AVERAGE employee? That's not choosing to live or die: That's killing it & raping it @ the hands of the few in upper mgt. & boards of directors etc. far faster than paying to have good workers onboard steady that you can see & trust vs. paying & retaining folks longterm (unions for it workers etc. in general, ARE needed - bigtime)...
... apk