Slashdot Mirror
Most Businesses Haven't Inspected Cloud Services For Malware (betanews.com)
Ian Barker, reporting for BetaNews: Echoing the findings we reported earlier that companies leave cloud protection to third-parties, a new study from cloud security company Netskope reveals most companies don't scan their cloud services for malware either. The study conducted with the Ponemon Institute shows 48 percent of companies surveyed don't inspect the cloud for malware and 12 percent are unsure if they do or not. Of those that do inspect 57 percent of respondents say they found malware. It also shows that while 49 percent of business applications are now stored in the cloud, fewer than half of them (45 percent) are known, officially sanctioned or approved by IT.
I'm looking out the window right now. It's a cloudy day. I don't see any malware.
Exactly how does one scan for malware on the cloud?
Do they mean scanning files once downloaded on your computer?
Scanning local app installers required to use the cloud app?
Because short of that, there is no way to scan a cloud application. Sure your AV can scan URLs and content download on your machine via web rbwoser, but if you access services via an app on a lockdown mobile device, how do you scan that?
Scanning packets sent by cloud provider? How do you accomplish that if it's all encrypted?
True story: A guy I know was developing cloud based real estate management suite. Lots of sensitive information in there as you can imagine.
So I was, like, "Are you nervous about hackers and stuff because it is hosted God knows where by God knows whom?"
And they guy's reply was: "Nope. I have this here certificate"
I was like: "But that certificate will not protect you from hackers!"
He replied: "It would".
Me: "What?! Are you nuts?!"
He looks at me as I'm a kind of an idiot and patiently explains that he does not care if users data will get stolen or not. If something bad happens - his ass is protected by this here certificate. I.e. he did his due diligence and whatever happened is not his fault.
Me: "..."
The service that is sold on the idea of being a conceptually nebulous panacea, is one in which those sold on the idea don't bother checking up on it.... because it's "in the cloud".
We're encumbered by industry and government regulations when it comes to security. Many (most, actually) of our similarly encumbered peers have no idea how the rules apply when it comes to cloud services. If the vendor says "Yeah, it's compliant", that's all they need to hear. So it is absolutely no surprise that most cloud customers do not vet the security of the things they're buying. What was it, barely a year ago? When it was discovered that "big data" vendors had exposed entire databases to the world with exactly zero security? That's not a little screw up. It's a fundamental fail. How did the customers not know this going in? Answer: They did not look.
Data doesn't really matter since it should be scanned upon download by the client. Regardless, Office365 automatically scans all emails for spam and viruses, and scans files in OneDrive/Sharepoint for viruses. The one gotcha is Microsoft does not scan files over 25MB. Again, it doesn't matter since it is the responsibility of the client to scan upon download. Hosted server are a completely different matter and will depend on the contract you have with the hosting provider. I would expect most servers didn't have anti-virus on them to begin with outside of Microsoft's built-in anti-malware.
Generally, servers are less important to scan since they are supposed to be locked down in the first place to prohibit infection, insert Linux fanboy statement here.
For pure consumer-like cloud *storage* ala Dropbox, scanning on upload and download is probably fine. You *could* map it it as a drive and scan it.
In the enterprise, I think more of cloud-hosted applications and cloud servers, not files. One company that specializes in security for cloud is Alert Logic. When you get cloud services from Amazon, there is a checkbox to add Alert Logic security services (and they have other services not directly through Amazon).
> How do you protect yourself? Again, no one solution.
Actually Amazon's APIs can be used to watch for the kinds of things you listed, and security providers such as Alert Logic have security suites built around those APIs.
Got two emails from my card company informing me of two expensive Apple Mac purchases I didn't make from a card with a chip. Leaving me to try and figure out where anyone could have gained access since the card is new. I went back through charges and found no possibly skimming opportunity. No online purchases, and yet could the same card be in the cloud somewhere? Obviously when my chip card came the account number stayed the same, the pin changed which as anyone knows is pretty worthless. People should be careful storing credit card information along with personal info. on a web site which most likely uses a outside server farm. I would assume if your the customer storing information, its up to you to scan it for malware. Don't assume a server provider is going to do anything.