Cloud Attacks Surface Essentials is the process where Cloud data centers can be perceived as similar to DMZs in legacy enterprises. Because everything in the cloud can be accessed remotely, it can be considered exposed to the Internet, to a greater or lesser extent.
Instead of the discrete perimeter of a private network, cloud configurations may be more porous or might be considered to have no specific perimeter boundary at all.
In this Cloud Attacks Surface section, we’ll discuss threats to specific cloud platforms and countermeasures that may facilitate trust in cloud usage
Although many of the threats to cloud computing are the same as those we faced in legacy operations, they might manifest in novel ways or pose a greater risk. In this Cloud Attacks Surface section, we’ll examine the threats to the private, community, public, and hybrid cloud models.
What are the Threats present in Private Cloud?
A private cloud is an internal network with remote access capabilities.
This is basically what we thought of as an “enterprise” before the concept and the term “cloud computing” was popularized. All the threats common to that motif pose a risk to private cloud architectures.
These include but are not limited to the following
Malware
Malicious software downloaded from the Internet or uploaded to the internal network can cause a wide variety of problems, including data loss, loss of control of devices, interruption of operations, and so forth.
Internal Threats
These can be the result of malicious or accidental activity on the part of employees or others who have been granted access such as contractors and maintenance personnel or the person which not from a particular organization.
External Attackers
Entities outside the organization may want to attack the network for any number of reasons, including financial gain, hacktivism, political goals, perceived grievances, and so on.
These attacks can take many forms and manifest a variety of effects, including DoS/DDoS, data breach, legal repercussions, and more.
Man-in-the-Middle Attacks
This is the colloquial term for any attack where the attacker inserts themselves between the sender and receiver.
This can take the form of simple eavesdropping to acquire data.
It can be a more advanced attack, such as the attacker posing as one of the participants in order to gain further control/access or modifying data traffic to introduce false or damaging information into the communication.
Social Engineering
As in all operations, private clouds are susceptible to social engineering threats.
Indeed, the private cloud may increase potential vectors for social engineering activities because of the nature of remote operations the need for users to reset passwords with the assistance of administrators.
Theft/Loss of Devices
Again, the convenience and enhanced operational capability of remote access also come with additional threats.
In a BYOD (Bring your own device)environment, especially, the loss or theft of a user’s device can lead to unauthorized access and exploitation of the private cloud.
Regulatory Violations
Regulations affect almost all IT operations, but a private cloud adds greater risk that the organization will not be able to maintain compliance.
The increased opportunity and efficiency for disseminating information also increases the likelihood of violating applicable regulations.
Natural Disasters
All operations are prone to disruption from natural disasters, and no geographical region is free of risk from this threat.
They only differ in location. (Location and climate dictate the types and frequencies of disasters, such as hurricanes, floods, wildfires, tornadoes, earthquakes, volcanoes, mudslides, and so on.)
On Cloud Attacks Surface the private cloud can be susceptible to disasters in at least two ways are as follows
- A disaster could strike the organization’s datacenter itself
- It could strike the utilities serving the datacenter (the ISP, electrical provider, and so on).
What are the Threats present in Community Cloud?
Community cloud operations include all the same threats as private cloud implementations, with these additional concerns
1. Loss of Policy Control
Because ownership is distributed in a community cloud, centralized policy promulgation and enforcement is not usually an option.
2. Loss of Physical Control
Again, distributed ownership means not only a decrease in expenses but a decreased amount of control as well.
Lack of physical control equates to a relative decrease in physical security.
3. Lack of Audit Access
Tied to the loss of physical control, it may be impractical or impossible to conduct audits in a distributed environment.
What are the Threats present in Public Cloud?
Compounding the threats faced by the aforementioned architectures (private and community clouds) (see in the upper section on Cloud Attacks Surface).
The public cloud not only includes all the threats those models faced but these additional threats.
Rogue Administrator
This is an enhanced form of insider threat. The public cloud incurs the possibility that an insider with more than just basic access may act in a malicious or irresponsible manner.
Because public cloud providers will be managing your systems and data, a bad actor or careless employee could take the form of a network/system architect, engineer, or administrator, potentially causing far more damage than a user in the legacy environment could accomplish.
Escalation of Privilege
This is another extension of the insider threat category.
This type of cloud attacks or threat is what happens when authorized users try to increase their level of access/permissions, for either malicious or operational reasons.
Not all attempts to escalate privilege are malicious in nature.
Some users are willing to violate the policy in order to increase their own ability to perform their tasks or to avoid annoying or cumbersome regulations.
The likelihood of this type of threat increases in the public cloud because users are faced with not one but at least two sets of governance that of their own organization and that of the provider.
Contractual Failure
A poorly crafted contract can lead to vendor lock-in, unfavorable terms, lack of necessary services, and other risks, and it should be perceived as a threat.
Important note to fully understand Cloud Attacks surface concept
Although natural disasters can still affect public cloud architecture, the public cloud can actually provide some protection and insulation from natural disasters as well.
In fact, one of the advantages of migrating to a public cloud configuration is the security offered by fast replication, regular backups, and distributed, remote processing and storage of data offered by cloud providers.
What are the Threats present in Hybrid Cloud?
All the threats posed to the other forms of cloud computing also exist in a hybrid design, with the additional risk of compounding those threats through the loss of uniformity and centralized control.
List of Countermeasure is use to prevent threats in cloud as well as Cloud Attacks
The following is a discussion of some countermeasures that can be adopted in order to address each of the threats for each of the cloud models discussed in the preceding sections.
Malware
Host-based and network-based antimalware applications and agents can be employed in actual host devices and virtualized instances.
Specific training can be provided for all users regarding the methods used for introducing malware into a cloud environment and how to defeat them.
Continual monitoring of network traffic and baseline configurations can be used to detect anomalous activity and performance degradation that may be indicative of infections.
Regular updates and patches should be implemented, perhaps including automatic checks for virtual machines as they are instantiated at every boot.
Internal Threats
Prior to hiring, aggressive background checks, résumé/reference confirmation, and skills and knowledge testing should be conducted.
For existing employees, personnel policies should be used that includes comprehensive and recurring training, mandatory vacation and job rotation, and two-person integrity in those situations where it makes financial and operational sense.
Solid workflow policies should include separation of duties and least privilege, An active surveillance and monitoring programs, both physical and electronic, can be used.
Data should be masked and obfuscated for all personnel who don’t need to work directly with raw data. Egress monitoring should include data loss, leak prevention, and protection technology.
External Attackers
Countermeasures include hardened devices, hypervisors, and virtual machines, with a solid security baseline and thorough configuration and change management protocols, as well as strong access controls, possibly even outsourced to a third party such as a cloud access security broker (CASB).
It’s also important for the organization to understand how the organization is perceived by the subject;
This kind of data can be used for threat assessment and identification.
What are the type of Attacks Conduct on Cloud Computing and technology?
The cloud data center has to be robust and resilient to all types of threats, from natural disasters to hacking attacks to simple component failure.
Man-in-the-Middle Attacks
One way to mitigate these attacks is to encrypt data in transit, including authentication activity. You can also use secure session technology and enforcement.
Social Engineering
Training, training, training. Use incentive programs (perhaps including spot bonuses and accolades) to identify personnel who resist social engineering attempts and bring them to the attention of the security office.
Theft/Loss of Devices
Countermeasures include encryption of stored material to attenuate the efficacy of theft, strict physical access controls, limited or no USB functionality (up to and including physically destroying USB ports).
Detailed and comprehensive inventory control and monitoring, and remote wipe or kill capability for portable devices.
Regulatory Violations
Hire knowledgeable, trained personnel with applicable skillsets. Defer to general counsel in planning and managing your system.
Implement DRM solutions. Use encryption and obfuscation and masking as necessary.
Natural Disasters
The cloud provider should ensure multiple redundancies for all systems and services for the data center, including ISPs and utilities.
The cloud customer can arrange for a disaster backup with the same cloud provider, with another cloud provider, or offline.
Loss of Policy Control
Strong contractual terms should be employed that ensure the provider is adhering to a security program that is at least as effective and thorough as what the customer would institute in an enterprise the customer-owned and controlled.
Detailed and extensive audits should be conducted by the customer or a trusted third party.
Loss of Physical Control
You can use all of the protections listed in the internal threats, theft/loss of devices, and loss of policy control entries in this list.
Lack of Audit Access
If the provider refuses to allow the customer to directly audit the facility, the customer must rely on a trusted third party instead.
If the provider limits access to full third-party reports, the customer must insist on contractual protections to transfer as much of the financial liability for security failures to the provider as possible, including additional punitive damages.
Rogue Administrator
Countermeasures include all the controls listed in the internal threats entry in this list, with additional physical, logical, and administrative controls for all privileged accounts and personnel.
Including thorough and secure logging of all administrative activities, locked racks, monitoring of physical access to devices in real-time, implementation of video surveillance, and financial monitoring of privileged personnel.
Escalation of Privilege
Extensive access control and authentication tools and techniques should be implemented.
Countermeasures also include analysis and review of all log data by trained, skilled personnel frequently, combined with automated tools such as SIEM, SIM, and SEM solutions.
Contractual Failure
To protect against vendor lock-in/lock-out, the customer might consider full offsite backups, secured and kept by the customer or a trusted third-party vendor, for reconstitution with another cloud provider in the event of severe contractual disagreement.
Legal Seizure
As has been mentioned in previous chapters, legal action (either for prosecutorial or litigatory purposes) might result in unannounced or unexpected loss or disclosure of the organization’s data.
The revised BIA should take this possibility into account, and we need to consider the use of encryption for data in the cloud.
