The cloud is very different from on-premise infrastructure in several key ways. Some of these differences become apparent when it comes to external attacks. To get to the core of how these attacks can unfold differently in the cloud (and how they are the same), Threat Stack recently hosted a webinar in which I interviewed security engineer Anthony Alves about the anatomy of a cloud attack.
As businesses move to the cloud, the rapid adoption of Infrastructure as a Service (IaaS) is no surprise. Unfortunately, securing the cloud and the data within it is no easy task. The speed and complexity of cloud computing requires a new, software-defined approach that differs from the strategies employed in a traditional, on-premise data center, leaving many wondering where to start.
For all the benefits that the cloud has to offer, some of the biggest causes for concern are questions around security. How do you know if you were breached if the server no longer exists? How do you protect yourself from insider threats, external attacks, and data loss in this new elastic, ever changing infrastructure? How can you have confidence that your cloud service providers security capabilities are up to snuff, when you don’t have visibility into who is accessing your data?
Look no further than the headlines to know that efforts to protect the cloud from attacks often fail. After attackers compromised the company’s Amazon Web Services (AWS) account, Code Spaces, a cloud-based hosting platform that enabled development and collaboration for software teams, was forced out of business. Within 12 hours the company’s Apache Subversion repositories and Elastic Block Store volumes and nearly all of its virtual machines were destroyed. By the time the company reclaimed its dashboard, the attackers had created alternative AWS logins, questioning the overall security of the system further. The company chose at that point to shut down and help its customers migrate any recoverable data to other services.