Data Security in the Cloud

Once upon a time, security used to consist of just a doorknob and a deadbolt. These simple physical defenses used to be enough to keep a family of five safe and out of harm’s way; unfortunately, in today’s world, we’re under attack in ways unimaginable 30 years ago. What was once simple physical security has expanded tremendously to now include data security—where cryptographers work tirelessly to keep our personal data out of the hands of those with more nefarious intentions. Of course, those with nefarious purposes have not sat by idly. What has resulted is a global game of cat-and-mouse, where each side attempts to stay one step ahead of the other. For each brilliant breakthrough in cryptography, there is an equally brilliant breakthrough in cryptanalysis, circumventing the new security measures and requiring another advance in cryptography to stop intrusion. Over the years, this cycle has repeated ad nauseam, leading to the co-evolution of data protecting and data hacking.

First off, the security of data is much different from online privacy. While data security and privacy are interlinked, there is a key difference. For starters, online privacy is typically violated by the company in control of the data itself, while data security is often violated by outside parties. (For more on data privacy and why it’s such an issue, see Your Privacy Online.) While most companies work to protect both data privacy and security, when the company voluntarily gives your data over to others, it’s privacy violation. On the other hand, if an outside force exploits a weakness in the company’s security measures and data is involuntarily transferred outside the servers, a security breach has occurred. The involuntary and unexpected nature of security leaks is what separates them from privacy violations. The tech industry is constantly susceptible to attack or malfunction at any time. Thus, security is a much more difficult matter, seeing as the best protection systems can be overcome, at any time, and without notice. Government oversight may be a useful tool in protecting privacy, but when it comes to data security, regulation can only pressure companies to stay up to date on security and possess thought-out data breach notification plans; it cannot stop security breaches outright.

If a deadbolt can’t keep us safe anymore, what can? Well, we all know that our passwords need to be secure, and that we shouldn’t share them with anyone. But what if we do everything correctly on our end, but someone else messes up? What if an IT guru at Amazon.com forgets to flip the proverbial “safety switch” one morning and a hacker is allowed access to sensitive data, such as credit card information, purchase histories, home addresses, and phone numbers? Though this particular situation may not be likely to occur, similar situations do arise. One such unfortunate event occurred in May 2010—a glitch broadcasted Facebook users’ private chat conversations on their friends’ “News Feeds,” allowing others to see private information that could be not only embarrassing, but damaging to the original parties involved. This is just one of a myriad of examples that arise after a quick Google News search for “Data Security Breaches”.  Not only that, but this is a relatively mild example. Thousands of credit card numbers are stolen annually, and instances of identity theft are on the rise. It does not take a cybercriminal much effort, after stealing credit card information, to look their victims up on Facebook.com, find some personal data, and begin amassing a sizable collection of fraudulent charges, which are often quite difficult for the victim to remove from their record. As the map shows, identify theft occurs across the United States, affecting millions of people each year.

In the cloud, this problem is easily multiplied—more servers are involved, more transportation of data takes place, and more information is consolidated into one place—making cloud service vendors a juicy target for cybercriminals. When it comes to cloud services, there are simply more links in the chain for things to go wrong. A system is only as strong as its weakest link; in the cloud, more links exist, more players matter, and the system as a whole is more attractive to cybercriminals.

According to a recent IBM report, threats to data security can be divided into four broad categories: “data threats, configuration threats, audit threats, and executable threats.” As part of the report, a huge table details the twelve ways data can be stolen, as well as common countermeasures to data threats. This is all well and good for an in-house IT department, but in the cloud, how can you be sure the cloud vendor is following the industry standards? Furthermore, there is another general problem with data outsourcing: what happens if the cloud service vendor goes out of business? Who becomes responsible for its secure storage and maintenance? These are the questions company CIOs must answer before shifting their business onto the cloud. (For more on the problems associated with cloud computing, go to Risks of Cloud Computing.)

One potential solution to this issue is strict regulation and standards within the realm of cloud computing. Measures need to be put in place, ranging from mandatory breach notification laws (which eighteen states currently lack) to stringent security enforcement requirements. These regulations and standards already exist in the world of e-commerce (which processes millions of credit card numbers a year without much incident). The Federal Trade Commission (FTC) just needs to update their regulations to keep up with the cloud computing craze. This fact has not escaped the Senate, which has recently motioned to push the FTC to begin regulating both security and privacy in the cloud, partially due to May’s Facebook glitch.

Of course, any measure to protect data security will have unintended consequences. For example, it is not infeasible to think that if particular industry standards are widely adopted, a security breach at one company might put the whole system in jeopardy due to the cloud’s homogeneity. Just as in nature, a little heterogeneity helps the system survive unexpected shocks. However, this would mean one of the major benefits of cloud computing must be overlooked, possibly even defeating the purpose of moving to the cloud in the first place. (To read about centralization and its effect on the benefits of cloud computing, go to Benefits of Cloud Computing.) Furthermore, due to the rapidly changing nature of this new technology, any regulations and standards written today will likely need revision within the same year. Considering the speed at which bureaucracy moves, this is quite unlikely.

Truthfully, the issue of data security is a concern that will shadow cloud computing well into the future. As long as cybercrime exists, security experts will question the safety of cloud. However, this is nothing new; for years Microsoft has faced scathing criticism over the safety of its operating systems, but people still use their products nonetheless. Over time, cloud computing will become less of a novel concept, and fears over its safety will die down. On the other hand, that does not mean this isn’t a significant problem. For some, market forces will be sufficient to force stringent safety standards. After all, no business would willingly enter into a contract with a cloud vendor with a shoddy reputation. Furthermore, efforts by Google to develop Apps.gov – a government-specific version of its popular Google Apps suite tailored to meet specific public-sector requirements in security and privacy protection – shows us that it isn’t impossible for the cloud to meet stringent safety standards. Google’s government cloud would comply with all rules spelled out in the Federal Information Security Act (FISMA). While the same methods may not translate over to open source cloud platforms, this is a step in the right direction and a win for the cloud computing movement as a whole.