FeaturesSecurity Compliance

Cloud security attacks are usually attacks directed at public clouds or Internet-facing services, or they can be attacks that leverage public computing resources. Contrary to traditional security attacks that infiltrate a corporate network, an attack of a cloud-based service hosted at a third-party location can take place completely off-premise, where gateway security originally surrounding one's data center becomes obsolete.

Cloud security attacks are usually staged for a financial gain or to fulfill a political motive. Ultimately, it is the data that attackers go after, from which they can derive great value, according to Charles Cheng (pictured) Trend Micro's senior director of business development and product management for cloud computing solutions, and director of product marketing.

In an interview with Asia Cloud Forum, Cheng outlines the common forms and targets of cloud security attacks, gives real life examples of how these attacks strike and incur losses, and suggest ways to minimize exposure to cloud security attacks. Read excerpts below.

Charles Cheng: Distributed denial of service (DDoS) on Internet-facing infrastructures, leveraging cloud computing resources to launch security attacks, such as DDoS attacks and email spamming.

Advanced attack could exploit known and unknown vulnerabilities of the Internet-facing services, allowing attackers to obtain administrative right and take total control of the cloud services.

Some of the common targets of cloud security attacks are financial institutions (e-banking) and e-commerce sites [that store or process] personal information.

Cheng: Public cloud and Internet-facing infrastructures are more prone to attacks since they are protected with fewer layers of protection. In addition, public cloud users are required to assume responsibility of security, while perimeter defense becomes impossible.

Use of public clouds can also require the user to run their applications and to store their data on shared infrastructures, making their assets more vulnerable to threats from unknown neighbor applications.

Cheng: Common vulnerabilities exist in traditional infrastructures and cloud infrastructures, but the availability of cloud computing and cloud technologies, and the use of cloud computing infrastructures, service, and technologies make certain attacks more common and potentially more damaging.

For example, Bloomberg News reported that hackers used AWS's EC2 cloud computing unit to launch an attack against Sony's PlayStation Network and Qriocity entertainment networks. The attack reportedly compromised the personal accounts of more than 100 million Sony customers.