The looming Cloud threat – securing the modern Cloud infrastructure

Chris Greany, Chief Information Security Officer, and International Cyber Expo Advisory Council Member, further discusses.

With a monopoly controlling the public servers, a large outage – whether hostile or accidental – on AWS, the leading public Cloud server, could shut off up to 38.9% of data and services operating within it. While end-users, be it an individual or company, are responsible for the security of their own applications; public Cloud servers look at the big picture, notably, the security of the Cloud infrastructure.

Public Cloud servers are set up to focus on resilience. They have multiple data centres dispersed across various regions, all working independently of each other. This structure minimises the impact of a cyberattack or outage from expanding beyond a singular region. Moreover, impact is minimised further through the use of cell-based architecture in the software utilised to run applications. Although servers have gone down in the past, they are limited in scale and quick to be addressed. So, what is the worry?

Even a small incident can quickly spiral out of control. Consider the 2020 AWS outage in Northern Virginia. In November 2020, Amazon Kinesis crashed, causing an interruption that avalanched and affected the operations of a whole host of national and even international companies. Theoretically, these failures are limited to regions. Yet if a region of London, or Silicon Valley, or New York City were to go down, the wider impact to society or the economy are hard to estimate. Moreover, though regions don’t generally communicate with one another, Identity and Access Management (IAM) controls introduces the exception. When managing access permissions, regions talk to each other to determine who has access to which services. Identity and Access Management (IAM) controls ask users ‘Are you who you say you are’ and ‘If you are, what can you do’. These controls run, not through a region or multiple regions, but across the entire Cloud provider network. If the IAM control is unable to function, then users across the Cloud would lose their ability to access services which store their data. Therefore, representing the single largest attack vector for Cloud infrastructure.

Despite this, there is still no specific Cloud security regulation. The UK government spent £2.8 billion during the last financial year on Cloud services. Yet, no direct Cloud regulation, no push for change or security, is proposed. The problem here is the unclear lines of jurisdiction and responsibility. The global Cloud computing market was worth USD$405.65 billion in 2021 and will continue to grow. It is critical then that authorities consider how Cloud resilience is governed, prioritising legal regulations and enforcing them to ensure the risk of a potentially catastrophic crisis is reduced. Of course, the best means of effecting the change we need to see is through the collaboration of the public and private sectors.

Held at Olympia London on the 27th to the 28th of September 2022, International Cyber Expo endeavours to be the go-to meeting place for industry collaboration, inviting vetted senior cybersecurity buyers, government officials and entrepreneurs, to software developers and venture capitalists.

To register for free tickets to the event, visit: https://ice-2022.reg.buzz/e1