Vulnerabilities in the Cloud
Cloud environments are by design, fluid and therefore require regular updates to the security architecture to ensure protection. Despite efforts by cloud providers to stay abreast of the latest threats, a single zero-day vulnerability could provide the means with which to potentially compromise every customer and machine being hosted within the cloud provider's network.
In order to address this risk, cloud providers need to invest in security vendors that provide frequent updates and a global intelligence network that can accurately identity and protect against new vulnerabilities and attacks before they are exploited in the wild.
Fortinet helps enterprises deal with the issues at each of these levels. We have the width and depth of solutions to address the security of data as it moves to, through, and outside of the cloud. By providing centrally managed physical and virtual appliances that can meet a broad range of network security requirements, Fortinet is able to help protect critical data from the organisation to the cloud and back.
Fortinet will also be launching FortiCloud, a hosted security management and log retention service for FortiGate and FortiWiFi devices. FortiCloud, aimed at customers not using our FortiAnalyzer and FortiManager appliances, provides centralised reporting, traffic analysis, configuration management and log retention without the need for additional hardware and software.
FortiGuard Labs, our threat research team, has predicted six key threats to look out for in 2013.
1. APTs Target Individuals through Mobile Platforms
APTs, also known as Advanced Persistent Threats, are defined by their ability to use sophisticated technology and multiple methods and vectors to reach specific targets to obtain sensitive or classified information. The most recent examples include Stuxnet, Flame and Gauss.
In 2013 we predict we'll see APTs targeted at the civilian population, which includes CEOs, celebrities and political figures. Because these attacks will first affect individuals and not directly critical infrastructure, governments or public companies, some types of information being targeted will be different. Attackers will look for information they can leverage for criminal activities such as blackmail, threatening to leak information unless payment is received.
2. Two Factor Authentication Replaces Single Password Sign on Security Model
The password-only security model is dead. Easily downloadable tools today can crack a simple four or five character password in only a few minutes. Using new cloud-based password cracking tools, attackers can attempt 300 million different passwords in only 20 minutes at a cost of less than US$20. Criminals can now easily compromise even a strong alphanumeric password with special characters during a typical lunch hour. Stored credentials encrypted in databases (often breached through Web portals and SQL injection), along with wireless security (WPA2) will be popular cracking targets using such cloud services.
Sign up for CIO Asia eNewsletters.