Download as PDF, PPTX
Uploaded byAlert Logic
Security Implications of the Cloud
The document discusses security implications of cloud computing and web application attacks. It notes that web application attacks are now the leading cause of data breaches, but less than 5% of security budgets are spent on application security. There is a wide range of attacks targeting different layers of the application stack. Defending applications and workloads in the cloud is complex due to rapidly changing code, vulnerabilities in third-party tools, and a shortage of cloud security expertise. Perimeter security tools are insufficient for protecting the diverse cloud attack surface. The document also provides an example of a textile company that suffered a data exfiltration attack through vulnerabilities in their PHP login system, costing them $1.8 million.
More Related Content
Similar to Security Implications of the Cloud
![OpenSouthCode '19 - Application Security Fundamentals [2019-May-25]](https://cdn.slidesharecdn.com/ss_thumbnails/opensouthcode19-applicationsecurityfundamentals-210905095336-thumbnail.jpg?width=640&height=640&fit=bounds)
Security Implications of the Cloud
- 1.
- 2. SECURITY IMPLICATIONS OF THECLOUD Charles Johnson, Director Solutions Engineering – Alert Logic
- 3. 5 47 74 89 184 289 277 222 207 571 Denial of Service Crimeware PhysicalTheft / Loss Payment Card Skimmers Everything Else Cyber-espionage Privilege Misuse Miscellaneous Errors POS Intrusions Web App Attacks Web app attacks are now the #1 source of data breaches But less than 5% of data center security budgets are spent on app security Source: Verizon DBIR 2017 n= 1,935 UP 300% SINCE 2014 $23 to $1 Percentage of Breaches 10% 20% 30% Source: Gartner Web App Attacks Security risk is shifting to unprotected web applications
- 4. Vulnerabilities + Change + Shortage Complexityof defending web applications and workloads Risks are moving up the stack 1. Wide range of attacks at every layer of the stack 2. Rapidly changing codebase can introduces unknown vulnerabilities 3. Long tail of exposures inherited from 3rd party development tools 4. Extreme shortage of cloud and application security expertise Web App Attacks OWASP Top 10 Platform / Library Attacks System / Network Attacks Perimeter & end-point security tools fail to protect cloud attack surface Web Apps Server-side Apps App Frameworks Dev Platforms Server OS Hypervisor Databases Networking Cloud Management
- 5. Tame the Beast IndustryChallenge: The Good, the Bad and the Ugly Known Good Known Bad Suspicious Allow Identify | Tune | Permit Block Drop | Reconfigure Application Stack Web Apps Server-side Apps App Frameworks Dev Platforms Databases Server OS Hypervisor Hardware Classification Action HUMAN EXPERT REQUIRED
- 6.
- 7. Customer X –Data Exfiltration Company Profile Textile Industry $65M Annual Revenue 500+ Employees 4 Branch Offices (NA) IT Dedicated Headcount – 14 Security Dedicated Headcount – 2 Hybrid Data Center (AWS & CoLo)
- 8. Customer X –Data Exfiltration Company Profile Textile Industry $65M Annual Revenue 500+ Employees 4 Branch Offices (NA) IT Dedicated Headcount – 14 Security Dedicated Headcount – 2 Hybrid Data Center (AWS & CoLo) Attack Progression Stalked company on LinkedIn and Google Gained entry through PHP (KNOWN) flaws Replaced PHP login to capture credentials Leveraged credentials to access critical system Stole Financial, Design data & Roadmap Undetected for 4 months – FBI Notification Cost of Breach - $1.8M
- 9.
- 10.