this is susan bradley for cso online well it's official we all have some part of our data in
some cloud somewhere most of us still have servers locally or perhaps in a
local data center or perhaps in some redundant regions throughout the world but too often the
procedures and processes that we are used to using when our servers are closely to us
should not be the same procedures we use in the cloud we need to understand that
our risks and responsibilities in the cloud are different now if you want to experience
a data center without actually going to one microsoft has released a new site where you
can take a virtual tour of a data center and you can actually go through various locations
and it gives you kind of a bird's eye view and allows you to explore
the different locations inside the server room
it's a great way to better understand the kind of physical security
infrastructure that they have in a server room
yeah my servers don't quit look quite as nice as that for sure
i can say that i certainly don't have the same normal array of battery backups ups and power
redundancies that a data center has data centers also ensure that they monitor disk memory and
other performance impact on a regular basis they ensure that physical storage is is protected with
encryption they make sure that physical security is a key way that information is protected
but recently a study came out that indicated that we aren't as secure in the cloud as we should be
for example census a security firm specializing in census-like scans took a closer look at
services that were left exposed sixty percent of exposed databases in the cloud were mysql servers
meaning that we had left these applications or databases exposed without a firewall
so all an attacker had to do was to scan for the
signature of that database and then could start attacking it with any number of
vulnerabilities or passwords or any kind of methodologies that they use to attack databases
next they found that 1.93 cloud servers were exposing rdp login pages i've said this time
and time again that if you use the same remote access that you do on on your on premise it is
not as secure when you go up to the cloud again you need to make sure that you limit access
limit to static ips put in two-factor remote desktop or perhaps even look at different ways
to access services not using remote desktop rdp is one of the most attacked methodologies
it's how ransomware often gets into systems bottom line it's something that you really need to
reconsider if that's your default way to get into a cloud server
often when it comes to cloud services you have to understand who has responsibility and control over
certain things so some services do not handle the microsoft updating for the server that you have
in the cloud some do so you need to establish who has responsibility for that updating model
recently microsoft has opened up a public preview of the microsoft graph apis to
manage windows updates so if you're looking for additional different ways to handle remote servers
remote workstations you may want to look into that as additional options of how to patch machines
bottom line with cloud services there is something called shared responsibility
part of the responsibility is on you part of the responsibility on on the vendor when you're on
premise all of the responsibility is on your side you the customer the more it moves over to the sas
model the more is on the vendor responsibility but that doesn't mean that you have no responsibility
responsibility at all you still have key basic responsibility in certain things
for example accounts and identities is a key key way that attackers can come in in the sas model
so you have to make sure that you look at your responsibility
and establish those procedures that you take care of understand where that boundary is and
take control of those items that you need to take control of bottom line don't set up the cloud with
the same risks and vulnerabilities that we open up on our on-premise deployments it's time to get
smarter in protecting our cloud data as always don't forget the daily tech information from
the idg tech talk youtube channel until next time this is susan bradley for cso online
you