Recently Hoff posted the irony-enhanced “Cloud Providers Are Better At Securing Your Data Than You Are..." as a reaction to “The Cloud is not That Insecure” up on GnuCitizen by PDP. It’s tough to expect any clear and firm conclusions on this debate since the notion of what “security” means in these two posts is not really that well synched up with the underlying causes of data loss.
Hoff and PDP both seem to be focused on comparing cloud computing platforms with enterprises on the level of diligence each show on classic countermeasures like perimeter security and communications security. PDP observes that Google and Amazon and others seem to present “rock solid” systems that achieve higher levels of protection simply because the IT goals of service providers are more focused that those of typical large-scale enterprises. True. Hoff counters with reports of breaches at major SaaS providers as evidence that service providers are enterprises too and just as likely to have problems protecting their perimeter. Sadly, true.
Problem is, this debate seems to ignore a key fact about data loss.
Tight perimeter security is a necessary but not sufficient condition to control risk of data loss. It happens all the time that disciplined security teams running solid defense-in-depth protections still suffer large amounts of data loss. What’s missing? No one on these teams can answer key questions like:
1) “Where are all the locations that sensitive enterprise data is stored?”
2) “How do employees use that data?”
3) “What’s the best way to enforce policies on the use of that data?”
Nearly every enterprise that uses cloud computing platforms has a mix of locally hosted systems and services in the cloud. Even assuming perfect protection from hosted services providers, the fact is that sensitive data constantly flows back and forth between the remote cloud and the local enterprise LAN. It gets copied to thumb drives, left out on open network shares, gmail’d home for work over the weekend, and posted up on wikis and sharepoints. Once copied into these uncontrolled secondary and tertiary locations, this data is at very high risk of loss. It’s this constant flow, copying, and proliferation that is a primary driver behind the data breach phenomenon. That’s not just us talking, but is a well documented by multiple independent studies.
Without content-aware protections that can answer the three questions above, data stored in cloud computing environments (like data stored in any system hosted anywhere) will be at risk of breach.
Comparing the depth of defenses of a cloud computing platform to those of an enterprise running “on prem” IT services is just the wrong question to debate. The most crucial factor in managing possible data breach is content-aware management of the flow of this data across the numerous boundaries that indicate risk.