BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

The Special Case of Privileged Users in the Cloud

Posted June 23, 2011    Peter McCalister

As we have been discussing the last few weeks, if you want to use the cloud and need to do it in a secure and compliant way, it’s a matter of shared responsibility. If you want your cloud vendors to be secure enough to protect your corporation’s most sensitive data, then you have to insist on it, communicate your requirements and oversee the controls. That leaves the final piece of the cloud security puzzle – the special case of the privileged users in the cloud.

While we can debate the relative security of clouds vs. most corporate data centers, there is one area where using a cloud vendor will always represent greater risk – the threat posed by insiders with administrative privileges. According to the recent Ponemon Institute study cloud providers are “least confident in their ability to restrict privileged user access to sensitive data”.

Now part of that lack of confidence is because their customers control privileged access to the operating system of whatever is running in a cloud computing environment. So as a customer you need to take control of that part of the cloud environment and, as many of our customers are doing, use the same tools they do in their data centers to protect privileged account credentials. Many solutions like our Powerbroker Servers product can be configured to run in a public cloud or in a hybrid mode as an extension of the system in your data center.

That leaves the cloud providers privileged users who administer their hypervisor and control plane environments. Encryption of data is a vital protection and can address a number of concerns about malicious insiders particularly with unstructured data. Database encryption in the cloud is tricky and requires a well thought our architecture and key management system.

We don’t know of any confirmed breaches by cloud insiders but that doesn’t mean there isn’t risk. Most customers don’t have deep insight into their cloud provider’s technology stacks and operating procedures. So ask them! Review their SAS 70 certifications. Agree on standards and audit them. Go onsite and check their controls and look at their logs. Once customers make their needs known I think we will quickly see which cloud providers understand the enterprise customer and want to deliver the security required. In the meantime, caveat emptor.

Leave a Reply

Additional articles

red-thumbprint

Why big data breaches won’t always be so easy

Posted September 19, 2014    Byron Acohido

This blog post is republished with the permission of ThirdCertainty. See the original post here. – By: Byron Acohido, Editor-In-Chief, ThirdCertainty Some day, perhaps fairly soon, it will be much more difficult for data thieves to pull off capers like the headline-grabbing hacks of Home Depot and Target. That’s not a pipe dream. It’s the projected outcome…

Tags:
, , , , ,
pbps-blog2

8 Reasons Your Privileged Password Management Solution Will Fail

Posted September 18, 2014    Chris Burd

Leveraging complex, frequently updated passwords is a basic security best practice for protecting privileged accounts in your organization. But if passwords are such a no-brainer, why do two out of three data breaches tie back to poor password management? The fact is that not all privileged password management strategies are created equal, so it’s critical…

Tags:
, , , , , ,
pbps-customer-campaign-image

You Change Your Oil Regularly; Why Not Your Passwords?

Posted September 11, 2014    Chris Burd

There are many things in life that get changed regularly:  your car oil, toothbrush and hopefully, your bed sheets.  It’s rare that you give these things much thought – even when you forget to change them. But what if you’re forgetting something that can cost you millions of dollars if left unchanged for long periods…

Tags:
, , ,