Cloud Security Report: The Cloud May Be Safer

Monday, March 05, 2012

alan shimel


Cloud Security Report Shows Cloud Security Is Different and the Cloud May Be Safer

With the rush around RSA week last week, I didn’t get a chance to post on the “State of Cloud Security” report published by my friends at Alert Logic last week.

I think this first installment of what promises to be a semi-annual report sheds some real light on the differences between on premises and cloud security environments and also advances the notion that despite the FUD, the cloud may in fact be safer for certain kinds of applications.

(click image to enlarge)

csr-graphic-bg (1)

The report itself is an analysis of over 2.2B security events that were monitored by Alert Logic’s security team across over 1500 customers, resulting in over 62k actual incidents. With that volume of data you can really see trends and patterns develop.

Also the fact that this was split between hosted, cloud and on premises environments it gives you well rounded view of what is being seen in the way of attacks out there. BTW, you can download the report here.

Here are the important takeaways I would like to focus on:

•  When compared to traditional in-house managed IT environments, service 
provider environments show lower occurrence rates for every class of 
incident examined.

•  Service provider customers experienced lower threat diversity (i.e., the 
number of unique incident classes experienced by a customer) than 
on-premise customers.

•  On-premise environments were twelve times more likely than service 
provider environments to have common configuration issues, opening 
the door to compromise.

•  While conventional wisdom suggests a higher rate of Web application 
attacks in the service provider environment, Alert Logic found a higher 
frequency of these incidents in on-premise environments.

So what does it mean? First of all, there is a real difference in the kinds of attacks and events we see in the cloud versus on on premises. Anyone who is still saying that cloud security is no different than on premises cloud security to paraphrase President Obama, “doesn’t know what they are talking about”.

Secondly, the cloud does appear to be safer. They see fewer kinds of attacks, fewer attacks overall  and on the whole cloud/hosted environments have less configuration issues.

A third thing that is borne out in the data is something that I think intuitively we know. The bigger and more complex your environment, the more risk you have.

The report is chalk full of other great information. It is free and you really should go download it. Also stay tuned for future versions of the report in the months and years ahead.  Nice work by the Alert Logic team!

Cross-posted from Ashimmy, After All These Years Blog

Possibly Related Articles:
Cloud Security
Service Provider
RSA Cloud Security Application Security Incident Response Attacks Managed Services report Configuration Alan Shimel Alert Logic
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.