Is Blockchain The Missing Link In Cloud Security?
A few decades back, it was almost an otherworldly thought to have a virtual space that could store or manage our information and functions. The idea of cloud environment/cloud computing started taking shape as early as the 1960s, when the idea of an ‘intergalactic computer network’ was proposed. The idea soon came to reality with technological progression and here we are now, using cloud networks for operations as basic as storing our personal images on cloud to performing most critical computations and operations on cloud. The advent of digitalization and proliferation of new age technologies like Internet of Things, Big Data and Artificial Intelligence among others has pushed the need for having a more connected and secure network, which can store and work with zettabytes of data- all in the virtual space.
Rapidly expanding digitalization is only an indicator of how the companies are embracing digital solutions and suggests that the need for robust digital infrastructure will only grow in the future.
An increasing number of enterprises are now migrating to cloud systems, with a Gartner report marking that the global public cloud market is anticipated to increase 17.3 % on a year-on-year basis to about USD 206.2 billion in 2019,[1] propelled by organisations of all sizes that are moving toward digital transformation and adopting cloud infrastructure and related services.
Moreover, a survey by LogicMonitor suggests that 83% Of Enterprise Workloads will be shifted to the cloud by 2020, with 41% of the enterprise workloads to run on public cloud platforms, 22% to run on hybrid cloud systems and another 20% predicted to run on private-cloud-based systems by 2020.[2]
Why all the buzz around cloud systems and how safe is your data on the cloud?
Cloud infrastructure is touted superior to traditional IT infrastructure because of the easy and convenient storage and accessibility to data. Adopting cloud computing helps the companies to reduce the costs associated with establishment and maintenance of data centres, procurement of skilled technicians and physical data storage systems and other related equipment and solutions. It also gives more flexibility to access and complete tasks from anywhere and gives the companies more opportunities to scale their operations easily as and when required without worrying about additional storage systems, servers or licenses. Cloud computing offers a range of services in the form of Infrastructure as a Service (IaaS), Software as a Service (SaaS), Platform as a Service (PaaS) and so on. This allows the companies to use only the required software or infrastructure- that too on cloud- and only pay for what they have used. While all these are reasons enough to allure a company to migrate to cloud system, an even bigger reason is ‘Security’.
Although the threats that affect the on-premise and cloud IT infrastructures are same, cloud setup is generally regarded safer than on-premise IT infrastructure. Cloud services are hosted services that run in data centres, which are manned by experts. More so, the providers of cloud services establish advanced firewalls and security technologies in order to comply with the security standards of different regions as well as that laid by certain third-party security agencies. HITECH and HIPAA regulations, which concern with the healthcare data, are some examples of data security standards. Data centres work hard to comply with such standards and obtain compliance certifications that boost their status, as the certifications indicate that the provider’s procedures and technical capabilities align with the required standards to protect sensitive information and provides assurance to the customers.
There are three types of cloud deployments: hybrid, public and private. Companies can opt for the deployment that is most suitable for their business, while keeping in mind the nature and scope of their operations and financial budget, of course!
But despite all the benefits proclaimed, is cloud really that safe? Can you trust a system that is not physically present around you and is handled from a remote location that could be several thousand miles away from where you are currently!
In LogicMonitor’s Cloud Vision 2020: The Future of the Cloud Study, 66% of IT professionals surveyed mentioned security as their most significant concern while adopting an enterprise cloud computing strategy.
Cloud environments are highly connected and they need robust security controls to tackle the environmental variables as well as the associated data and workloads in transit or at rest. Weak credentials and identity management, insecure APIs, malicious insiders and account hijacks may put the data and system at high risk. Furthermore, the world has seen far too many sophisticated malware and other attacks like Advanced Persistent Threats (APTs) to continue being relaxed or oblivious to such threats. The attacks have become advanced enough to bypass network defences by effectively exploiting the vulnerabilities within the computing stack or even manipulating advanced security solutions that are based on new age technologies. Moreover, the customers lose some visibility and control over their data and operations to the Cloud Service Provider (CSPs), who has certain policies and protocols relating to the security monitoring and logging.
As the data is spread across several storage devices within the CSP’s infrastructure in a multi-tenancy setup, there could be a chance of incomplete and insecure data deletion by the CSP and users do not have the ability to verify if their data was deleted properly ad securely and that no remnants of the data exists that could be exploited by the attackers. Also, the set of APIs offered by the CSPs are easily available to all the customers through internet so that they can manage and interact with the cloud services; however, such easy availability of the APIs and potential presence of vulnerabilities could be a treat for the adversaries, who can easily exploit the vulnerabilities to their advantage and threaten the cloud assets. Moreover, cloud credentials if stolen by hackers could amplify the risk of data compromise as the attacker can then use the credentials to enter the CSP’s infrastructure and attack the company’s data. If the attacker gets his hands on a CSP administrator’s credentials then the entire infrastructure, including the assets of different entities, is at stake. Staff and administrators for both the CSPs and companies can also abuse their access authorities to illegally access, share and use data.
There are several such threats that exist in today’s cloud infrastructure but blockchain could come to its rescue. Several IT experts are suggesting the implementation of blockchain technology, which is known for its inherent audit capabilities. All the transactions on private and public blockchain systems are encrypted, time stamped and signed thereby making it easier for users to track down the events. It records every action and any new transaction fundamentally alters the status of the blockchain ledger, all while storing the previous iteration. This gives a complete history of the transaction which in turn makes all the actions auditable and discourages data tampering. The decentralised nature of blockchain helps in discouraging the adversaries from pushing false information into the network and disturbing the network. It can effectively decrease the threat of distributed denial-of-service (DDoS) attacks, which disrupts the functioning of several systems at once.
Cloud computing is a critical element supporting the Internet of Things, which entails disparate devices and systems connected to the network. These devices are at risks of cyber attacks, as some of these connected devices do not have robust in-built security features to counter infiltration, and one inadequately secure device can serve as a gateway for the attackers to enter the network and wreak havoc. Deployment of blockchain is not only believed to improve the security of the IoT network but also improve the network’s scalability. It can help in determining aberrant network behaviour and quarantine the nodes that perform erratically. Blockchain can also help in identifying the root cause of a problem by offering complete history of a transaction thereby allowing the business to understand the reason for the problem and take necessary action.
Will Blockchain patch cloud vulnerabilities?
Blockchain is still in its nascent stage and its capabilities are still to be explored to the fullest for effective implementation. There are some really promising blockchain-related innovations that can help companies boost cybersecurity. It won’t be long before blockchain becomes one of the main components of security defense strategies for companies and their cloud networks.
References:
[1]
[2]
Other sources:
https://www.computerweekly.com/feature/A-history-of-cloud-computing
https://www.growthbusiness.co.uk/7-reasons-business-needs-move-cloud-2552054/
https://www.atlantic.net/hipaa-compliant-cloud-storage/how-secure-is-the-cloud/
Related posts:
