The Real Problems with Cloud Computing
There is a great deal of truth that Google can maintain the security of systems better than individual companies. While I may be critical of some aspects of Google Apps security, I firmly believe that Google is significantly more likely to maintain the security of individual systems than companies would themselves.
Mon, August 24, 2009
CSO — The recent Twitter hack, where a French hacker compromised internal Twitter documents by accessing the account of administrative assistant, among others, was essentially an attack on Google Docs. The reason is that Twitter outsourced their infrastructure by contracting with Google, and the accounts in question were on Google's infrastructure.
The ensuing reports questioned the security of Google Apps and cloud security in general. In the process, Google claimed that their security was better and less expensive than the security that companies could provide for themselves. At the same time, people (including me) persisted in their statements that exposed information is exposed information. This position takes the stand that companies want to protect their information, and not the computers themselves. This can be extremely confusing for CSOs trying to decide whether or not to implement cloud computing. This issue is at the forefront, especially given Los Angeles County's stated intention to migrate to Google Apps.
Also see: Chris Hoff on Virtualization and Cloud Computing
Let's first acknowledge that Google Apps was not specifically "hacked" in the traditional sense of the word during the Twitter hack. A hacker did not break into Google computers through some technical vulnerability in the Google infrastructure.
A hacker found a personal e-mail account for the administrative assistant previously mentioned. Similar to the Sarah Palin Yahoo! account hack, the hacker researched social networking sites to find the answer to the "secret question" required to reset the account's password. In going through the e-mails in the account, the hacker apparently found the password used by the administrative assistant on other sites, and correctly assumed that person used that password on their Twitter corporate account at Google Apps.
This gave the person access to e-mails and files. Other information available to the account also allowed the attacker to compromise the Twitter corporate accounts of other employees.
While the initial reaction would be to blame the guessability of the security questions on the freemail account, as well as the reuse of the password, that is akin to saying people drown because of water. Clearly, there are many other vulnerabilities in cloud computing implementation that enabled the compromise of the accounts on Google Apps.
For example, the fact is Google Apps allowed for anyone in the world to attempt to log into any account at Twitter. In this case, the account holder was in the San Francisco area and the hacker logged in from France. If the accounts were maintained internally, Twitter would have had the ability to deny remote access. Similarly, if there was misuse and abuse detection, even allowed accesses would have been flagged given the location as well as the scope of the data access. There are also data leak prevention (DLP) tools that could have been in place.
