A gathering storm in the clouds?

This past week saw news that the ‘Cloud’ had fallen victim to the bot-herders. Use this link to see the coverage of it on CNET.  Security researchers found that a variant of the infamous password stealing Zeus Trojan had found its way onto a server, hosted on Amazon’s Elastic Computing Cloud (EC2) and they had used as their command and control point.

This news, I am sure, helped provoke a severe case of ‘I told you so’ from the cloud ‘nay-sayers’. However, whether the server site was in the cloud, or on plain boring terra firma, the cause of the hack, was not something new or revelatory. It was in all probability, something more prosaic. A hole in a particular application may have opened the door, or other instances of Zeus could have captured log-in credentials, which were then used to access the necessary services hosted on EC2.

It requires site owners to ensure that they lock-down access to the server and that they update and patch the software used to mitigate any vulnerabilities. The rush to cloud based services and infrastructure is gathering pace. What this incident should remind us is that the same rules, controls and requirements need to be applied to sites hosted in the cloud, as anywhere else.

December 14, 2009 | Filed Under Security, Technology 

comments

Leave a Reply