Cloud Storage: What Is It & Who Runs It?

The Cloud is a major talking point  in computing currenty, but its meaning is rather, poorly understood. Even so, its highlt likely high that you have already used the cloud, even if you were probabaly unaware of it it at the time. 

• In 1983, CompuServe offered its consumer users a small amount of disk space that could be used to store any files they chose to upload.[2]
• In 1994, AT&T launched PersonaLink Services, an online platform for personal and business communication and entrepreneurship. The storage was one of the first to be all web-based, and referenced in their commercials as, "you can think of our electronic meeting place as the cloud." 
• Amazon Web Services introduced their cloud storage service AWS S3 in 2006, and has gained widespread recognition and adoption as the storage supplier to popular services such as SmugMug, Dropbox and Pinterest. In 2005, Box announced an online file sharing and personal cloud content management service for businesses. 

• In most cases, the customer is in charge of protecting its virtual machines and applications. It’s too often assumed that the cloud service provider is in charge of securing the cloud environment. That’s only part of the story. Infrastructure as a service (IaaS) providers such as Amazon, Microsoft and Google take care of security for their physical data centers and the server hardware the virtual machines run on.

• It doesn’t matter what kind of security defenses the cloud provider offers if customers don’t protect their own networks, users and applications. Cloud providers offer security services and tools to secure customer workloads, but the administrator has to actually implement the necessary defenses. 

• A disconnection between perception and reality. As reported by McAfee, many breaches have occurred in IaaS environments that don’t fit the familiar “infiltrate with malware”  In most cases, the breach “is an opportunistic attack on data left open by errors in how the cloud environment was configured.”  The data shows a worrisome disconnect between the misconfigurations that companies using IaaS environments are aware of and those that escape their attention. Survey respondents say they are aware of 37 misconfiguration incidents on average per month, but McAfee’s customer data shows that those enterprises actually experienced about 3,500 misconfiguration incidents per month, a year-over-year increase of 54%. 

• There are numerous tools widely available which allow potential attackers to identify misconfigured cloud resources on the internet. According to Symantec’s 2019 Internet Threat Report, in 2018 Amazon Web Services S3 buckets emerged as an Achilles heel for organizations, with more than 70 million records stolen or leaked as a result of poor configuration. . Unless organisations take action to properly secure their cloud resources, such as following the advice provided by Amazon for securing S3 buckets, they are leaving themselves open to attack, according to Symantec. 
• Increasingly complex enterprise IT environments. The growing adoption of multi-cloud environments among enterprises, coupled with a lack of complete awareness of all the cloud services in use at an enterprise, is exacerbating the misconfiguration problem, according to McAfee. In its recent study, 76% of enterprises reported having a multi-cloud environment, but an examination of customer data found that actually 92% of those environments are multi-cloud, an increase of 18% year over year.
• While multi-cloud environments have advantages, they can also become complicated to administer, manage and control. “Security practitioners responsible for securing data in IaaS platforms are constantly playing catch up, and they don’t have an automated way to monitor and automatically correct misconfigurations across all the cloud services,” says Dan Flaherty, McAfee director of product marketing.