Welcome!

@CloudExpo Authors: Ed Featherston, Yeshim Deniz, Elizabeth White, Liz McMillan, Kevin Benedict

Related Topics: @CloudExpo, Cloud Security, @DXWorldExpo

@CloudExpo: Article

Ransomware in the Age of #SaaS | @CloudExpo SDN #AI #ML #CloudSecurity

There’s a rapidly evolving range of threats that SaaS users face on their own side that SaaS providers have no control over

Protecting Data and Applications in the Age of SaaS

Recent market analysis from Cisco demonstrates the torrid adoption of cloud-based services. By 2019, more than four-fifths of all data center traffic, 83 percent, will be based in the cloud (up from 65 percent today). Most of this action will be going to public cloud services, which will account for 56 percent of all cloud workloads. In terms of type of cloud services, a majority will be applications, as the study finds Software as a Service (SaaS) is and will continue to be the dominant mode. Currently, about 45 percent of cloud implementations are SaaS; this figure is expected to grow to 59 percent by 2019, and SaaS adoption is particularly widespread among SMBs.

The increasing trust and confidence in public cloud services has contributed, and is continuing to contribute, to the growth in SaaS adoption for mission-critical workloads. More specifically, companies using or considering SaaS are often attracted to the greater level of cybersecurity protection that SaaS providers can deliver, including installations, maintenance, upgrades and patches.

However, there's a rapidly evolving range of threats that SaaS users face on their own side that SaaS providers have no control over. These include ransomware, various insider threats and third-party apps. Ensuring a high level of protection and security for SaaS-based data and apps depends as much on SaaS users addressing these client-side threats as it does on the cybersecurity resilience of SaaS providers. Here, we'll explore these primary threats and offer tips for SaaS users to address them.

Ransomware on the Rise
Ransomware - a form of cyberattack where hackers seize and encrypt data, and demand compensation (Bitcoin) for data to be unlocked - is now the biggest malware threat in the world. Undercapitalized and outgunned small businesses are increasingly the target of ransomware. According to recent research from Kaspersky Lab, 42 percent of SMBs worldwide suffered a ransomware-based attack between late 2015 to late 2016. Of those, one in three paid up the ransom, but one in five never got their files back, despite paying.

SaaS users may initially believe that using a SaaS provider naturally protects them from this kind of attack. Cloud file solutions like Google Drive create a second copy of local data that is stored in the cloud. But this doesn't mean your data is backed up and protected. If you're infected with ransomware, the files on a local hard drive will be held for ransom (by encryption) and any backup copies in Google Drive will be overwritten when the computer is synced. This means the "backup" data is now essentially also being held for ransom.

Proper backup is the only true protection for SaaS users - and all organizations for that matter - to guard against ransomware attacks. One effective technique is cloud-to-cloud backup, which enables data stored in one cloud to be backed up to another cloud. This type of backup can be automated, for maximum ease and resource-efficiency. In the future, we expect backup capabilities to deliver more automated ransomware protection - not just backing up data, but actually identifying ransomware attacks and the impacted files. This will help expedite data recovery and minimize any potential business disruption and downtime.

Insider Threats
Another major security problem today is insiders - according to Verizon, insiders are responsible for up to 90 percent of security incidents. This does not mean, however, that all these insiders have ill intentions. Most insider-driven security breaches are committed by innocent workers who are unaware they're actually doing something wrong, and creating major risks.

Consider an employee who moves sensitive data from a SaaS application to their personal iPad, or even their personal email address, in order to work on it at home. Their aim is good - to be more productive - but practices such as these can be hazardous. In the simplest example, this employee may lose their device and it may fall into the wrong hands. Or, the employee may switch jobs and go to a competitor, and then have full access to this SaaS data via their personal email account.

To address these threats, organizations should instill a culture of security and implement training on how employees can avoid certain practices that inadvertently create risk - from sharing passwords, to clicking on suspicious email links, to downloading and sending data to personal devices and email accounts. As the Ponemon Institute notes, "Good protection starts at the computer."

But given the speed at which most workers are moving today, it is important to supplement this training with automated protections and supports. SaaS users can also benefit from automated solutions that identify and delete risky data sharing practices and alert IT to risky or unusual user behaviors. These types of oversights can help minimize unnecessary risk exposure.

Third-Party Apps
Third-party apps that connect directly to SaaS data and applications are another major threat. Often, employees will download third-party apps - for functions like calendar or messaging, for example - in order to supplement the functionality of their SaaS apps. However, they often do this without express IT permission, a trend known as "shadow IT." Their intentions may be good, but if any one of these apps is backed by a malicious party, that party now has a full-access pass to critical SaaS data and applications.

Consider the case of the recent Gooligan malware, an Android-based malware that has compromised more than one million Google accounts, hundreds of them associated with enterprise users. The infection began when users downloaded and installed a Gooligan-infected app from a third-party app store on a vulnerable Android device. Through a process called rooting, Gooligan then stole Google account and authentication token information and launched a sinister money-making scheme, downloading apps and giving them positive reviews, as well as installing adware to fraudulently generate revenues.

While the Gooligan hackers' ultimate goal proved not to be data theft, they could have inflicted major damage. According to researchers, a total of 86 apps available in third-party marketplaces carried the malware, and collectively they had the power to root 74 percent of all Android phones worldwide. Gooligan was just the latest (and perhaps most eye-opening) example of the potential danger that third-party apps can pose to the security of connected SaaS-based data and applications. Industry research shows that the use of third-party apps within enterprises has increased 30 times over the past two years, and more than a quarter of these apps are risky. Given the acceleration of third-party app downloads - which isn't expected to slow anytime soon - SaaS users should frequently scan third-party applications accessing SaaS systems, as well as "blacklist" and remove any identified as suspicious.

Conclusion
Both SaaS providers and users face a rapidly evolving threat environment, and protection and security of SaaS-based data and applications must be a shared endeavor. SaaS providers have made great strides in their security standardizations, but it is impossible for them to address the range of threats that lie on the client-side, including ransomware, insider threats and third-party apps. SaaS users must assume this responsibility and understand the important role they play in ensuring the security and protection of their own data and apps based in the cloud.

More Stories By Dmitry Dontsov

Dmitry Dontsov, CEO of Spinbackup, has wide technology and marketing expertise in the area of cloud apps development and management. In addition to being the CEO and Co-founder of Spinbackup, he is the Co-founder of Bridge and founder of Optimum Web Outsourcing.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@CloudExpo Stories
Blockchain. A day doesn’t seem to go by without seeing articles and discussions about the technology. According to PwC executive Seamus Cushley, approximately $1.4B has been invested in blockchain just last year. In Gartner’s recent hype cycle for emerging technologies, blockchain is approaching the peak. It is considered by Gartner as one of the ‘Key platform-enabling technologies to track.’ While there is a lot of ‘hype vs reality’ discussions going on, there is no arguing that blockchain is b...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settle...
"IBM is really all in on blockchain. We take a look at sort of the history of blockchain ledger technologies. It started out with bitcoin, Ethereum, and IBM evaluated these particular blockchain technologies and found they were anonymous and permissionless and that many companies were looking for permissioned blockchain," stated René Bostic, Technical VP of the IBM Cloud Unit in North America, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventi...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
The cloud era has reached the stage where it is no longer a question of whether a company should migrate, but when. Enterprises have embraced the outsourcing of where their various applications are stored and who manages them, saving significant investment along the way. Plus, the cloud has become a defining competitive edge. Companies that fail to successfully adapt risk failure. The media, of course, continues to extol the virtues of the cloud, including how easy it is to get there. Migrating...
The need for greater agility and scalability necessitated the digital transformation in the form of following equation: monolithic to microservices to serverless architecture (FaaS). To keep up with the cut-throat competition, the organisations need to update their technology stack to make software development their differentiating factor. Thus microservices architecture emerged as a potential method to provide development teams with greater flexibility and other advantages, such as the abili...
Product connectivity goes hand and hand these days with increased use of personal data. New IoT devices are becoming more personalized than ever before. In his session at 22nd Cloud Expo | DXWorld Expo, Nicolas Fierro, CEO of MIMIR Blockchain Solutions, will discuss how in order to protect your data and privacy, IoT applications need to embrace Blockchain technology for a new level of product security never before seen - or needed.
Leading companies, from the Global Fortune 500 to the smallest companies, are adopting hybrid cloud as the path to business advantage. Hybrid cloud depends on cloud services and on-premises infrastructure working in unison. Successful implementations require new levels of data mobility, enabled by an automated and seamless flow across on-premises and cloud resources. In his general session at 21st Cloud Expo, Greg Tevis, an IBM Storage Software Technical Strategist and Customer Solution Architec...
The use of containers by developers -- and now increasingly IT operators -- has grown from infatuation to deep and abiding love. But as with any long-term affair, the honeymoon soon leads to needing to live well together ... and maybe even getting some relationship help along the way. And so it goes with container orchestration and automation solutions, which are rapidly emerging as the means to maintain the bliss between rapid container adoption and broad container use among multiple cloud host...
Blockchain is a shared, secure record of exchange that establishes trust, accountability and transparency across business networks. Supported by the Linux Foundation's open source, open-standards based Hyperledger Project, Blockchain has the potential to improve regulatory compliance, reduce cost as well as advance trade. Are you curious about how Blockchain is built for business? In her session at 21st Cloud Expo, René Bostic, Technical VP of the IBM Cloud Unit in North America, discussed the b...
Imagine if you will, a retail floor so densely packed with sensors that they can pick up the movements of insects scurrying across a store aisle. Or a component of a piece of factory equipment so well-instrumented that its digital twin provides resolution down to the micrometer.
While some developers care passionately about how data centers and clouds are architected, for most, it is only the end result that matters. To the majority of companies, technology exists to solve a business problem, and only delivers value when it is solving that problem. 2017 brings the mainstream adoption of containers for production workloads. In his session at 21st Cloud Expo, Ben McCormack, VP of Operations at Evernote, discussed how data centers of the future will be managed, how the p...
As DevOps methodologies expand their reach across the enterprise, organizations face the daunting challenge of adapting related cloud strategies to ensure optimal alignment, from managing complexity to ensuring proper governance. How can culture, automation, legacy apps and even budget be reexamined to enable this ongoing shift within the modern software factory? In her Day 2 Keynote at @DevOpsSummit at 21st Cloud Expo, Aruna Ravichandran, VP, DevOps Solutions Marketing, CA Technologies, was jo...
"Since we launched LinuxONE we learned a lot from our customers. More than anything what they responded to were some very unique security capabilities that we have," explained Mark Figley, Director of LinuxONE Offerings at IBM, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
When shopping for a new data processing platform for IoT solutions, many development teams want to be able to test-drive options before making a choice. Yet when evaluating an IoT solution, it’s simply not feasible to do so at scale with physical devices. Building a sensor simulator is the next best choice; however, generating a realistic simulation at very high TPS with ease of configurability is a formidable challenge. When dealing with multiple application or transport protocols, you would be...
Nordstrom is transforming the way that they do business and the cloud is the key to enabling speed and hyper personalized customer experiences. In his session at 21st Cloud Expo, Ken Schow, VP of Engineering at Nordstrom, discussed some of the key learnings and common pitfalls of large enterprises moving to the cloud. This includes strategies around choosing a cloud provider(s), architecture, and lessons learned. In addition, he covered some of the best practices for structured team migration an...
In his session at 21st Cloud Expo, Raju Shreewastava, founder of Big Data Trunk, provided a fun and simple way to introduce Machine Leaning to anyone and everyone. He solved a machine learning problem and demonstrated an easy way to be able to do machine learning without even coding. Raju Shreewastava is the founder of Big Data Trunk (www.BigDataTrunk.com), a Big Data Training and consulting firm with offices in the United States. He previously led the data warehouse/business intelligence and B...
Smart cities have the potential to change our lives at so many levels for citizens: less pollution, reduced parking obstacles, better health, education and more energy savings. Real-time data streaming and the Internet of Things (IoT) possess the power to turn this vision into a reality. However, most organizations today are building their data infrastructure to focus solely on addressing immediate business needs vs. a platform capable of quickly adapting emerging technologies to address future ...
In his general session at 21st Cloud Expo, Greg Dumas, Calligo’s Vice President and G.M. of US operations, discussed the new Global Data Protection Regulation and how Calligo can help business stay compliant in digitally globalized world. Greg Dumas is Calligo's Vice President and G.M. of US operations. Calligo is an established service provider that provides an innovative platform for trusted cloud solutions. Calligo’s customers are typically most concerned about GDPR compliance, application p...
You know you need the cloud, but you’re hesitant to simply dump everything at Amazon since you know that not all workloads are suitable for cloud. You know that you want the kind of ease of use and scalability that you get with public cloud, but your applications are architected in a way that makes the public cloud a non-starter. You’re looking at private cloud solutions based on hyperconverged infrastructure, but you’re concerned with the limits inherent in those technologies.