Access your Pro+ Content below.
Challenges with data protection in the cloud
This article is part of the June 2012 issue of Information Security magazine
In December 2010, Honda experienced a data breach that affected 2.2 million customers. Names, email addresses, vehicle identification numbers (VINs), and credentials for a Honda portal were stolen from a database. The database, however, was not accessed within Honda’s infrastructure. This sensitive information was stolen from a cloud-based marketing service provider that Honda did business with. A year ago, cloud storage provider Dropbox pushed a code change that eliminated the password authentication system required to access users’ stored data, rendering any data from any account accessible to anyone who wanted to access it. In addition, Dropbox drew criticism for maintaining control of users’ encryption keys, potentially making accounts and data susceptible to compromise should those keys fall into the wrong hands. Also, last year, Amazon’s Simple Storage Service (S3) was found to be susceptible to a basic HTTP-focused brute-force attack that could expose customer’s data storage accounts. As more systems, applications and ...
Features in this issue
Businesses and government agencies work to improve sharing of cyberthreat information.
Capabilities such as encryption and DLP can be complicated in the cloud.
SIMs aren’t just for network monitoring anymore.
Legislation designed to provide the federal government with threat data from the private sector gains steam.
Columns in this issue
Reflections on the ICS CERT alert, Oracle’s handling of a zero-day and more.
Security expert Marcus Ranum talks with Brian Chess, formerly of HP, about coding practices and security.
Enterprises need an agile risk management strategy to deal with today’s evolving threats.