SYS-CON MEDIA Authors: Pat Romanski, Yeshim Deniz, Nikita Ivanov, Sean Houghton, Glenn Rossman

Related Topics: Cloud Expo, Java, SOA & WOA, Linux, Security, SDN Journal

Cloud Expo: Article

Maybe the Cloud Can Help Secure the Internet

Ironically, the majority of cyber security problems do not go away once they are discovered or disclosed

As recent events have confirmed once again, no single company, organization or government is up to the task of securing the Internet. The never-ending cat and mouse game of exploits chasing vulnerabilities continues. The stunning Heartbleed discovery has shaken the online security establishment to the core. Claims of security and privacy for many Web servers were patently false.

We all know a chain is only as strong as its weakest link and the unintended back door information leak that is Heartbleed has undoubtedly allowed countless secrets to escape from secure servers, albeit as random pieces of a puzzle to be reassembled by the hacker. It will undoubtedly go down in history as the most widespread compromise of online services since the advent of the Web. Why? Because we now conduct an unprecedented number of so-called "secure" communications over SSL in every facet of commerce, government and the social web.

Ironically, the majority of cyber security problems do not go away once they are discovered or disclosed. Even when corrective fixes or software updates are widely available, the original vulnerabilities live on, continuing to exist in countless systems accessible via the Internet. The risk from Heartbleed is probably increasing as the rise in the number of malicious exploits is likely to be outpacing the speed with which vulnerable resources are being protected or updated.

Another equally dramatic trend is the escalating malicious use of standard Internet services such as DNS (Domain Name System) and NTP (Network Time Protocol) as unwilling attack drones for third-party Distributed Denial of Service (DDoS) attacks. In reflection or amplification DDoS attack scenarios, the legitimate infrastructure of the Internet is tricked into attacking innocent victims. These specific services are just two common examples of Internet services with vulnerable populations of millions of publicly accessible servers that can be easily co-opted as "bots-on-demand" without any security compromise needing to have taken place in advance of the attack. These innocent servers are just sitting out there, waiting to be called into action to attack at a moments notice.

"Heartbleed" and "Amplification DDoS" attacks are just two headline examples of the serious cyber-security problems presented by an unsecured Internet. Malicious traffic carrying these threats flows freely over most service provider networks. Similarly, the cloud is generally agnostic to the intent of the traffic it delivers or serves. Many hosting providers unknowingly accommodate customers who do not practice safe Internetworking, making their public cloud offerings a platform for vulnerable services. Even more worrying is that most customers end up paying their provider for the bandwidth that delivers potentially dangerous Internet content.

What can the service provider industry do to combat these alarming trends? Ideally, we need to flip the commercial equation away from payment for raw (unsecured) Internet traffic and toward subscription services for protected (secured) Internet access. The technology exists today to squash Heartbleed as it transits the service provider network. Likewise, security devices can detect and block DNS and NTP amplification attacks in the network before they coalesce into a perfect storm of unsolicited responses - before raining down on the victim subnet, causing collateral damage to communications for other customers as they become caught up in the network traffic jam that is typical of volumetric DDoS attacks.

The cloud service provider is in a unique position to dramatically improve Internet security. Cloud customers are showing increasing interest in purchasing premium secured Internet access services, free from the malicious threats such as Heartbleed, Amplification DDoS and more. The commercial benefits are becoming even more clear with each successive breach, compromise or attack that impacts unprotected customers, compromises security or damages a brand.

For customers who willingly choose a protected cloud service, the issue of net neutrality is moot. They are explicitly deciding to purchase a network security service that is supposed to remove unwanted traffic. The network security technology is available now that can apply threat detection and mitigation policies on a per-customer basis. The decision to pay for the removal of DDoS attacks and cyber threats does not need to impact the net-neutrality perspective of other cloud customers.

An additional beneficial side effect of secured cloud offerings is the virtual patching of vulnerable Internet Services, such as open DNS resolvers and "monlist" supporting NTP servers. Even if a hosted customer unintentionally deploys a vulnerable service, it is practical to offer them paid protection to prevent those services being leveraged by malicious third parties such as those who are planning to launch DDoS attacks on third parties by leveraging vulnerable cloud resources.

In conclusion, it is clear that technically the cloud can play a significant role in securing the Internet against DDoS attacks and cyber threats. Equally important is the presence of an economic engine for such change driven by customer demand for premium secured cloud services.

More Stories By Ashley Stephenson

Ashley Stephenson is Chief Executive Officer of Corero Network Security. As CEO he leads Corero’s global expansion strategy. A seasoned executive with a proven track record in the technology industry, he brings a notable record, having co-founded or led several technology companies as Chairman or CEO.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Latest Stories
"There is a natural synchronization between the business models, the IoT is there to support ,” explained Brendan O'Brien, Co-founder and Chief Architect of Aria Systems, in this SYS-CON.tv interview at the 15th International Cloud Expo®, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Fundamentally, SDN is still mostly about network plumbing. While plumbing may be useful to tinker with, what you can do with your plumbing is far more intriguing. A rigid interpretation of SDN confines it to Layers 2 and 3, and that's reasonable. But SDN opens opportunities for novel constructions in Layers 4 to 7 that solve real operational problems in data centers. "Data center," in fact, might become anachronistic - data is everywhere, constantly on the move, seemingly always overflowing. Net...
An entirely new security model is needed for the Internet of Things, or is it? Can we save some old and tested controls for this new and different environment? In his session at @ThingsExpo, New York's at the Javits Center, Davi Ottenheimer, EMC Senior Director of Trust, reviewed hands-on lessons with IoT devices and reveal a new risk balance you might not expect. Davi Ottenheimer, EMC Senior Director of Trust, has more than nineteen years' experience managing global security operations and asse...
The 4th International DevOps Summit, co-located with16th International Cloud Expo – being held June 9-11, 2015, at the Javits Center in New York City, NY – announces that its Call for Papers is now open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's large...
SYS-CON Media announced that Centrify, a provider of unified identity management across cloud, mobile and data center environments that delivers single sign-on (SSO) for users and a simplified identity infrastructure for IT, has launched an ad campaign on Cloud Computing Journal. The ads focus on security: how an organization can successfully control privilege for all of the organization’s identities to mitigate identity-related risk without slowing down the business, and how Centrify provides ...
The Internet of Things promises to transform businesses (and lives), but navigating the business and technical path to success can be difficult to understand. In his session at @ThingsExpo, Sean Lorenz, Technical Product Manager for Xively at LogMeIn, demonstrated how to approach creating broadly successful connected customer solutions using real world business transformation studies including New England BioLabs and more.
There's Big Data, then there's really Big Data from the Internet of Things. IoT is evolving to include many data possibilities like new types of event, log and network data. The volumes are enormous, generating tens of billions of logs per day, which raise data challenges. Early IoT deployments are relying heavily on both the cloud and managed service providers to navigate these challenges. In her session at Big Data Expo®, Hannah Smalltree, Director at Treasure Data, discussed how IoT, Big D...
The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, discussed how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will need to convince a skeptical public to participate. Get ready to show them the money!
The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
In her General Session at 15th Cloud Expo, Anne Plese, Senior Consultant, Cloud Product Marketing, at Verizon Enterprise, focused on finding the right mix of renting vs. buying Oracle capacity to scale to meet business demands, and offer validated Oracle database TCO models for Oracle development and testing environments. Anne Plese is a marketing and technology enthusiast/realist with over 19+ years in high tech. At Verizon Enterprise, she focuses on driving growth for the Verizon Cloud platfo...
SYS-CON Events announced today Isomorphic Software, the global leader in high-end, web-based business applications, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Isomorphic Software is the global leader in high-end, web-based business applications. We develop, market, and support the SmartClient & Smart GWT HTML5/Ajax platform, combining the productivity and performance of traditional desktop software ...
The Internet of Things will put IT to its ultimate test by creating infinite new opportunities to digitize products and services, generate and analyze new data to improve customer satisfaction, and discover new ways to gain a competitive advantage across nearly every industry. In order to help corporate business units to capitalize on the rapidly evolving IoT opportunities, IT must stand up to a new set of challenges. In his session at @ThingsExpo, Jeff Kaplan, Managing Director of THINKstrateg...
The Internet of Things is tied together with a thin strand that is known as time. Coincidentally, at the core of nearly all data analytics is a timestamp. When working with time series data there are a few core principles that everyone should consider, especially across datasets where time is the common boundary. In his session at Internet of @ThingsExpo, Jim Scott, Director of Enterprise Strategy & Architecture at MapR Technologies, discussed single-value, geo-spatial, and log time series dat...
DevOps Summit 2015 New York, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that it is now accepting Keynote Proposals. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete...
SYS-CON Events announced today that Gridstore™, the leader in hyper-converged infrastructure purpose-built to optimize Microsoft workloads, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Gridstore™ is the leader in hyper-converged infrastructure purpose-built for Microsoft workloads and designed to accelerate applications in virtualized environments. Gridstore’s hyper-converged infrastructure is the ...