A Wakeup Call for the Cloud

Every so often something happens that should make people stop and think. That may have just happened in the cloud.

Code Spaces is a company that hosted application development work in Amazon Web Service’s cloud on behalf of its customers. On June 17 the company experienced a DDOS attack where traffic floods the company’s servers. Multiple media outlets have reported that when company officials contacted the perpetrator, a ransom was demanded. When the money was not paid, the bad guys hacked into the Cloud Spaces administrative console for Code Space’s AWS account and deleted what appears to be the entirety of the company’s files. Code Spaces has since been shut down.

AWS officials said their infrastructure as a service platform acted “as designed,” essentially directing the blame for this epic failure to the customer - in this case Code Spaces.

The incident should be a wake up call to anyone using cloud computing services - especially IaaS. If your business is hosted in the cloud or if you work with a vendor who hosts its backend operations in the cloud, this could happen to you.

Jupiterimages

The good news is there are steps that can be taken to make it hard for a perpetrator to hack into your account and literally destroy your business. Read about the seven tips I wrote about to protect your AWS cloudhere.

To be fair - we don’t yet have all the details as to exactly what happened as Code Spaces. Perhaps they did have security policies in place; or maybe they didn’t. The point is that this incident should be an alarm to cloud users to make sure they have the proper security measures in place to reduce the risk of something like this happening to them.

James Staten, an IaaS cloud expert at Forrester Research says the big lesson that users should take away from this incident is don’t put all your eggs in one basket. Code Spaces seemingly was hosted almost entirely in AWS’s cloud. Meaning that the primary functions of the company were in AWS’s cloud and it was backed up also in AWS’s cloud. “Your backup plan should not be your primary plan,” Staten says. When you literally store all of your data in AWS’s cloud, then if a hacker can break into the highest levels of an administrative console, then it can all be wiped out. Do your DR (disaster recovery) in another cloud, or at your on-premises data center, Staten recommends.

This is not the first time we’ve had what should be considered a wake-up call in this still young cloud computing industry. The last major one, I believe, was the abrupt shutdown of storage vendor Nirvanix. Within about a 6-week period this company went from business as usual to warning customers it had mere weeks to evacuate their data from the company’s cloud storage platform. Customers and analysts scrambled to get the data out as fast as possible. The company shut down shortly thereafter. Read lessons from that incidenthere.

This Code Spaces incident is eerily similar. It’s too bad that a company like Code Spaces appears to have been irrevocably damaged. But, on the bright side, perhaps this happening to one company will save it from happening to others.