Clouds Future Security Depends On Mobile

Passwords are a major weakness for cloud providers. Industry experts say that, in the future, mobile will be the authentication platform of choice

As more companies move some part of their infrastructure to the cloud, an increasing amount of corporate data will be accessed from anywhere in the world.
Great for productivity? Yes, but its also a security threat, a panel of experts stressed on Monday at the Cloud Security Alliance (CSA) Summit in San Francisco. In many cases, the only security measure standing between an attacker and the companys data is a username and password. Even with strong password policies, that can be too little security, says Patrick Harding, chief technology officer for identity and access management firm Ping Identity.
Passwords are the Achilles heel of cloud security, he says. If I can get your password ... I can get instant access to all of the data.
Instead, Harding and others see mobile devices being a key part of a persons identity. A smartphone equipped with some form of biometric security -- such as a fingerprint scanner or facial recognition -- could better verify a users identity and strengthen the security of the gates limiting access to cloud services.
The future of mobile devices and cloud security are already heavily linked, argues Harding. Where many companies worry about employees bringing their own devices (BYOD) into the network, he worries about BYOC, the cloud services that ride into the corporate network piggybacking on mobile devices. Users that downloaded apps that have not been vetted by the company could be allowing remote access into the company. Or the user could be using an unauthorized cloud service to store company-sensitive data, he says.
I now have the device I can use anywhere and these cloud services I can use anywhere, Harding says. Now IT has just lost control.
Beset with employees using devices, companies have to change their mindset and create policies to secure their data before the devices are used to send company information into the cloud, says David Lingenfelter, information security officer for mobile-device management firm Fiberlink.
You cant separate mobile devices and cloud, he says.
Yet the industry has a ways to go before mobile devices make good gatekeepers. The incentive to drive the broad adoption of the necessary technologies for authentication on smartphones has not yet arrived, says Harding. It will take five years for the technology to trickle out into the market, he says.
In addition, the software systems to manage the process need to be developed as well, says Don Godfrey, a panel member and a security consultant at health insurer Humana. Managing corporate passwords for tens of thousands of employees is difficult enough -- adding employee-owned phones to the mix will be a headache, he says.
When you have 40,000 associates using a phone-based authentication, while it can be very convenient, how do you -- as a company -- manage 40,000 phones? Godfrey says.
There are other pitfalls as well. In the past, biometric security has led to increased security risk because the biometrics were stored by a security firm. Its a mistake that should not be repeated, says Pings Harding.
As long as you leave my biometrics out of the cloud, this will work, he says.
Have a comment on this story? Please click Discuss below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Authorities affirm agencies are on course to adopt CyberScope. ◂ Discovered: 06/01/2025 Category: security	▸ Facebook Apps Share User IDs. ◂ Discovered: 06/01/2025 Category: security	▸ Facebook brings back Lolapps after fixing privacy breach. ◂ Discovered: 06/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Clouds Future Security Depends On Mobile