This is already a couple of days old, but I wish there were some type of follow-up. I didn’t delve into it before because it was just said to be a rumor, but the possibility of the breach raises major concerns. What I am referring to is the rumor that the ones who hacked into PSN and caused a major disruption if not a major felonious assault did the work via Amazon’s EC2 service. They were able to leverage the cost-effectiveness of the cloud to do the major work that was needed for the pilfering of 100 million accounts. Here’s an excerpt from the entry on Bloomberg.com:
Amazon.com Inc. (AMZN)’s Web Services cloud- computing unit was used by hackers in last month’s attack against Sony Corp. (6758)’s online entertainment systems, according to a person with knowledge of the matter.
Hackers using an alias signed up to rent a server through Amazon’s EC2 service and launched the attack from there, said the person, who requested anonymity because the information is confidential. The account has been shut down, the person said.
The development sheds light on how hackers used the so- called cloud to carry out the second-biggest online theft of personal information to date. The incursion, which compromised the personal accounts of more than 100 million Sony customers, was “a very carefully planned, very professional, highly sophisticated criminal cyber attack,” Sony has said.
It’s not that Amazon did anything wrong, but it just seems the safeguards were not put in place to protect us from this. As we are all moving to cloud-based computing, data storage and retrieval, it just is a concern that we are moving too fast and the controllers of the clouds are not doing eveything to hammer away and make sure thse types of things can’t happen.
Don’t get me wrong. I think that the cloud is the direction we need to be heading, but when you look at the costs of rushing to the cloud, I just wish that more people did their due diligence.
So far, the only headaches I’ve personally dealt with pertaining to the cloud were due to key differences between uploading to a server as opposed to the particular cloud we were using. Unfortunately, it messed up versioning and caused duplicate work and more time until launch of some major products. Certainly not as huge and damaging as what is rumored to have happened regarding the cloud and PSN, but with that simplicity in comparison, wouldn’t you expect the IT group to check everything off their list to make sure the cloud is sound before migrating.
Is the cloud too shiny an object to take the time to do due diligence? Even if the rumors are untrue, my hope is that everyone is taking a closer look at the cloud and its security – not only in staying up, but keeping people and information safe.