Cloud Computing represents one of the most significant shifts in information technology many of us are likely to see in our lifetimes. Reaching the point where computing functions as a utility has great potential, promising innovations we cannot yet imagine. Customers are both excited and nervous at the prospects of Cloud Computing. They are excited by the opportunities to reduce capital costs. They are excited for a chance to divest themselves of infrastructure management, and focus on core competencies. Most of all, they are excited by the agility offered by the on-demand provisioning of computing and the ability to align information technology with business strategies and needs more readily. However, customers are also very concerned about the risks of Cloud Computing if not properly secured, and the loss of direct control over systems for which they are nonetheless accountable. To aid both cloud customers and cloud providers, CSA developed Security Guidance for Critical Areas in Cloud Computing, initially released in April 2009, and revised in December 2009. This guidance has quickly become the industry standard catalogue of best practices to secure Cloud Computing, consistently lauded for its comprehensive approach to the problem, across 13 domains of concern. Numerous organizations around the world are incorporating the guidance to manage their cloud strategies. The guidance document can be downloaded at The great breadth of recommendations provided by CSA guidance creates an implied responsibility for the reader. Not all recommendations are applicable to all uses of Cloud Computing. Some cloud services host customer information of very low sensitivity, while others represent mission critical business functions. Some cloud applications contain regulated personal information, while others instead provide cloud-based protection against external threats. It is incumbent upon the cloud customer to understand the organizational value of the system they seek to move into the cloud. Ultimately, CSA guidance must be applied within the context of the business mission, risks, rewards, and cloud threat environment using sound risk management practices. The purpose of this document, Top Threats to Cloud Computing, is to provide needed context to assist organizations in making educated risk management decisions regarding their cloud adoption strategies. In essence, this threat research document should be seen as a companion to Security Guidance for Critical Areas in Cloud Computing. As the first deliverable in the CSAs Cloud Threat Initiative, the Top Threats document will be updated regularly to reflect expert consensus on the probable threats which customers should be concerned about. There has been much debate about what is in scope for this research. We expect this debate to continue and for future versions of Top Threats to Cloud Computing to reflect the consensus emerging from those debates. While many issues, such as provider financial stability, create significant risks to customers, we have tried to focus on issues we feel are either unique to or greatly amplified by the key characteristics of Cloud Computing and its shared, on-demand nature. We identify the following threats in our initial document: Abuse and Nefarious Use of Cloud Computing Insecure Application Programming Interfaces Malicious Insiders Shared Technology Vulnerabilities Data Loss/Leakage Account, Service & Traffic Hijacking Unknown Risk Profile The threats are not listed in any order of severity. Our advisory committee did evaluate the threats and each committee member provided a subjective ranking of the threats. The exercise helped validate that our threat listing reflected the critical threat concerns of the industry, however the cumulative ranking did not create a compelling case for a published ordered ranking, and it is our feeling that greater industry participation is required to take this step. The only threat receiving a consistently lower ranking was Unknown Risk Profile, however the commentary indicated that this is an important issue that is simply more difficult to articulate, so we decided to retain this threat and seek to further clarify it in future editions of the report. Selecting appropriate security controls and otherwise deploying scarce security resources optimally require a correct reading of the threat environment. For example, to the extent Insecure APIs (Application Programming Interfaces) is seen as a top threat, a customers project to deploy custom line- of-business applications using PaaS (Platform as a Service) will dictate careful attention to application security domain guidance, such as robust software development lifecycle (SDLC) practices. By the same token, to the extent Shared Technology Vulnerabilities is seen as a top threat, customers must pay careful attention to the virtualization domain best practices, in order to protect assets commingled in shared environments. In addition to the flagship CSA guidance and other research in our roadmap, this research should be seen as complimentary to the high quality November 2009 research document produced by ENISA (European Network and Information Security Agency), Cloud Computing: Benefits, Risks and Recommendations for Information Security. ENISAs research provides a comprehensive risk management view of Cloud Computing and contains numerous solid recommendations. The ENISA document has been a key inspiration, and we have leveraged the ENISA risk assessment process to analyze our taxonomy of threats. We encourage readers of this document to also read the ENISA document: http://www.enisa.europa.eu/act/rm/files/deliverables/cloud-computing-risk-assessment Our goal is to provide a threat identification deliverable that can be quickly updated to reflect the dynamics of Cloud Computing and its rapidly evolving threat environment. We look forward to your participation on subsequent versions of Top Threats to Cloud Computing, as we continue to refine our list of threats, and to your input as we all figure out how to secure Cloud Computing.
Cloud Security Alliance. (2013). The Notorious Nine. Cloud Computing Top Threats in 2013. Cloud Security Alliance (CSA), (February), 1–14. https://doi.org/10.1021/jm900143u