1. General Risk: There are many risks, from data breach to data leakage, which must be prioritized when selecting a provider. There is a way we can use to understand the client’s requirements, assess what providers are offering, then select the right framework that will allow you to implement control according your requirements and then assess any control gaps to help us understand whether the risk is within our appetite level.
2. Vendor lock: This is another problem that most consumers will have to deal with if their initial due diligence fails. In this case, most consumers don’t understand the technology used or the initial contract. Consumers are then locked in to provider and can’t leave.
3. Provider Exit: Financial stability of the provider is also important. What if the provider makes a large investment in technology, and the market disappears? Consumer data as well as provider data must be protected. Before making large investments, it is necessary to verify stability of the provider.
4. Multitenant: Due to the shared nature of cloud (Multitenant), side channel attack is also a concern for consumers. This needs to be prioritized, and rectified. Multitenancy can also pose a serious security and privacy issue. This is because other tenants are also using the same hardware. If the infrastructure is not secure, it could lead to isolation failure that results in data and service breaches.
You may also like: Top 10 Cyber Security Certifications For 2021
5. Virtualization – is the foundation of cloud. We can also say that without virtualization, there is no cloud. Multiple attacks have been detected against well-known hypervisors like ESXI. These attacks need to be tested and rectified. We need a secure virtual platform from which to build the secure service. There are many rootkits and malwares that can be used to exploit a weak virtual platform. Secure cloud is also about selecting the right virtual platform.
6. VM-HOPPING – Attackers target the less secure virtual machine, then the virtual platform, and finally the other tenant information and workload. This attack is technically known as VM Hopping attack. These attacks can usually occur due to insecure operating systems and insecure virtual platforms
7. API : API is on cloud because most services are assessed through web console or CLI. In both cases, API (application program interface) is the primary service to assess all services. The API accepts the request and forwards it.
