Hotmail Breach shows off the dangers of the Cloud...

@ 2009/10/06
Just a couple of days ago I talked about the unfortunate tendency for corporations to look for the cheapest solution, not the best. While covering that I touched on the new found trust in Cloud Computing. This is a trend where big companies, looking to save money, are turning to hosted solutions for e-mail, documents, even operating systems instead of controlling them all on their own.

The problem is that these systems are not very secure. Web Based E-mail and document systems are all too easy to breech. Just look at the recent leak of "several thousand" Hotmail accounts to a third party site "most likely due to a phishing scam". That is a lot of user accounts to be exposed by a Phishing scam if you ask me and serves as an example of how insecure these systems can be. Now I know we are seeing a free web based solution here, but it is pretty much a cloud type of service. Yes, not all cloud systems are this insecure, and not all will be vulnerable to this type of attack but is still a cause for concern here.

Comment from Kougar @ 2009/10/07
Only difference is there is one of me, and an IT staff + management staff number of them. I prefer the odds when its just me I have to worry about... wouldn't be the first time a sales rep or tech inadvertently leaked something, or some big site got hacked.

More on topic, a follow up:

Quote:
Hotmail users aren't the only ones who've been hit by a phishing scheme over the past week. Google told BBC News on Tuesday that Gmail users have also been affected by the hackers who posted passwords online.

The problem is far more widespread than was disclosed on Monday, possibly affecting Yahoo and AOL e-mail accounts as well, according to BBC News.
http://news.cnet.com/8301-17939_109-...?tag=mncol;txt
Comment from jmke @ 2009/10/07
but that one user might exposure info of you in the cloud
Comment from wutske @ 2009/10/07
Every system, even when you host it yourself is vulnerable due to the incompetence of the user. The weakest link in security is almost always the end user.