The Next Hacking Frontier: Private Clouds

Before the Labor Day long-weekend, I would like to conduct some fear mongering. Should I talk about the 9.1 percent unemployment rate? Nope. How about a double-dip recession? Nah. Bank of America going belly-up? No thank you.

Rather, let's talk about security, and more specifically, let's talk about the security ─ or lack thereof ─ in the private clouds you techies have been building.

Yesterday, I met with John Linkous, the chief security and compliance officer of eIQnetworks, an Acton, Massachusetts-based security vendor. While there have been several high-profile cases of public clouds being hacked, private clouds on Wall Street have remained ─ as far as I know ─ unaffected.

When I asked Linkous if he expected this trend to continue for the foreseeable future, he gave me a yes-and-no response. Basically, right now there is no reason for the hacking community to set its sights on Wall Street, because there isn't a Fabergé egg to be found, he says.

Even those cutting-edge hedge funds that have been developing internal cloud solutions haven't been keen on putting important information into those environments. But when you consider the leaps and bounds that have been made toward getting the buy side to be comfortable with the cloud, it's only a matter of time until the industry starts to put sensitive information into such environments.

Linkous used Microsoft's operating system as an example to illustrate his point. Back in 2000, Microsoft dominated the OS scene. Thus, there was more incentive for hackers to find the cracks in Windows. But as Microsoft has lost marketshare to the likes of Apple, it has created greater incentive for the attacking community to turn its attention on Apple's OS.

"I think that there will be a tipping point when enough critical data gets out there that's worth hacking," Linkous says. "Vendors haven't fully addressed those security concerns yet, and there's going to be a plateau when those attacks go like crazy and vendors will be forced to implement appropriate security controls. At the end of the day, what drives business? Security or functionality? It's functionality every time ─ security is an afterthought."

While Linkous has a dog in this fight, there's plenty of reason to believe what he's saying. If elite hackers can tap into the Department of Defense, surely they can get into a $2 billion hedge fund's private cloud.

So please take this thought with you into the three-day weekend: You are not nearly as secure as you think you are.

Have a great Labor Day!