Towards the end of last year, a managed WordPress hosting provider suffered a serious security breach in which customer credentials were exposed to an attacker. Breaches of this sort are a risk with any online service, but what’s interesting about this breach is that the blame rests squarely on one of the company’s cloud infrastructure providers.
Rather than targeting the company’s hosting clients directly, or attempting to infiltrate the company’s systems, the attackers instead focused on the cloud provider’s administrative panel. This is a fairly common vector for services using cloud providers — cloud control panels and cloud APIs make for convenient infrastructure management, but they’re also an obvious point of attack for a criminal who wants access to the company’s infrastructure.
What interests me about this attack is that the company itself has very little knowledge of or control over the security practices, the networks, the servers, and the underlying processes that secure their infrastructure. As with most cloud providers, the admin panel is simply an interface to a black box, the inner workings of which the cloud user has no insight into.
In fact, that lack of insight is the primary selling point of most cloud services. The value proposition of Infrastructure-as-a-Service is that users don’t have to worry about managing the underlying physical layer, including its security. The price to be paid for that convenience is that cloud users must have absolute trust in the cloud vendor — if something is less than well managed in the physical infrastructure layer, the virtualization layer, or the associated services, there’s really nothing that the user can do until after an attack is discovered.
We can contrast this to a bare metal cloud or dedicated server cluster platform. Because BMC is essentially physical infrastructure managed via an advanced clustering solution, users are able to monitor and control their hardware platform from the bare metal to the top of the software stack.
It wouldn’t be fair to say that the problem I’m highlighting here is exclusive to cloud systems. It’s perfectly possible for an analogous security oversight to cause similar issues in a BMC environment. It is, however, fair to say that in the case of BMC, users have insight and control over their infrastructure such that they can implement their own security and privacy processes, responsive to their business requirements and risk profile. They aren’t limited by whatever inscrutable systems a cloud vendor puts in place.
Virtualized cloud platforms have their place for users that require extreme scalability, but the security, performance, and price advantages of bare metal cloud platforms are undeniable — for most infrastructure hosting scenarios, bare metal is the best bet.