I recently read a blog post from a technical professional who’s account had been hacked (http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/) – not because he used poor passwords or unsafe practices, but because the hackers used some social engineering to get around the safety he had put into place.
While I won’t focus on the particulars of his situation, the interesting part of his loss was the fragility of the security of his data. In this case, he lost personal data – with no way to replace it. Two things stood out for me in his article: the chain of security through his accounts, and the single-source of data he had.
In this case, someone contacted the vendor and pretended to be this person. Using easily obtained information, they simply gained access to the account, and didn’t even have to hack the password. From there, the chain was that using various convenience-features, the hackers could delete the smartphone, and then on to the laptop the person owned. They completely wiped that out, and this is where there is an issue – he had his data on that laptop, and on the same vendor’s cloud backup. Since the hacker *was* the account owner by that time, they wiped out both. The person’s personal pictures, etc were gone forever. From there the hackers impersonated the person on Twitter and made racist and other statements to embarrass the person.
Although lots of features are available in all vendor products, I’ve always been….paranoid about using them. I try to follow the “moats and bridges” approach to security, meaning that one account or feature doesn’t lead to another. I don’t link things together that can be used to attach to more than one account, even when it's a cool new feature. One public logon from an airport’s “free” wifi (which I never use, by the way) can lead to these attacks – even if you don’t think you’re logging on. Ever check your mail from the airport? Do you have more than one mail account in your mail client? You could be hacked. I realize most client software does a good job of trying to prevent this, but I use my own MiFi device which I have set to the highest encryption I can.
I also keep lots of data in the cloud – but that’s not the only place. Periodically I have my important data backed up to a local drive,which I rotate to another secure location. After all, I’ve moved most of my books, pictures, scans, everything to a digital format. There’s no way I’m keeping that in just one place, or on just one vendor.
There are other things you can do to protect yourself – a great list is here: http://gizmodo.com/5932663/9-things-you-absolutely-must-do-to-keep-your-online-identity-secure
When I help clients design solutions on Windows Azure, I recommend another copy of the storage wherever possible – even on other vendor's cloud storage or locally on a drive, or both. I’m paranoid that way – I don’t want them to lose data. We take extraordinary precautions against losing data. Azure data has three copies on separate fault domains, and then those three are copied again to another physical datacenter automatically, that’s just built into the system. Even so, I recommend periodic backups to other
locations of data the client can’t easily re-generate.
While we provide lots of tools, information and guidance about security and protection in Windows Azure, ultimately it's up to you to properly secure your assets and plan for disaster recovery. That's true of any cloud provider - you need to learn the platform well to understand how to protect your data.
What I architect in Windows Azure I practice at home. Read that blog post, and I think you will agree it’s good to be a little paranoid. Sometimes they really are out to get you.