Amazon Web Services Customers Can Hack AWS Cloud And Steal Data, Says Oracle CTO Larry Ellison.<\/p>\n
(Note: After an award-winning career in the media business covering the tech industry, Bob Evans was VP of Strategic Communications at SAP in 2011, and Chief Communications Officer at Oracle from 2012 to 2016. He now runs his own firm, Evans Strategic Communications LLC.)<\/p>\n
CLOUD WARS \u2014 Oracle founder Larry Ellison this week said businesses using arch-rival Amazon\u2019s AWS cloud have become major cybersecurity threats because the AWS cloud architecture allows them to see and steal data belonging to other customers using the AWS cloud.<\/p>\n
Ellison made the remarks in a keynote at Oracle\u2019s annual OpenWorld conference on Monday while extolling the advantages of Oracle\u2019s new Generation 2 Cloud versus traditional cloud architecture such as what he said Amazon currently uses.<\/p>\n
The comments were striking because while cybersecurity has unquestionably become one of the major issues for business leaders in our increasingly digital economy, the blame for cyberattacks and cybercrime has rarely been put on customers\u2014instead, organized teams of cybercriminals and\/or nation-states looking to exploit digital weaknesses in other countries have almost always been named as the culprits.<\/p>\n
But Ellison on multiple occasions cited AWS \u201ccustomers\u201d as the agents or potential agents of data manipulation, data exfiltration and data theft\u2014and I\u2019ll offer verbatim examples from his keynote in just a moment.<\/p>\n
Before getting to those verbatim comments, I want to offer a few thoughts that help provide some context for Ellison\u2019s remarks\u2014because while cybersecurity and cyberattacks have been a major theme in some of Ellison\u2019s recent public presentations, he has never, as far as I can discover, cited \u201ccustomers\u201d as the bad guys.<\/p>\n
So let\u2019s take a look at Ellison\u2019s verbatim comments about customers as cyber threats and cybercriminals, which I transcribed from the video archive of his keynote address:<\/p>\n
Those are very strong words about the business customer that are using the enterprise cloud. I asked the Oracle spokesperson if she could share any data that supports what Ellison was saying\u2014for example, does Oracle consider that 10 percent of customers engage in cybercrime in the way Ellison described, or is it 25 percent, or something higher?\u2014but Oracle did not offer any such facts. Here\u2019s the statement I received from Oracle:<\/p>\n
\u201cThe point is that\u00a0 bad actor can pose\u00a0as customers on any public cloud, so from the perspective of an actual customer, a bad actor is a \u201ccustomer.\u201d<\/p>\n
\u201cYou can have bad actors using cloud instances for distributing unlawful content or performing otherwise forbidden tasks (crypt mining) while paying for their cloud instances with stolen credit cards. You can also deal with sophisticated attackers who will attempt to make use of malicious code and known vulnerabilities in an attempt to break multi-tenant separation (recent highly publicized vulnerabilities come to mind). So\u2026Yes. Bad actors posing as customers in the cloud are\u00a0potential\u00a0cyber threats. We prevent bad actors from committing nefarious acts.\u00a0Bad actors posing as customers are to clouds, what insider threats are to traditional on-premises environments\u2026<\/p>\n
\u201cThere is nothing stopping operatives from a rogue nation, for instance, from posing as a business of some kind, and opening an account with any public cloud vendor. From that standpoint, they are a customer \u2013 but they are also a bad actor who, once set up inside Microsoft or Amazon or Google cloud, to name a few, can start using malicious code to either mess with the infrastructure\u2019s control code or attempt to move sideways to steal data from other (legitimate) customers.<\/p>\n
\u201cFrom the standpoint of a legitimate customer, using such a less-secure-than-Oracle cloud vendor, that bad actor\u00a0LOOKS LIKE A CUSTOMER.<\/p>\n
Since public cloud vendors aren\u2019t the FBI or other law enforcement, they can\u2019t be in the business of vetting the legitimacy of customer x or customer y.<\/p>\n
Thus, bad actors posing as \u201ccustomers\u201d are a potential threat agent that Oracle can protect its other customers from by, among other security measures, isolating control code from software that manages the virtual machines or bare metal servers used by other customers.\u201d\u00a0(End of Oracle response.)<\/p>\n
To be sure, those are all very reasonable thoughts. But Larry Ellison\u2019s a very reasonable guy\u2014so why didn\u2019t he at least allude to a couple of these points during his hour-long keynote?<\/p>\n
So Oracle\u2019s just unveiled a sophisticated new \u201cGeneration 2 Cloud\u201d to help customers avoid becoming victims of cyberattacks in the cloud, and Oracle\u2019s also warning its good customers to watch out for its bad customers and\/or truly bad guys\u00a0posing\u00a0as customers.<\/p>\n
All in all, more proof that life\u2019s never dull in the Cloud Wars.<\/p>\n
I\u2019ve analyzed and written about the enterprise-tech business for more than 20 years from the media side as an editor-in-chief and chief content officer, and more recently as Chief Communications Officer at Oracle from 2012-2016. I\u2019ve written thousands of articles and columns\u2026MORE<\/p>\n
As businesses jump to the cloud to accelerate innovation and engage more intimately with customers, my Cloud Wars series analyze the major cloud vendors from the perspective of business customers.<\/p>\n","protected":false},"excerpt":{"rendered":"
Amazon Web Services Customers Can Hack AWS Cloud And Steal Data, Says Oracle CTO Larry Ellison. (Note: After an award-winning career in the media business covering the tech industry, Bob Evans was VP of Strategic Communications at SAP in 2011, and Chief Communications Officer at Oracle from 2012 to 2016. He now runs his own […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-49","post","type-post","status-publish","format-standard","hentry","category-tech-news"],"yoast_head":"\n