A security flaw has been unearthed in Microsoft's Azure App Service that resulted in the exposure of source code of customer applications written in Java, Node, PHP, Python, and Ruby for at least four years since September 2017.

The vulnerability, codenamed "NotLegit," was reported to the tech giant by Wiz researchers on October 7, 2021, following which mitigations have been undertaken to fix the information disclosure bug in November. Microsoft said a "limited subset of customers" are at risk, adding "Customers who deployed code to App Service Linux via Local Git after files were already created in the application were the only impacted customers."

The Azure App Service (aka Azure Web Apps) is a cloud computing-based platform for building and hosting web applications. It allows users to deploy source code and artifacts to the service using a local Git repository, or via repositories hosted on GitHub and Bitbucket.

The insecure default behavior occurs when the Local Git method is used to deploy to Azure App Service, resulting in a scenario where the Git repository is created within a publicly accessible directory (home/site/wwwroot).

While Microsoft does add a "web.config" file to the .git folder which contains the state and history of the repository to restrict public access, the configuration files are only used with C# or ASP.NET applications that rely on Microsoft's own IIS web servers, leaving out apps coded in other programming languages like PHP, Ruby, Python, or Node that are deployed with different web servers like Apache, Nginx, and Flask.

"Basically, all a malicious actor had to do was to fetch the '/.git' directory from the target application, and retrieve its source code," Wiz researcher Shir Tamari said. "Malicious actors are continuously scanning the internet for exposed Git folders from which they can collect secrets and intellectual property. Besides the possibility that the source contains secrets like passwords and access tokens, leaked source code is often used for further sophisticated attacks."

"Finding vulnerabilities in software is much easier when the source code is available," Tamari added.

Here is the original post:
4-Year-Old Bug in Azure App Service Exposed Hundreds of Source Code Repositories - The Hacker News

In the first two weeks of this month, Amazon Web Services (AWS) hit some bumps that caused two outages: a bigger, more widespread one on December 7, and a smaller, more localized one on Dec. 15. Both catalyzed disruptions across a range of websites and online applications, including Google, Slack, Disney Plus, Amazon, Venmo, Tinder, iRobot, Coinbase, and The Washington Post. These services all rely on AWS to provide cloud computing for themin fact, AWS is the leading cloud computing provider among other big players like Microsoft Azure, Google, IBM, and Alibaba.

To understand why the impact was so big, and what steps that companies can take to prevent something like these disruptions in the future, it makes sense to take a step back and take a look at what cloud computing is, and what its good for.

Whenever you connect to anything over the internet, your computer is essentially just talking to another computer. A server is a type of computer that can process requests and deliver data to other computers in the same network or over the internet.

But running your own server isnt cheap. You have to buy the hardware box, install it somewhere, and feed it a lot of power. In many cases, it needs internet connectivity too. Then, to ensure that data is received and sent with minimal delays, these servers need to be physically close to its users.

Additionally, you have to install software that needs to be updated regularly. And you have to build fail-safe mechanisms that will switch over operations to another server if a main server malfunctions.

[Related: Facebook has an explanation for its massive Monday outage]

The thing that companies like Amazon noticed is that a lot of [computing infrastructure] is not really specific to the service youre running, says Justine Sherry, an assistant professor at Carnegie Mellon University.

For example, the code running Netflix does something different compared to the code running a service like Venmo. The Netflix code is serving videos to users, and the Venmo code is facilitating financial transactions. But underneath, most of the computing work is actually the same.

This is where cloud providers come in. They usually have hundreds to thousands of servers all over the country with good bandwidth. They offer to take care of the tedious tasks like security, day-to-day management of the data center operations, and scaling services when needed.

Then you can focus on your [specialized] code. Just write the part that makes the video work, or the part that makes the financial transactions work. Its easier, its cheaper because Amazon is doing this for lots and lots of customers. Sherry explains. But there are also downsides, which is that everyone in the world is relying on the same couple of Costco-sized warehouses full of computers. There are dozens of them across the US. But when one of them goes down, its catastrophic.

What caused the AWS outages appeared to be related to errors with the automated systems handling the data flow behind the scenes.

AWS explained in a post that the December 7 error was due to a problem with an automated activity to scale capacity of one of the AWS services hosted in the main AWS network, which resulted in a large surge of connection activity that overwhelmed the networking devices between the internal network and the main AWS network, resulting in delays for communication between these networks.

[Related: A Look Inside the Data Centers of The Cloud]

This autoscaling capability allows the whole system to adjust the number of servers its using based on the amount of users on the network. The idea there is if I have 100 users at 7 am, and then at noon, everyone is on lunch break Amazon shopping and now I have 1,000 users, I need 10 times as many computers to interact with all those clients, explains Sherry. These frameworks automatically look at how much demand there is and can dedicate more servers to doing whats needed when its needed.

Later on December 15, a status update issued by AWS said that the outage was caused by traffic engineering incorrectly moving more traffic than expected to parts of the AWS Backbone that affected connectivity to a subset of Internet destinations.

Big data centers have lots of internet connections through different internet service providers. They get to choose where online traffic gets routed, whether its over one cable through AT&T, or another cable through Sprint.

Their automatic traffic engineering decides to reroute traffic based on a number of conditions. Most providers are going to reroute traffic mostly based on load. They want to make sure things are relatively balanced, Sherry says. It sounds like that auto-adaptation failed on the 15th, and they wound up routing too much traffic over one connection. You can literally think of it like a pipe that has had too much water and the water is coming out the seams. That data ends up getting dropped and disappears.

Despite some prevalent outages over the past few years, Sherry argues that AWS is quite good at managing their infrastructure. Inherently, its very difficult to design perfect algorithms that can anticipate every problem, and bugs are an annoying but regular part of software development. The only thing thats unique about the cloud situation is the impact.

[Related: Amazons venture into the bizarre world of quantum computing has a new home base]

A growing number of independent companies are turning to third-party centralized services like AWS for cloud infrastructure, storage, and more.

If I pay Amazon to run a data center for me, store my files, and serve my clients theyre going to do a better job than I can do as an university administrator or as an administrator to a small company, says Sherry. But from a societal perspective, when all of these small individual actors decide to outsource to the cloud, we wind up with one really big centralized dependency.

During the time AWS went out, Sherry could not control her television. Normally, she uses her phone as a remote control. But the phone does not directly talk to the TV. Instead, both the phone and the TV talk to a server in the cloud, and that server is orchestrating that in-between. The cloud is essential for some functions, like downloading automatic software updates. But for scrolling through cable offerings available from an antenna or satellite, theres no reason that needs to happen, she says. Were in the same room, were on the same wireless network, all Im trying to do is change the channel. In short, the cloud can offer convenient tech solutions in some instances, but not all.

[Related: This Is Why Microsoft Is Putting Data Servers In The Ocean]

One account of a marooned technology that struck her most as an unnecessarily roundabout design was a timed cat feeder that had to go through the cloud. Automated cat feeders have been around a long time before the cloud. Theyre basically paired to an alarm clock. But for some reason, someone decided that rather than building the alarm clock part into the cat feeder, they were going to put the alarm clock feeder in the cloud, and have the cat feeder go over the internet and ask the cloud, is it time to feed the cat? Sherry says. Theres no reason that that needed to be put into the cloud.

Moving forward, she thinks that application developers should review every feature thats intended for the cloud and ask if it can work without the cloud, or at least have an offline mode thats not as completely debilitating during an internet, data center, or even power outage.

There are other things that are probably not going to work. Youre probably not going to be able to log in to your online banking if you cant get to the bank server, says Sherry. But so many of the things that failed are things that really should not have failed.

Read the original:
AWS outages and cloud computing, explained - Popular Science

The cloud has had a major impact on data-driven medical research, enabling breakthroughs that otherwise would have taken substantially longer to happen. Such is the case with the massive, orchestrated effort that went into the development of COVID-19 vaccines.

Using cloud computing and artificial intelligence (AI), researchers developed the vaccines in less than a year, and the effort required collaboration by various entities in the private and public sectors pharmaceutical companies, hospitals, non-profit organizations, and government agencies. The monumental undertaking involved sharing large volumes of data as new discoveries occurred.

The development of these vaccines certainly is a major achievement for the pharmaceutical field. But there are several other examples of how cloud computing supports advancements in medicine, such as wearables devices that connect doctors and patience, storage of medical records, and remote surgery.

What makes the cloud so attractive to medical researchers comes down to the same characteristics that make it valuable in other fields elasticity, scalability, and the capacity to handle massive data volumes.

"One of the incredible powers of the cloud is that ability to scale up quickly," said Adam Glick, senior director of portfolio marketing for APEX Cloud Services at Dell Technologies. "Processing large amounts of drug discovery and trial data more quickly helps get lifesaving medications to people that need them faster. Imagine that you are in phase 2 trials for a new treatment, or you're in a much earlier stage doing drug discovery, and you want to analyze the data you're collecting. The ability to get data analysis in minutes as opposed to days can radically change the speed of drug discovery and approval, which ultimately mean saving more lives."

Without access to a cloud infrastructure, Glick added, the time and financial requirements to procure and set up the environment to conduct data-driven research are much higher. And once the project is completed, much of the servers and infrastructure used in the research may sit idle since they're no longer needed.

But with the cloud, "you can scale up your resources quickly and then you can process the data much faster," Glick said. This translates to faster development of life-saving drugs and treatments.

The cloud also plays a role in connected medical devices. Currently, 10 to 15 connected devices are used at each hospital bed. The global market for connected medical devices is expected to reach $158 billion in 2022, up from $41 billion in 2017.

Remote devices such as blood pressure, glucose, and heart monitors stay connected with clinics and physician offices, maintaining a continuous flow of data that helps enhance patient care. In some cases, timely data transmission can limit damage to a patient and even prevent death. If a device detects a problem with a patient, it can send an alert to dispatch an ambulance. In stroke and heart attack situations, a quick response can help minimize the impact on a patient.

Data transmitted from medical devices increasingly leverages edge networks, which place computing and analytics close to data sources and users to enable real-time decisions. But data that isn't used for real-time responses is stored in the cloud, where it can later be useful for research leading to new treatment methods and the development of therapeutic drugs.

Whether supporting operating rooms, wearable medical devices, or lab workers involved in critical research, the cloud already has proven critical to healthcare.

COVID-19 vaccines illustrate just how important the cloud can be, but as technologies and AI evolve to work together with the cloud, the list of possibilities of what medical researchers can accomplish is growing by the day.

Find out how APEX Cloud Services can help your R&D efforts.

This post was created by Insider Studios with Dell Technologies APEX.

Read this article:
How the Cloud Helps With Medical Research and Remote Medicine - Business Insider

Description

Thecloud security marketsize is valued atUSD 34.5 billion in 2020and is expected to register a 14.3% CAGR during the forecast period (2021-2027). Cloud security is one of the important aspects taken into consideration by every company that has shifted its business to the cloud. Most organizations are using multiple cloud servers and looking for a unified way to secure them, which will boost the growth of the cloud security market. Many enterprises use CASB software that integrates cloud service users and cloud applications for monitoring activity and enforcing security policies.

Request for Report Sample:https://www.marketstatsville.com/Cloud-Security-Market-will-reach-USD-68.5-billion-by-2025

The increasing sophistication of cyber espionage, cybercrimes, and new cyberattacks are the key factors that boost the growth of the cloud security market. Moreover, increasing data leakage and data breaches in enterprises are creating the demand for cloud security and are expected to accelerate the growth of the cloud security market.

Due to trust issues, small and large enterprises are hesitant to move all their data to the cloud. This factor is estimated to impede the growth of the cloud security market. Additionally, the rise in the number of government initiatives to support smart city projects is investing in cloud computing technology, which increases the demand for cloud security and fuel the growth of the global market.

The impact of the COVID-19 pandemic on the cloud security market was relatively mild compared to other industries. Since all the government and regulatory authorities have mentioned to both public and private organizations to work remotely and maintain social distancing, digital business has increased. On the other perspective internet penetration across the corners of the globe has also increased exponentially. This results in cloud security growth in the later stages of lockdown to ensure safety from malicious attackers and hackers.

Request for Buy Full Report: https://www.marketstatsville.com/buy-now/Cloud-Security-Market-will-reach-USD-68.5-billion-by-2025

The report outlines the global cloud security market study based on service, security type, application, and region.

Cloud Security Market Regional Outlook

The global cloud security market has been segmented into five geographical regions: North America, Asia Pacific, South America, Europe, and the Middle East and Africa (MEA). North America, followed by Europe and the Asia Pacific, has the largest share in the global cloud security market, owing to the high adoption of IT security services. Further, Asia Pacific is the fastest-growing global cloud security market.

Request for Report Table of contents: https://www.marketstatsville.com/table-of-content/Cloud-Security-Market-will-reach-USD-68.5-billion-by-2025

The global cloud security market is fairly fragmented, with the presence of a large number of small players across the globe. The vital cloud security manufacturers operating in the global market are

The cloud security market report thoroughly analyzes macro-economic factors and every segments market attractiveness. The report will include an in-depth qualitative and quantitative assessment of the segmental/regional outlook with the market players presence in the respective segment and region/country. The information concluded in the report includes the inputs from primary interviews.

Full Report Analysis: https://www.marketstatsville.com/Cloud-Security-Market-will-reach-USD-68.5-billion-by-2025

See the rest here:
Cloud Security Market 2021 is Expected to be on Course to Achieve Considerable Growth to 2027 mainlander.nz - mainlander.nz

By Indrajeet Ghorpade General Manager Technical Services at Rahi Systems

The year 2020 and 2021 witnessed Data Explosion, there was an exponential rise in the generation and storage of data as work went virtual and businesses adopted digital services. 2022 will not only experience the quick cloud deployments for specific applications but a complete overhaul of enterprise systems embracing cloud migration.

As per a survey conducted by Forbes, 83% of the enterprise workload will be stored on the cloud by the end of 2021. The current shared cloud model is less flexible in terms of controlling it but it offers ease of access and high security. 94% of businesses experienced a significant improvement in security after migrating to the cloud, according to Salesforce.

Augmenting the best of public and private cloud environments with the hybrid cloud will continue to be a major trend continuing from 2021. Cloud has emerged as the most efficient data storage and application management solution. It has enabled organizations to focus on their core services. This article highlights the innovation and ongoing advancements in cloud computing infrastructure identified by Rahis cloud experts.

Cloud service providers like Amazon (AWS Lambda), IBM Cloud Function, and Microsoft Azure Functions are offering serverless cloud computing services. A relatively new concept, the serverless cloud is gaining huge traction as it provides a true pay-as-you-go service and users dont need to pay a fixed amount for storage or lease a server.

Serverless technology does not imply that servers are not present; servers are present, but users only use them without getting into the setups and technicalities. Also referred to as the functions-as-a-service, it can be utilized by startups and small businesses to rapidly upscale their business leveraging serverless architectural solutions with minimal capital investments.

Serverless infrastructure is infinitely scalable, and the expenses spent are dependent only on consumption, allowing businesses to pay for the exact cloud services they utilize. According to Mordor Intelligence, the serverless computing market is expected to grow at a CAGR of over 23.17% during the year 2021-2026.

As per IDG, 92% of organizations are hosting their IT infrastructure on the cloud, 55% are using multiple cloud systems with 21% of organizations using 3 or more cloud systems. This exponential growth in cloud adoptions created a new vulnerability for bad actors to compromise the IT systems. Cybercrime saw a steep increase of 630% in the January to April period only.

The recent breach in which over a million email addresses were exposed of GoDaddy customers shows that cloud security is critical and requires a proactive approach to fill up blind spots in the system. As per AllClouds Cloud Infrastructure Report, 28% of respondents consider security as one of the most important criteria in selecting the cloud service provider. Cloud offers the flexibility and operational efficiency an organization needs to grow and scale at ease but at the same time, it opens a gateway for cybercriminals via multiple entry points.

A major trend to counter cloud-based security issues is the use of Cloud Access Security Brokers (CASBs). CASBs are cloud-based security enforcement points placed between the cloud user and service provider. It can be on-premise or cloud-based security policy enforcement points and consolidates multiple security enforcement measures. Over 50% of organizations dont have a proper security framework for their cloud applications. Cloud adoptions saw a huge jump, cloud security comes next.

According to CDP Global, climate change will cost global businesses $1.3 trillion by 2026. Cloud significantly reduces the power consumption at the users end as physical IT infrastructure is handled by the colocation facility providing the cloud services. Maximum power consumption occurs due to the Always on infrastructure, powerful computing engines, massive digital storage requirements, etc.

Out of 9 consideration factors, 80% of consumers list sustainability as the most crucial while selecting a service provider. A wider audience is emerging who want their brand ethics to be in line with the values of service providers. With 44% of CEOs planning on net-zero futures, it is now increasingly important to take the best of highly efficient cloud operations. Adopting a public cloud reduces carbon dioxide emissions by 59 MT per year. Noticing the sustainability impact of cloud, it will be a very important trend in 2022 and years to come.

Tech giants around the world will be focussing on becoming net zero in 2022, Amazon the largest cloud service provider is also the biggest buyer of renewable energy resources for its data centers. Going green is more of an environmental necessity than just a trend to follow. Businesses globally are relying on the cloud for most of their operations, with advanced digital transformation. Rahis cloud experts are always evolving to bring the best of the cloud to your IT infrastructure.

If you have an interesting article / experience / case study to share, please get in touch with us at [emailprotected]

See the article here:
Top Cloud Computing Trends Shaping Our IT Landscape in 2022 - CRN - India - CRN.in