Investigation reveals serious cloud computing flaws

A UK security company has revealed the long-awaited details of a research study involving four cloud service providers (CSPs) that pinpointed serious cloud computing data security problems, including the ability for customers, in some cases, to access each others' stored data. Context Information Security initially brought the issues to light a year ago when it carried out research to test the security of four CSPs.

In April 2011, Context produced a white paper detailing the tests it carried out against Amazon EC2, Gigenet, Rackspace and VPS.net. Context  did not name the four CSPs at the time, but it released the names today. Context outlined a range of security failings it had found as well as issues customers should consider when moving to a CSP.

At the most basic level, Context found the virtual machines (VM) provided by all four CSPs lacked up-to-date security patches and did not have antivirus software included. In addition, some of the CSPs had backdoors to allow their own administration staff to have access to the VMs. But the most serious flaw, detected at the time in offerings from Rackspace and VPS.Net, was that data left by one customer was not deleted automatically and could conceivably show up on the VM belonging to the next customer using that disk space.