Virtual infrastructure has become the backbone of cloud computing, particularly in the area of infrastructure-as-a-service. This is why the latest attack on EC2 demonstrated by MIT researchers garnered a fair amount of attention in the press.

This is an attack against virtual computing resources, not necessarily against EC2 per se. In fact, this attack can potentially work against any virtual infrastructure, private cloud included.

Does this mean that there is a security vulnerability within EC2? Yes.

Should you be concerned? Not really.

This is an example of a "side-channel" attack. For this attack to be feasible, certain conditions must be true a priori. These conditions include that the attacker has knowledge of when the victim virtual machines would be launched. Some of these conditions, though not entirely impossible, are on the impractical side. While the author concedes that it is possible that an espionage attack with high-valued stakes may very well undertake such a method, it is hardly a concern for run-of-the-mill computing tasks running in EC2.

A detailed description of the attack and possible countermeasures can be found on my personal blog. Check http://chenxiwang.wordpress.com/category/cloud-security/.

What this attack highlights is that the security of cloud computing has everything to do with security within the virtual infrastructure. What does this mean? Providers of IAAS must take extreme care when it comes to security and privacy of their operations, or risk facing far-reaching consequences.

Here at Forrester, I’m starting a study to investigate the security and privacy practices of leading cloud providers. I’ve identified Salesforce.com, Google, Microsoft, and Amazon as the four vendors that I would study initially. I have yet to make Amazon commit to an interview, but the former three have all expressed willingness to participate in this study. I will write more as the study gets underway. Until then stay tuned and let me know what you think …