Tag Archive for 'Cloud Security'

By Geoff Webb, Director of Product Marketing at Credant Technologies

Whenever the subject of cloud computing comes up there are two facts that seem to dominate the conversation.  The first is that enterprises and small business would desperately like to make greater use of the explosion in new cloud services and offerings.  However the discussion will usually rapidly turn to the fact that the potential of the cloud remains out of reach for many business uses.  The reason?  Security.

By Kevin Steinhardt (Flickr)

Concerns over the security of information in cloud infrastructures, especially public cloud infrastructures, continues to stifle adoption of cloud services and shackles many organizations to traditional approaches to providing business IT services.

Fundamentally, the concerns over cloud security fall into two broad buckets: concerns over availability, and concerns over confidentiality.  And it’s not hard to see why businesses are afraid to plunge into the cloud.

In March 2011 a prolonged period of interruption to Amazon’s Elastic Block Storage (part of the AWS offering) caused a large number of websites to go suddenly, and painfully, dark.  While the problem was nothing more sinister than a simple administrator error, it did cause many to rethink the assumption that “cloud” implied “always on.”

While the need to protect against service interruption is worrying, the solution is at least reasonably well understood — not relying on a single service or service provider.  Even during Amazon’s rather infamous March outage, those organizations that had planned ahead for such an eventuality suffered far less than those who had not.

Keeping information in the cloud confidential is a more difficult proposition.   In June 2011, cloud storage provider Dropbox also suffered a simple administrative error.  But rather than rendering systems unavailable, it had quite the opposite effect.  For a period of four hours *everything* was available.  Access to Dropbox storage accounts suddenly and unfortunately, no longer required the correct password.  While Dropbox quickly remedied the problem, the fact that it happened at all underscored the concern that businesses already felt about storing information in the cloud.  Specifically, who’s watching the security on this stuff and who has access to it?

So are these concerns justified?  Well, probably.  While service providers like Amazon and Dropbox clearly provide great value, and rarely make mistakes that cause problems, such mistakes are inevitable in the long run.  And as more and more data moves out into the cloud, so the impact of mistakes, failed security controls, lax hiring procedures, or disgruntled insiders will continue to affect more and more customers.

Yet none of these are new to businesses, and with good planning, such problems can be overcome or, at least, minimized.  And therein lies the rub, because it is the difficulty of planning for such events that causes such concern.  The integration of cloud and traditional security practices is not a simple one.  Technical, as well as process, hand-offs are often unclear to both provider and customer alike, and this complexity introduces opportunities for both accidental and malicious attack that are new to many organizations.

However, what if rather than being the source of security concerns, the cloud could also offer a solution too?  In September the Cloud Security Alliance released their first whitepaper defining Security as a Service, offered through the cloud.

The idea behind the paper is to start to define the various security services that could be offered as cloud-hosted products, including such areas as encryption, security information and event management, email security and so on.

What we are seeing, then, is an emerging and maturing element to cloud security, and it opens up some interesting possibilities.

For example, by creating security services specifically hosted in the cloud, confusion over who has responsibility may be reduced, as new vendors emerge to essentially ‘own’ many of the cloud-specific problems.  This approach of delivering security services through the cloud also offers up the prospect of broadening the types of security technologies available to small and medium businesses who may have been unable to afford them in the past, or to help larger organizations reduce their IT security spend without impacting overall security capabilities.

Finally, it may allow businesses to more clearly and cleanly ensure segregation of duties between the cloud service provider (for example, a storage provider) and the security functions, which could now be delivered through a specialized third party.

It’s now clear that the cloud computing is evolving and maturing fast.  While the cloud definitely causes IT security and compliance organizations considerable headaches, the possibility exists that cloud-specific security services may actually benefit everyone in the long run.  Most importantly, they may enable organizations of all kinds to safely, and securely, move more fully into the cloud.

Europe needs to become not only cloud-friendly but “cloud-active” to fully realize the benefits of cloud computing. That’s the view of  ETNO (The European Telecommunications Network Operator‘s Association) in a recently-issued paper on cloud computing development in Europe, which emphasized the importance of relieving obstacles surrounding data privacy and security.

Courtesy of Alexander Kirk (Flickr)

Fragmented regulations are a particular problem in Europe, where sometimes restrictive legislation of the EU and individual Member States has stifled the development of cloud computing services. ETNO reiterates that rules governing data transfer should be simplified, especially if the transfer is within the same group of companies. Furthermore, ETNO concludes that there is no need for applying specific regulatory or legislative action on cloud computing in Europe. It should suffice to apply general rules of data protection and consumer protection to cloud computing – as with other sectors of industry.

Unified Standard Needed
What will be most beneficial for cloud computing development in Europe is the creation of an international standard based on a unified and consistent approach to online privacy, enabling companies to compete on the same level as US market leaders, the ETNO says. Such a global framework would give providers equal foundation for offering cloud services and the same level of protection for all cloud users.

Unfortunately for the EU, regulations are currently fragmented between the 27 EU Member States when it comes to consumer contracts – increasing compliance costs significantly for service providers that want to offer cross-border cloud services.

Contractual agreements are imperative

ETNO makes a clear distinction of cloud services for companies/organizations and for individuals, and points to the importance of service contracts between service providers and companies always clearly including clauses that specify the applicable law and jurisdiction in the event that any disputes or controversies arise between the parties. This is very important, as the jurisdiction of the service provider often coincides with the location of the end-user, i.e. where the service is provisioned. However, national consumer laws should normally apply when it comes to cloud services for individuals.

Cloud federation addresses interoperability and portability issues

One of the problems intrinsically linked to cloud computing service provisioning may be the complex value-chain of multiple entities or service providers that may be subject to divergent jurisdiction and regulations. These interlinked value-chains must then apply to certain contractual rules and agreements that are homogeneous and transparent to the end-user.

Also, ETNO acknowledges the potential lock-in situation end-users can experience, not being able to easily transfer their service from one service provider to another. The way to address the portability and interoperability problem is to deploy the “federation model,” where end-users establish a business relationship with a “home” cloud provider or broker and obtain the requested cloud resources they need online – regardless of who the seller might be.

This is similar to well-known models from the travel industry including online services like Expedia and Orbitz that offer a single interface to multiple source service providers (flights, hotels, car rentals, etc.).  At the same time, it’s important to understand that the federation model may not always be feasible due to additional costs incurred.

A guest article by Arjan de Jong, Marketing Manager at Jitscale

In early August, a lightning strike at a transformer owned by one of Amazon’s power suppliers caused a major failure in Amazon Web Services’ European cloud. The power outage affected, among others, the Elastic Compute Cloud (ECS) and Rational Database Service (RDS) cloud services.

According to the Amazon Web Services status page, a transformer from an energy supplier for one of the availability zones (EU-WEST-1 region) in Dublin was struck by lightning. An availability zone is a set of hardware that supports cloud services and that functions independently of other zones. According to the site, the cloud services were weakened by the impact. Since the cloud services are composed of complex software components, Amazon had to assign more hardware to restore its cloud services after the power had been restored.

Courtesy of Brilhasti1 (Flickr)

This is the type of event that causes some businesses to doubt the benefits of cloud computing and to believe that it is not a safe or reliable method of hosting data. While these doubts are understandable, the fact is there are a variety of techniques a cloud computing company can apply to mitigate disruption caused by weather events and resulting power outages.

One option, depending on a client’s business requirements, is for the cloud provider to distribute its servers over multiple availability zones (AZ). This redundancy provides excellent protection from localized emergencies such as a lightning strike, power surge or other severe weather related events.

For other customers, monitoring and frequent back ups can mitigate problems when incidents occur. With careful monitoring, engineers will be informed immediately when servers are unreachable. Then, using snapshots of all servers taken on an hourly basis, it is possible to boot the relevant servers in AZ’s that are available.

Several physical redundancies can also help to mitigate problems. These include redundant power supplies and backup generators that are tested to assure they will kick on when the power fails-unlike Amazon’s generators in Dublin. Using redundant Internet connections running simultaneously provides a backup if one provider fails or is performing poorly. Redundant hardware, such as multiple hard drives and other components, can be arranged so that if one fails, another immediately and seamlessly take its place.

According to a new survey from the Cloud Industry Forum of 450 organizations in the UK, almost half (48 percent) are already using cloud computing in some shape or form.

The survey showed high levels of satisfaction with cloud service providers, but lingering confusion about business interruption issues and the consequences of downtime.

Courtesy of Edwård (Flickr)

The Cloud Becomes Mainstream

The survey suggests that cloud services are no longer a buzzword, but already in widespread practice. Not surprisingly, the private sector is leading the way, with far higher uptake of cloud services than seen with their public sector counterparts. Medium to large companies are at the forefront of cloud adoption, as opposed to the small businesses with less than 20 employees or the public sector.

The survey findings also show that the decision to migrate to the cloud is now predominantly made by the head of IT, rather than CEOs or managing directors (MDs). In smaller companies without IT departments, the decision is mostly taken by the MD or owner.

Cloud services are maturing

An overwhelming majority of respondents (94 percent) is satisfied with the use of cloud services and happy with the results of their use of the cloud. This definitely indicates that the market is maturing and service providers are successfully offering cloud services that are meeting customer expectations. Only a few mid- to large-scale enterprises mentioned difficulties with the migration to the cloud, which should not come as a surprise.

Increasing cloud adoption rates

Similarly, the majority of respondents expect their use of cloud services to increase significantly in the next 12 months, especially with email services, data back-up and data storage services. Also, one-third of those not currently employing cloud services claimed that they anticipated adopting them in the next year, and almost two-thirds believe that their companies will eventually employ cloud services.

Data security and location

Not surprisingly, many respondents claim that they are reluctant to move sensitive data to the cloud, especially employee information, account/financial data. Data security and data privacy were cited as the number one concern.

Also, the physical location of data and jurisdiction was another area of concern for cloud users, preferring to have the data stored in the UK or EU. This development is interesting as it reflects natural concerns driven by regulation and that national law provides a higher level of comfort to cloud users. Enterprise users clearly want to know where their data is stored in the cloud at all times and be aware of the legislation of the particular jurisdiction where the data resides.

However, as a sign of immaturity of the cloud market, only about half of respondents employing cloud services negotiated the legal terms of their contract with their cloud service provider (CSP), with larger organizations more likely to do so. Furthermore, the study reveals that users are in the dark over questions of liability, indemnity, insurance and ownership of content in the cloud. Some uncertainty also exists about the issue of business continuity and risk management. Forty-three percent claimed that their insurance covered business interruption from a disaster at the CSP’s data center or a data leak. Two-thirds believed this should be covered by the CSP – indicating an uncertainty of responsibility and accountability. Certainly this reflects the importance of establishing a wider insurance industry and best practices guidelines.

Flexibility is the primary driver

When it comes to the primary driver of cloud adoption the overwhelming reason is flexibility, according to 53 percent of respondents. Interestingly, cost savings were cited by only 16 percent as the primary driver for initial cloud adoption – a contradiction with the emphasis that cloud service providers have put on cost savings as the primary selling proposition. It seems that the cloud is affording businesses large and small, public and private, the flexibility they need to adapt to the ever changing business environment.

(Written by Danny Lieberman, www.software.co.il)

Several factors combine to make data security in the cloud a challenge.

Web applications have fundamental vulnerabilities. HTTP is the cloud protocol of choice for everything from file backup in the cloud to Sales force management in the cloud. HTTP and HTML evolved from a protocol for static file delivery to a protocol for 2 way applications – a purpose for which they  were never designed; let’s examine some of the data security issues with the current rich content Web 2.0 model:

1. The multiple layers at the server side from db server to Web server or App server are vulnerable to attack since the Web application passes messages to the data tier through several interfaces in order to execute SQL.  The interfaces are vulnerable, in particular to SQL injection

2. HTTP is a stateless protocol. As a result, the simplest kind of Ajax application generates dozens of http transactions between the client and the server. The simplest autocomplete floods the pipe with Ajax transactions.  If you have ever put a sniffer like Wireshark on the line you will see this.  The rich interactivity on the client with Ajax generates a huge, disproportionate amount of traffic and a high price tag for simple operations.   For example – in a tcp socket-socket link, if you want to know if there are new mail messages, no polling is required and the message length is just a few bytes. This is primarily a latency and load issue on the cloud computing infrastructure but also creates additional difficulties in detecting data loss and opens the door for network-based attacks such as a slow POST DDOS attack.

3. Passing messages between remote process (client and server) inside the query string is patently a bad idea that is not remedied by using https (although if you pass privacy data in a query string you must use https). It is a bad idea because it is fragile (may break on software changes) and vulnerable to any number of software bugs and exploits from buffer overflow to sql injection to simple query hacking.  To get a feel for the order of magnitude of the problem, just google for web application security.

The current rich Web 2.0 model is broken, not because Javascript or PHP are bad, it’s just that the existing Web application stack on server and client is a bad fit to the world of applications.

There is little free market demand for software security. The key demand-side driver for cloud computing is that it is a service that can be consumed at a  variable cost like a utility. We might think that with all the headlines on data security breaches,  that consumers would be discerning about the security of the service.  However,  data loss risk is negligible in a consumer buying decision since people use applications based on their utility and productivity and beauty of the UI not because of their security, since we all assume that the security is built-in.  The cloud model requires the consumer to consider impact of data loss, similar to considering the impact of a power spike on home appliances with digital controllers.  Data security in the cloud won’t happen by itself.

Enforcing data security in the cloud is harder than in the enterprise. Trusted insiders can exploit application vulnerabilities no matter where the application runs.  However, our ability todetect data loss inside the cloud is far less than our ability to detect data loss inside an office network and more expensive to mitigate in a virtualized operating system environment.

Inside an enterprise network, you can put procedural, network monitoring and DLP solutions into place, however the same security countermeasures may not be supported by your cloud provider as a standard item.   By implementing custom countermeasures in the cloud, you won’t enjoy the economy of scale of a shared, virtualized infrastructure nor benefit from the experience curve of the cloud service provider.  It will become your problem.

Data security is about economics. If you want guaranteed service levels on the security of your IP and customer data that you store in a SaaS system, you need to RFP and negotiate the appropriate contract and security countermeasures (encrypting data at rest and in motion, employee monitoring, key management, data loss prevention, malicious software detection and more).  Compliance with PCI DSS 2.0 and HIPAA may come at additional cost.

Data security in the cloud is a cost borne upstream by the customer and downstream by the cloud provider.

From a cloud service provider perspective, note that there are high fixed costs involved in providing capacity, customer support and secure infrastructure while the revenue from consumers is variable. Consumers that adopt a hybrid model for cloud delivery will have additional fixed and variable costs of operation.

In order to protect your data in the cloud, I suggest adopting some common-sense best practices:

• Before moving your application to the cloud, do some attack modeling and consider the value of your assets to be stored in the cloud, versus the cloud service costs and custom security measures you may (or may not need) to implement
• Invest in software security. Remember that hackers attack your software, not your security procedures.
• After you set a budget, choose a cloud service according to your threat model and read their dotted line on data security before committing

Businesses must be aware of the security risks associated with different cloud deployment models, i.e. privae, hybrid or public. To start with, it is important to map out the data flow from the current infrastructure to an eventual cloud service provider, whether in a private or public context. It is essential to understand if and how data can move in and out of the cloud. Having a high-level understanding of the security risks involved also enables businesses to understand which security and risk controls are appropriate to be executed, and to act proactively.

The three primary service modes in cloud computing; SaaS, PaaS and IaaS also represent different security approaches for businesses. In the case of SaaS, the service provider is responsible, or should be, for maintaining acceptable service levels and security, governance, compliance and liability expectations. However, in the case of PaaS and IaaS the customer is responsible for effectively manage the same expecations, while the service provider normally ensures at least some degree of securing the underlying platform and infrastructure components.

CSA also points to the importance of classifying risk in relation to each service mode and location of assets. For example, in a hybrid cloud context, both the customer and service provider can be responsible for the same risks. The problem is that sometimes it is difficult to distinguish between when and who should take accountability. Due to lack of information of security controls maintained by the service provider, customers can also be misguided – potentially leading to wrong decisions and adverse outcomes.