Security of End User based Cloud Services Sang Young

Transcription

1 Security of End User based Cloud Services Sang Young Chairman, Mobile SIG Professional Information Security Association

2 Cloud Services you can choose Social Media Business Applications Productivity Applications Agile Infrastructure Website Hosting Mobile Enablement Storage Centralized Reference:

3 Graphic Source:

4 Cloud Services Characteristics Zero capital investments Zero maintenance cost On demand self service Rapid elasticity and scalability Ubiquitous network access

5 Well known Cloud Service Dropbox Evernote Google Services Microsoft Office 365 Apple icloud etc

6 Threats in Using Cloud Service Client Tool Authentication Data Transmission Data Storage Avaliability

7 Cloud Service Clients Web Browser Customized Client (Windows, MacOS X, Linux etc) dropbox evernote Mobile Apps

8 Security depends on Web Browser Operating System Security Patches Level Microsoft Windows, MacOS X, Linux User Privilege on the PC Administrators, Power Users, Users Which Browser? Chrome, Firefox, IE, Safari Browser version & Security Patches level Browser Configuration

9 Security Depends on Customized Clients Operating System Patches Level User Privilege on the PC Client Configuration Vulnerabilities in Cloud Services Client e.g. the issue of %APPDATA%\Dropbox\config.db in DropBox. e.g. weakness that let hacker stole all username & password in Evernote

10 Mobile Apps Security Depends On Platform ios vs Android Jailbreak or Rooted Any vulnerabilities in Apps? Dropbox for Android allows other apps to access its content database allowing attackers to upload your files to the public

11 Authentication Authentication Methods Password based may become insufficient The evil of Save Password Automatic login how secure the credentials stored in client computer?

12 Data Transmission Protection in data transmission Communication encryption HTTPS check the Web Browser when using Cloud Service How about Client Application? How about Mobile Apps?

13 Security Controls Encryption Type of encryption? Key Management? Data Storage Does Encryption enable?

14 Communication Availability The reliability of your network connection Dial up Broadband Wi Fi GPRS/EDGE/3G/HSDPA/HSPA+/LTE/LTE A Bandwidth Consideration Latency Consideration

15 Service Providers Availability Technical Problems Network outage Servers down Storage system down Services malfunction Information Security Incident Out of Business Can you migrate an accounting data from one provider to another? (hint: there is not standard data format in cloud computing world)

16 Availability in cloud based infrastructure is Feb 2009: Gmail outage for 2.5 hours Mar 2009: Microsoft Azure outage for a day Jun 2009: Amazon EC2 outage for 4 hours Apr 2011: Amazon EC2 outage for 3 hours

17 Availability of Microsoft Office 365 Sep 2011: includes Microsoft Office 365, Hotmail, Skydrive and Live Services

18 Availability of Apple icloud Nov 2011: Apple icloud service is not available for some users

19 Availability of Apple icloud Nov 2011: Apple icloud service is not available for some users

20 Security Incident of Cloud Services Oct 2009: T Mobile, lost customer all sidekick data Apr 2011: Epsilon, customer data were stolen by hacker Jun 2011: Dropbox, allowed any password to be used to access any user account

21 Security Incident of Cloud Services Nov 2013: Instagram, photo sharing services had an outage Facebook, partial outage that affected timeline & page contents WhatsApp, change of Daylight Savings time crashed the platform More incidents in:

22 Cloud Incidents Categories AutoFail DataLoss Hack Outage Vulnerability

23 Countermeasures Authentication: Using two setup verification

24

25

26 Data Transmission Countermeasures Encrypted Channel (e.g. Using Secure Wi Fi Only) HTTPS

27 Data Leakage Encrypt before upload (e.g. password protected a file using Zip) Countermeasures Slide 27

28 Leverage Security Controls Difference among cloud services providers Providers give you security functions and features, not help you to configure it. You should take primary responsibilities to secure it

29 AWS Checklist Published by Amazon uditing_security_checklist.pdf

30 Conclusion Cloud Services is still in stone age Encrypt your data, if possible, before uploading to cloud service provider Encrypt your communication traffic HTTPS / VPN Local copy of data for backup purpose Contingency if Internet connection outage Provider services suspend Reputation of Providers Keep up to date of your cloud service clients Password

31 About PISA A not for profit organization for local information security professionals. Focus on developing the local information security market with a global presence in the industry

32 Mission to facilitate knowledge and information sharing among the PISA members to promote the highest quality of technical and ethical standards to the information security profession, to promote best practices in information security control, to promote security awareness to the IT industry and general public in Hong Kong

33 Web Site: Contact PISA Membership Information: